Privacy Policy

Effective Date: January 1, 2026  ·  Last Updated: March 27, 2026

1. Who We Are

Urban Boomerang ("we," "our," or "us") is a community investment platform that enables consumers to automatically direct a percentage of qualifying purchases to community initiatives and foundations. We are operated by Urban Boomerang, Inc.

If you have questions about this policy, contact us at privacy@urbanboomerang.app.

2. Information We Collect

2.1 Information You Provide Directly

• Account information — your name, phone number, city, and ZIP code when you register
• Identity verification information — name, date of birth, address, and last four digits of your Social Security Number (SSN), collected only when you choose to verify your identity to unlock unlimited contributions. This is processed by Plaid Identity and is not stored on Urban Boomerang servers in raw form.
• Communications — messages you send to our support team
• Waitlist information — your email address if you join our waitlist

2.2 Information Collected Through Plaid

When you link a payment card, we use Plaid Technologies, Inc. to establish a read-only connection to your financial institution. Through this connection we receive:

• Transaction data — merchant name, amount, date, and category for transactions at your linked accounts
• Account information — masked account number, institution name, and account type
• Balance information — account balance, used only to verify your card is active

We do not receive your full account number, login credentials, or the ability to initiate transactions. Plaid's access is strictly read-only. Plaid's privacy policy governs how they handle your data and is available at plaid.com/legal/privacy-statement.

2.3 Transaction Matching Data

We analyze your transaction data to identify purchases at participating retailers. This analysis happens automatically and generates:

• Boomerang records — the amount, retailer, and initiative associated with qualifying purchases
• Match confidence scores — how confident we are that a transaction matches a participating retailer
• Spending pattern summaries — aggregated data used by our AI Spending Coach feature

2.4 Device and Usage Information

• Device token for push notifications (if you grant permission)
• App usage data — screens viewed, features used, session duration
• Crash reports and performance data
• IP address and approximate location (city-level only)

3. How We Use Your Information

Specifically, we use your information to:

• Create and manage your account
• Match your transactions to participating retailers and calculate boomerang amounts
• Route funds to your chosen community initiative
• Verify your identity when you choose to unlock unlimited contributions
• Detect and prevent fraud, unauthorized access, and abuse of our platform
• Send you boomerang notifications, account alerts, and (with your permission) marketing communications
• Generate your weekly AI Spending Coach insights (see Section 7)
• Comply with legal obligations, including anti-money laundering (AML) and Know Your Customer (KYC) regulations
• Improve our transaction matching accuracy and platform features
• Resolve disputes and respond to support requests

4. How We Share Your Information

We do not sell, rent, or trade your personal information. We share your data only in the following limited circumstances:

4.1 Service Providers

We share data with vendors who help us operate the platform, including:

• Plaid — financial data connectivity and identity verification
• Stripe — payment processing and fund disbursement
• Firebase (Google) — push notification delivery
• Twilio — SMS delivery for one-time passcodes
• SendGrid — transactional email delivery
• Anthropic — AI model provider for our Spending Coach feature (anonymized spending data only)
• Railway — cloud hosting and database infrastructure

All service providers are contractually required to protect your data and use it only for the services they provide to us.

4.2 Community Initiatives

We share aggregated, anonymized disbursement totals with the initiatives you fund. We do not share your name or personal information with initiatives without your explicit consent.

4.3 Legal Requirements

We may disclose your information if required by law, court order, or government authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Urban Boomerang, our users, or the public.

4.4 Business Transfers

If Urban Boomerang is acquired, merges with another company, or transfers its assets, your information may be transferred as part of that transaction. We will notify you before your information is transferred and becomes subject to a different privacy policy.

5. Data Security

We take security seriously and implement industry-standard protections:

• Encryption at rest and in transit — all data is encrypted using AES-256 at rest and TLS 1.3 in transit
• Plaid access token encryption — your financial institution credentials are stored using separate encryption keys and never exposed to our application layer
• JWT authentication — all API requests require a signed token with a 7-day expiration
• Rate limiting and fraud detection — we monitor for unusual transaction patterns and velocity anomalies
• SOC 2-certified infrastructure — our cloud hosting provider maintains SOC 2 Type II certification
• No CVV or full card number storage — we never see or store your full payment card details

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at security@urbanboomerang.app.

6. Data Retention

• Account data — retained for the life of your account plus 7 years (required for financial record-keeping)
• Transaction data — retained for 7 years from the transaction date
• Identity verification data — retained for 5 years after account closure per regulatory requirements
• Plaid connection data — deleted within 30 days of you unlinking a card
• Device tokens — deleted immediately when you disable notifications or delete your account
• Waitlist data — retained until you unsubscribe or request deletion

7. AI Spending Coach

Our Spending Coach feature uses artificial intelligence to generate personalized weekly spending insights. Here is how your data is handled:

• Your transaction history, nearby retailer data, and community impact stats are assembled into an anonymized context
• This context is sent to Anthropic's Claude AI model to generate your insight
• We do not send your name, phone number, or account credentials to Anthropic
• Anthropic's API is subject to their privacy policy at anthropic.com/privacy
• You can disable the Spending Coach at any time in your Profile → Coach Settings

8. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

8.1 Access and Portability

You may request a copy of the personal information we hold about you. We will provide it in a machine-readable format within 30 days.

8.2 Correction

You may update your account information at any time through the app. For corrections to identity verification data, contact us at privacy@urbanboomerang.app.

8.3 Deletion

You may request deletion of your account and associated data. Note that we are required to retain certain financial records for regulatory compliance. We will inform you of any data we are legally required to retain.

8.4 Opt-Out of Marketing

You may unsubscribe from marketing communications at any time by tapping "Unsubscribe" in any email or updating your notification settings in the app. Transactional communications (boomerang alerts, OTP codes, account security) cannot be disabled while your account is active.

8.5 California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act, including the right to know what categories of personal information we collect, the right to opt out of the sale of personal information (we do not sell personal information), and the right to non-discrimination for exercising these rights. To submit a CCPA request, contact privacy@urbanboomerang.app.

8.6 Unlink Your Financial Account

You may unlink your payment card at any time through Profile → Payment Methods. Upon unlinking, we will stop monitoring new transactions from that account within 24 hours. Historical transaction data is retained per our data retention policy above.

9. Children's Privacy

Urban Boomerang is not directed to children under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected information from a minor, contact us immediately at privacy@urbanboomerang.app and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app and update the "Last Updated" date at the top of this page. Your continued use of Urban Boomerang after changes take effect constitutes your acceptance of the updated policy.

11. SMS & Text Message Communications

Urban Boomerang collects your phone number solely for account verification via one-time passcode (OTP) SMS messages. We do not send marketing or promotional text messages.

What we send: A single 6-digit verification code per login session. Example: "Your Urban Boomerang verification code is: 847291. Valid for 10 minutes. Reply STOP to opt out."

Message frequency: One message per login session. Frequency varies based on account activity.

Message and data rates may apply.

Opt-out: Reply STOP to any message to cancel. You will receive one final confirmation and no further messages will be sent. To re-enable, text START.

Help: Reply HELP or contact privacy@urbanboomerang.app.

SMS data is never sold or shared with third parties for marketing purposes. See Section 4 of this Privacy Policy for full data sharing details.

12. Contact Us

© 2026 Urban Boomerang, Inc. · Terms of Service · Home