Privacy policy

Last updated 9 November 2026

Sift is operated by Builder Operating System Limited ("we", "us"), a company registered in Nigeria. This policy explains what we collect and why. We designed Sift so that your financial data stays with you, in line with the Nigeria Data Protection Act 2023.

The short version

• Your bank statements are opened and read in your own browser. They are never uploaded to our servers.
• Your transactions, balances and account numbers are stored on your device, encrypted.
• Our server only stores your account details and your Ask Sift credits.

What stays on your device

PDF statements, statement passwords, transactions, balances, account numbers, categories, budgets and notes. These are stored in your browser's storage, encrypted with a key that is created on your device and can't be read out of it. We cannot access this data. Clearing your browser data deletes it, so use Settings → Backup to keep an encrypted copy.

What we collect

• Account details: email address, username and a hashed password, so you can sign in.
• Google sign-in: if you continue with Google, we receive your Google account ID, email address and first name (used to greet you). We never see your Google password.
• Payments: a record of Ask Sift purchases (reference, amount, status). Card and bank details are handled by our payment provider, Paystack, and never reach us.
• Email preferences: whether you want the monthly statement reminder, and the month we last sent it.
• Ask Sift usage: the number of questions you've asked and how much AI processing each used, so we can manage credits and costs.
• Bank requests: if you ask us to support a bank, the bank name and the email you give us.
• Basic technical logs kept by our hosting provider (such as IP address and request times) for security.

Ask Sift (AI questions)

When you ask a question, your browser sends the question plus a summary of your totals (for example monthly money in and out, spending by category and top payees) to our server, which passes it to our AI provider, Moonshot AI (Kimi), to produce the answer. Raw statements and account numbers are not sent. We don't store your questions, the summary or the answers on our servers.

Emails we send

Sign-in and password-reset codes, and a monthly reminder to add last month's statement. You can turn the reminder off with the link in any reminder or in Settings. We don't send marketing from third parties.

Cookies and browser storage

We use only cookies needed to run Sift: one that keeps you signed in (it expires after 10 minutes of inactivity), a short-lived one used during Google sign-in, and one that remembers how you last signed in so we can point you to the right button. No advertising or tracking cookies. Your financial data and Ask Sift conversations are kept in your browser's own storage on your device.

Who we share data with

• Vercel (hosting) and Neon (database) — to run the service.
• Resend — to send sign-in codes, password resets and the monthly reminder.
• Google — only if you choose to sign in with Google.
• Paystack — to process payments.
• Moonshot AI — only when you use Ask Sift, as described above.

We don't sell your data or use it for advertising.

Your rights

You can access, correct or delete your account at any time from Settings, or by emailing us. Deleting your account removes your account details and unused credits from our servers; you can also remove all Sift data from your device in Settings. Records of payments you made (reference, amount and date) are kept, without your name or email, for as long as tax and accounting law requires. You may also complain to the Nigeria Data Protection Commission.

Contact

Builder Operating System Limited · admin@builderos.live