Financial Privacy Notice

1. Who We Are

Henry Financial, Inc. (“SirHENRY,” “we,” “us,” or “our”) provides a desktop financial analysis application built on a local-first architecture. SirHENRY is not a registered investment adviser (RIA), broker-dealer, tax preparer, or insurance provider. We provide financial tools and educational information only.

2. Categories of Financial Information We Collect

When you use SirHENRY, we may collect the following categories of nonpublic personal information (“NPI”):

• Information you provide directly — household names, filing status, state of residence, income amounts, employer names, dependent information, financial goals, and insurance policy details.
• Information from financial institutions (via Plaid) — account names, balances, transaction histories, investment holdings, and account metadata. This data is retrieved with your explicit authorization through Plaid's secure connection protocol.
• Information from documents you upload — data extracted from W-2 forms, 1099 forms, pay stubs, and other financial documents you choose to import.
• Application usage data — feature usage patterns, error reports, and consent records. We do not use third-party analytics, advertising pixels, or cross-site tracking.

3. How We Use Your Information

• Local financial analysis — all calculations (tax modeling, retirement projections, portfolio analytics, insurance gap analysis) are performed locally on your device using your locally-stored data.
• AI-powered features (with consent) — when you opt in to AI features, financial summaries (with names and employers replaced by generic labels) are sent to Anthropic's Claude API for analysis. If you use document analysis, the pages you submit (such as tax forms) are sent as images and can contain identifiers that appear on those documents, including Social Security numbers and account numbers — see our Privacy Policy §4 for the full description of what leaves your device.
• Bank data synchronization (with consent) — when you connect a bank account, Plaid retrieves account and transaction data on your behalf and transmits it to your local SirHENRY database.

4. Information We Share

We do not sell your nonpublic personal information. We share information only in the following limited circumstances:

We do not share your information with affiliates for marketing, non-affiliated third parties for their marketing, or joint marketing partners. We do not use advertising networks or data brokers.

5. Your Right to Opt Out

Because we do not share your NPI for marketing purposes with non-affiliated third parties, there is no opt-out required under GLBA. However, you have the following controls:

• AI features — you can revoke AI consent at any time in Settings → Privacy. When revoked, no financial data is sent to external AI services.
• Bank sync (Plaid) — you can disconnect any linked institution at any time in Settings → Accounts. Disconnecting revokes the Plaid access token and stops all data retrieval.
• All data — because your data is stored locally, you can delete it entirely by removing the local database file from your device.

6. How We Protect Your Information

• Local-first storage — your financial database is a SQLite file on your device. We do not hold a copy of it. Two narrow exceptions transit our infrastructure: bank connections made through our hosted Plaid relay (the token and retrieved bank data pass through servers we operate, encrypted with a per-user key), and any error report you choose to send.
• Encryption at rest — Plaid access tokens and sensitive credentials are encrypted using Fernet symmetric encryption (AES-128-CBC + HMAC-SHA256) before storage.
• PII sanitization — before sending data to the Claude AI API, personal identifiers (names, employers) are replaced with generic labels (e.g., “Primary Earner,” “Employer A”).
• No tracking — we do not use Google Analytics, Facebook Pixel, or any third-party tracking services.
• Audit logging — sensitive operations are logged locally (without PII) to help you review data access history.

7. Data Retention and Deletion

Your financial data is retained locally on your device for as long as you choose to keep it. We do not maintain a copy of your financial database on our servers; where our relay is used for bank sync, the connection token and retrieved data are handled as described in Section 4 and our Privacy Policy. You may delete all local data at any time by removing the local database file. Plaid access tokens can be revoked individually through the application, which terminates the connection and deletes the encrypted token from your local database.

8. Annual Notice

Under GLBA, we are required to provide this notice at the time you establish a customer relationship and annually thereafter. This notice is available at any time at sirhenry.app/financial-privacy-notice and will be provided to you via email on an annual basis if you have an active subscription.

9. Changes to This Notice

We will notify you of material changes to this Financial Privacy Notice via in-app notification and email (if available). The current version is always available at the link above.

10. Contact Us

If you have questions about this Financial Privacy Notice or our data practices, contact us at:

Email: privacy@sirhenry.app

Mail: Henry Financial, Inc., Leesburg, VA 20176