Privacy

Information processed

When you sign in through Auth0 at auth.n3wth.com, the connector uses your verified account identifier to associate your connection with your account. It stores an internal user ID, the authentication issuer and subject, connection identifiers, connection status, environment, and timestamps in Cloudflare D1.

When you request a financial tool, the connector retrieves the requested information from Lunch Money, such as accounts, transactions, categories, tags, recurring items, or budget summaries. It processes those results to answer your request and does not persist financial responses in its database.

Your Lunch Money token

You enter your token in Nango's browser-based connection flow, not in chat. Nango stores the token. The connector retrieves it temporarily to make allowed requests to the Lunch Money API. The connector enforces financial reads only, even if the token itself has broader permissions.

Who receives information

Auth0 handles authentication. Nango handles credential storage and connection setup. Cloudflare runs the connector and stores identity and connection records. Vercel hosts the website and routes requests to the connector. Lunch Money processes requests made to its API.

Requested financial results are returned to the MCP client you choose, and may be sent to that client's model provider. Your client's privacy settings and provider policies govern their handling and retention of those results. This connector does not control or delete your chat history.

Website and operational logs

The website's example conversations use fictional data and run locally. Basic website usage counts are enabled by default: we send landing-page view, Connect-click and successful setup-prompt-copy events to PostHog US Cloud to understand usage and improve the website. Each event has a new random identifier; we do not use it to link visits or create a person profile.

These events contain only the event label, a fixed site label, and privacy-control fields. We do not send financial data, credentials, chat content, page URLs, query strings, referrers, or user identities. We do not use session recording, automatic interaction capture, advertising tracking or analytics cookies. We replace the analytics IP property with a placeholder and disable geolocation enrichment. PostHog still receives network information such as your IP address when your browser connects to its servers.

We use these statistical counts for our legitimate interest in improving the website, where applicable law permits. You can disable usage counts at any time; this stops future events. Only an explicit preference is saved in local storage for 180 days. Global Privacy Control and Do Not Track signals prevent collection. Opting out does not affect the service. Authentication providers may use cookies on their login pages.

Connector telemetry in Cloudflare contains allowlisted event labels, requested tool names and HTTP status codes, so we can measure request volume and reliability. Tool counts represent authenticated requests admitted by rate limits, not necessarily successful results. It includes no user identifiers, tool arguments, tokens, connection links, request bodies, or financial results. Hosting and authentication providers may retain their own operational or security logs, including network information such as IP addresses. These operational counts are separate from optional website analytics and are not sent to PostHog.

Disconnecting and retention

Call lunchmoney_disconnect to delete the Nango connection. The connector marks the connection deleted after success; if deletion fails, access may remain active, so retry and confirm success. Disconnecting does not revoke the original Lunch Money token: revoke it in Lunch Money to prevent its further use elsewhere.

Identity records and connection lifecycle records remain after disconnect to preserve ownership and prevent replay or reconnection races. The service does not currently apply an automatic expiry period to these records. Infrastructure backups and provider logs follow the respective providers' retention settings. Uninstalling a plugin alone does not disconnect the service.

For a request about your information or removal of retained connector records, contact oliver@newth.ai. Do not include API tokens or financial records in your email.

Website analytics are hosted by PostHog in the United States. This integration does not configure an automatic event-deletion period; events remain subject to the project's retention settings until deleted. Because event identifiers are not retained in your browser or linked to your identity, we may be unable to locate individual analytics events in response to a request. See PostHog's privacy notice for its handling of information.

Your privacy rights

Depending on your location, you may have rights to access, correct, delete, restrict or object to processing of your personal information, request portability, withdraw consent, and complain to your local data-protection authority. Contact oliver@newth.ai to exercise these rights. We use operational records to provide and secure the connector, relying on our legitimate interests where that legal basis applies. We do not sell personal information or share it for cross-context behavioral advertising.

Questions and changes

Contact oliver@newth.ai with privacy questions. Changes to the connector's data handling will be reflected on this page with an updated date.