How Yield Clarity protects your financial data

• Your plans: assets, values, contributions, spending and assumptions.
• Your account: name, email, sign-in details and plan subscription.
• Not your full card details. Those stay with the payment provider.

• Passwords are stored hashed, never in plain text.
• Two-factor sign-in with an authenticator app, with ten recovery codes for when you lose your device.
• Changing your password or email needs your current password; turning off two-factor sign-in also needs a code.
• Sessions expire, and signed-in requests are checked against your current account.

• You see only your own plans and plans shared with you.
• A shared plan gives access to that plan alone, as View only or Can edit; billing and your other plans stay private.
• Key access checks are covered by automated tests.
• Connections to Yield Clarity are encrypted in transit. Two-factor secrets, broker credentials and statement imports in progress are also encrypted by the application.

• Connections are read-only: Yield Clarity cannot place trades, move money or change your brokerage account.
• Credentials are stored encrypted and used only to read from the provider.
• Depending on the provider, imports cover account balances, positions and, where offered, transactions and dividends.
• You can pause, disconnect or remove a connection at any time.
• Available on Plus and Pro for supported providers: one connection on Plus, more on Pro.

• PDF statements up to 20 MB, including password-protected files.
• The file is read in memory to extract transactions; the original isn't stored.
• Extracted transactions wait, encrypted, for your review and are cleared once you confirm or cancel. Confirmed transactions are saved to your plan.
• Profile photos are kept in private storage and shown only to signed-in users.

• Payments are processed by Paddle. Of your payment details, Yield Clarity keeps only the payment type, card brand, last four digits, expiry date and cardholder name, to show on your billing page.
• Yield Clarity runs on established cloud infrastructure providers.
• Market-data providers receive the instruments being priced, not who holds them.
• The marketing website uses Google Analytics, which you can turn off at any time from Cookie settings in the footer.
• If you arrive through an affiliate partner's link, our affiliate platform, Tolt, records the referral so the partner can be credited.

• Delete holdings, assets and plans yourself in the app.
• Downgrading never deletes data; plans above your new limit become read-only.
• Reports export as PDF, CSV or JSON on Plus and Pro. They cover your portfolio and plan, not a complete copy of your account.
• To close your account or request a copy of your personal data, email privacy@yieldclarity.com.

Reporting a vulnerability