Privacy Policy

Overview

Oberlin24 is a bookkeeping and tax-prep tool for rental-property owners. It runs on the web and on iPhone. It connects to your bank, reads the bills and receipts you send it, sorts each transaction onto the right Schedule E line, reconciles your accounts, and exports a return your accountant can use.

This policy covers what we collect to do that, how we use and protect it, who else is involved, how long we keep it, and how you can see or delete it. You use the same account on the web and on iPhone, so this applies to both.

1. Information We Collect

Information you give us

• Account details. Your name and email, used to create and secure your account.
• Property and financial records. The properties, units, leases, tenants, vendors, loans, and transactions you enter or import.
• Documents you send. Receipts, bills, and statements you upload or forward, including photos you take or pick from your library.

Bank account data (via Plaid)

When you connect a bank, we use Plaid Inc. to pull your account and transaction data. We never see or store your bank login.

• Account names, types, and balances
• Transactions, with dates, amounts, merchant names, and categories
• Institution details we need to keep the connection working

Email documents (via Gmail, optional)

If you connect Gmail, we use read-only access to find rental bills and receipts and read their attachments. We never send email, change your mailbox, or read anything unrelated.

Camera and photos (optional)

On iPhone you can add a receipt or bill by taking a photo or picking one from your library. We use the camera or photos only when you choose to add an image, and we upload only the image you pick. We don't browse your library.

Automatically collected

• Security and audit logs. Sign-ins, consent actions, and other key events, with timestamps, to keep your account secure.
• Basic device and session data, which keeps you signed in and the app reliable.
• Product usage. Which screens you visit and roughly how long you spend on them, tied to your account, so the operator can see what's useful and fix what isn't. Screen-level detail is deleted after 12 months.

2. How We Use Your Information

• Keep your books: categorize transactions, reconcile accounts, and maintain a double-entry ledger.
• Read the documents you send to pull out the vendor, amount, date, and category, and match them to the right transaction.
• Prepare your taxes: sort expenses onto the right Schedule E lines and generate exports.
• Run the in-app assistant, which shows a preview before it saves anything.
• Keep your account secure, prevent fraud, and meet tax-record and legal requirements.

3. AI Processing

To read your documents and run the assistant, we send the needed content to AI providers (Anthropic and OpenAI) through their business APIs. Under those terms, your data is not used to train their models. We send only what the task needs, and the assistant always shows a preview before it writes anything to your books.

Assistant chat recording

We keep a record of your assistant conversations (the question, the answer, and which tools ran) to find and fix bad answers. Before anything is stored, tax IDs and account-number-like digits are masked. The conversation text is deleted after 90 days; only anonymous quality metrics are kept longer. You can turn recording off any time in Settings → Data, and the chat window says this while you use it. Recordings are reviewed only by the operator to improve the assistant, and are never shared or sold.

4. Third Parties We Share With

We share data only with the services we use to run the app. Each is bound by its own data-protection terms:

• Plaid, for bank connections and transaction data. See Plaid's End User Privacy Policy. You can review and manage what you've shared at my.plaid.com.
• Google (Gmail), for optional read-only document access. See Google's Privacy Policy. Our use follows the Google API Services User Data Policy, including its Limited Use rules.
• Anthropic and OpenAI, for AI processing of documents and assistant requests. They don't use your data to train their models.
• Railway, for cloud hosting and our database.

Otherwise we share data only when the law requires it. We never sell your data.

5. How We Protect Your Data

• In transit. All traffic uses TLS.
• At rest. Sensitive fields, including access tokens, are encrypted (AES-256-GCM) with a master key kept out of the code.
• Bank credentials. We never receive them. Your login goes straight to Plaid.
• Sign-in. Passwords are hashed, and you can turn on two-factor auth (TOTP).
• Access and auditing. Every record is tied to your account, and key events are written to a durable log.

6. Data Retention

• Financial records. Kept while your account is active, and for tax purposes usually up to 7 years.
• Account information. Kept while your account is active.
• Assistant chats. Conversation text is deleted after 90 days (see AI Processing).
• Security and consent logs. Kept for security and compliance.

When you delete your account, we remove your data right away (see below). We keep a few records only where the law requires it.

7. Your Rights and Choices

• See and export your data in JSON or CSV.
• Edit or correct your records anytime.
• Disconnect a bank or Gmail connection instantly in settings.
• Withdraw a permission you granted earlier, anytime.

For anything you can't do in the app, email us using the details below.

8. Children's Privacy

Oberlin24 is for adults managing rental property. It isn't meant for anyone under 18, and we don't knowingly collect data from children.

9. Changes to This Policy

We may update this policy as the app changes. We'll update the "Last updated" date above, and for big changes we'll let you know in the app. If you keep using Oberlin24 after an update, that means you accept the new policy.

10. SMS / Text Message Alerts

Oberlin24 offers an optional text-message alert program so you can be notified about your own bookkeeping, for example when rent has not been received by the expected date, when a charge is unusually large versus normal, or when an account has drifted out of reconciliation.

• Opting in. You enroll yourself at oberlin24.com/sms-alerts by entering your own mobile number, checking the consent box, and verifying the number with a one-time code. Consent to receive texts is never a condition of any purchase.
• Message frequency. Frequency varies based on your account activity, typically a few messages per day at most.
• Cost. Message and data rates may apply, depending on your mobile carrier and plan.
• Opting out. Reply STOP to any message to unsubscribe at any time, or HELP for help.

We do not sell or share your mobile number, or any information collected as part of the SMS opt-in, with third parties or affiliates for their own marketing or promotional purposes. Your mobile information is used solely to deliver the alerts you asked for.

11. Contact

Questions about this policy or your data:

• Email: oberlin24info@gmail.com
• Response time: we acknowledge privacy inquiries within 72 hours.