Privacy Policy

Effective May 21, 2026Version 2026-05-21Contact privacy@diru.ai

At diru, we take your privacy seriously. Please read this Privacy Policy to learn how we treat your personal data. This Privacy Policy explains how diru LLC (“diru,” “we,” “our,” or “us”) collects, uses, stores, processes, and discloses information when you access or use the diru mobile application, website, products, software, features, content, and related services (collectively, the “Services”).

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of information as described herein.

Remember that your use of diru's Services is at all times subject to our Terms of Use, which incorporates this Privacy Policy. Any terms we use in this Policy without defining them have the definitions given to them in the Terms of Use.

If you do not agree with this Privacy Policy, please do not use the Services.

If you have questions regarding this Privacy Policy, you may contact us at privacy@diru.ai.

Summary of our Privacy Policy

Our goal is to help users better organize, understand and plan their finances while maintaining transparency regarding how personal information is handled.

In order to provide the Services, we collect certain information relating to your account, financial connections, device usage, and interactions with the platform.

We do not sell your financial data.

Because diru is currently offered as a private beta product, certain Services may be experimental, incomplete, or subject to change as we continue improving the platform.

What information do we collect?

We may collect personal information that you voluntarily provide directly to us, information automatically collected through your use of the Services, and information obtained from connected financial institutions and third-party providers.

The categories of information we may collect include:

Account information, such as your name, email address, username, profile image, account credentials, linked authentication providers, and related profile information.
Financial information, including balances, transactions, account names, account types, budgeting information, financial goals, net worth information, manually entered financial data, liabilities, investment information, recurring payment information, cryptocurrency holdings, token quantities, and related financial records retrieved through connected financial institutions or third-party providers.
Property and alternative asset information, including property addresses, estimated property values, geolocation-related property information, home value estimates, and related metadata retrieved from third-party providers or integrations.
Shared or couples account information that you intentionally choose to share through shared account functionality.
Billing and subscription information, such as subscription status, renewal dates, trial information, purchase history, transaction identifiers, app marketplace purchase records, and related billing metadata associated with purchases processed through third-party payment providers or app marketplaces.
Uploaded or imported financial files, including CSV, XLSX, PDF, or similar files uploaded in connection with budgeting, net worth tracking, historical financial analysis, or related Services.
Communications and support information, including messages, feedback submissions, support requests, beta feedback, surveys, and correspondence.
AI interaction data, including prompts, requests, financial context, questions, and responses generated through AI-powered features.
Device, technical, and usage information, including IP address, browser type, operating system, device identifiers, crash logs, app activity, session information, analytics data, authentication information, synchronization metadata, integration status information, error logs, and interactions with the Services.
Local device and application information, including locally cached financial summaries, authentication state, app preferences, security settings, invitation management information, and related information stored locally on your device to support app functionality and user experience.
Public, gamified, or community-related information, including display names, rankings, progress indicators, educational activity, learning interactions, XP systems, quests, and related participation information if you choose to engage with community-oriented or gamified features.
Cookie, analytics, and tracking information collected through cookies, SDKs, pixels, analytics tools, session replay technologies, and similar technologies.

The Services may also generate downloadable reports, summaries, or exports in formats such as CSV, XLSX, or PDF, which may contain sensitive financial information once exported outside the Services.

diru may support device-level biometric authentication technologies provided by your mobile operating system, such as Face ID or fingerprint authentication. However, diru does not collect, process, or store raw biometric identifiers or biometric data.

Financial account information

diru utilizes third-party financial data aggregators, including Plaid and other financial technology providers, to connect and retrieve financial information from your financial institutions.

When you connect financial accounts through the Services, you authorize and give your express consent to diru and its service providers to access, retrieve, process, and display financial information associated with your designated accounts, which consent is structured to meet all applicable legal requirements for clarity and scope.

The financial information we receive may include account balances, transaction histories, account ownership information, account metadata, liabilities, investment information, recurring payment information, and related financial records made available by financial institutions or third-party providers.

diru does not directly store your raw bank login credentials, passwords, PINs, or multi-factor authentication credentials.

Connected financial accounts are used to retrieve, organize, and display financial information. diru does not use connected financial accounts to initiate transfers, payments, trades, or other money movement.

Financial institution connections and synced data may be delayed, incomplete, unavailable, interrupted, or inaccurate due to limitations imposed by financial institutions, third-party providers, outages, synchronization delays, or technical interruptions.

How do we use your information?

We may use collected information for the following purposes:

To provide, operate, maintain, and improve the Services.
To create and manage user accounts.
To connect and synchronize financial institution data.
To generate budgeting tools, financial summaries, categorizations, and insights.
To operate AI-powered features and financial organization tools.
To personalize user experiences and improve platform functionality.
To respond to support requests, feedback, and communications.
To monitor usage trends, analytics, and product performance.
To detect, investigate, prevent, or address fraud, abuse, security incidents, unauthorized access, or technical issues.
To comply with legal obligations, regulatory requirements, or lawful requests.
To enforce our Terms of Use and protect the rights, safety, property, or security of diru, our users, or third parties.

We may also use anonymized, aggregated, or de-identified information for analytics, operational improvements, research, security monitoring, and product development purposes.

AI-powered features

The Services may leverage artificial intelligence technologies, including technologies provided by OpenAI and other third-party providers, to generate financial summaries, categorizations, explanations, budgeting insights, or interactive responses.

When you interact with AI-powered features, certain prompts, requests, financial context, and generated outputs may be processed by third-party AI providers in order to provide the requested functionality.

Artificial intelligence systems are probabilistic in nature and may generate inaccurate, incomplete, outdated, or misleading outputs.

Personally Identifiable Information (PII) such as email addresses, full financial account numbers, usernames, and passwords are removed and never sent to third-party AI models for analysis. We may also use information that has been anonymized, aggregated, or de-identified to ensure that data cannot be associated with any specific user, providing an additional layer of protection in the case of a third-party security incident.

You acknowledge that AI-generated content should not be treated as financial, legal, tax, accounting, or professional advice and should not replace independent verification or consultation with qualified professionals.

Shared and couples features

diru may offer shared or couples functionality that allows users to intentionally share financial information, transaction visibility, goals, budgets, or account information with another authorized user.

By enabling shared or couples features, you authorize diru to display selected financial information to linked users within the shared environment.

You understand and acknowledge that once shared access is intentionally granted, certain financial information, transaction history, balances, or manually entered data may become visible to the authorized linked user.

You remain responsible for determining what information you choose to share through shared account functionality.

When and with whom do we share information?

We may share information with service providers, vendors, infrastructure providers, financial data aggregators, analytics providers, cloud hosting providers, AI providers, payment processors, customer support vendors, security providers, and other third parties that help us operate the Services.

These providers may include companies such as:

Plaid
OpenAI
Stripe

We may also disclose information:

when required by law, subpoena, court order, or regulatory request;
to protect the rights, property, safety, or security of diru, users, or others;
in connection with fraud prevention, security investigations, or legal enforcement;
in connection with a merger, acquisition, financing transaction, restructuring, bankruptcy, or sale of assets;
with your consent or at your direction.

We do not sell your financial data.

We do not disclose personal financial information to advertisers for monetary compensation.

Third-party services and providers

The Services may integrate with or rely upon third-party providers, websites, APIs, financial institutions, artificial intelligence systems, cloud infrastructure providers, analytics providers, and other external technologies or services that are not owned or controlled by diru.

diru does not control and is not responsible for the availability, accuracy, security, privacy practices, content, or performance of third-party providers or financial institutions.

Your use of third-party services may also remain subject to the separate terms, conditions, and privacy policies of those third parties.

Cookies, analytics, and tracking technologies

diru may use cookies, SDKs, pixels, analytics tools, session replay technologies, and similar technologies to operate, secure, analyze, and improve the Services.

These technologies may collect information regarding device identifiers, browser type, operating system, IP address, app usage activity, interactions with features, crash reports, pages viewed, session activity, and referring websites or sources.

We may use analytics and infrastructure providers to help us understand usage trends, monitor platform stability, improve functionality, and measure product performance.

Most browsers and mobile operating systems allow you to control cookie preferences through device or browser settings.

Because there is currently no universally accepted standard for recognizing “Do Not Track” browser signals, the Services may not respond to such signals at this time.

Data retention

We retain personal information for as long as reasonably necessary to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, maintain security, prevent fraud, or fulfill legitimate business purposes.

We may retain certain information after account deletion where required by law, for backup purposes, for fraud prevention, security investigations, dispute resolution, or compliance obligations.

We may also retain anonymized, aggregated, or de-identified data that no longer identifies individual users.

Because diru is currently operating as a private beta platform, data retention periods, backup practices, and storage architecture may evolve over time as the Services continue developing.

Data security

We implement reasonable administrative, technical, and organizational safeguards designed to protect personal information from unauthorized access, disclosure, misuse, alteration, or destruction.

These safeguards may include encryption, authentication controls, restricted access policies, infrastructure monitoring, and security procedures designed to protect the Services.

However, no method of electronic transmission, cloud storage, or internet-based infrastructure can be guaranteed to be completely secure. As a result, we cannot guarantee absolute security of information transmitted to or stored within the Services.

You are responsible for maintaining the confidentiality of your account credentials and for using secure devices and networks when accessing the Services.

Children’s privacy

The Services are intended only for individuals who are at least 18 years old.

diru does not knowingly collect, solicit, or market to individuals under 18 years of age. If we become aware that personal information has been collected from an individual under 18, we will take reasonable steps to delete such information.

If you believe that a child under 18 may have provided personal information to us, please contact us at privacy@diru.ai.

Your privacy rights

Depending on your jurisdiction and applicable privacy laws, you may have certain rights regarding your personal information, including the right to request access, correction, deletion, portability, withdrawal of consent where processing is based on consent, objection to certain processing activities, or opt out of certain targeted advertising or data sharing activities where applicable.

You may exercise applicable privacy rights by contacting us at privacy@diru.ai.

We may require verification of your identity before responding to certain requests.

California privacy rights

If you are a California resident, you may have rights under the California Consumer Privacy Act (“CCPA”) and related California privacy laws, subject to applicable exceptions and limitations.

California residents may have the right to request access to categories or specific pieces of personal information collected; deletion of personal information; correction of inaccurate information; information regarding categories of third parties with whom personal information has been shared; and limitation of certain uses of sensitive personal information where applicable.

diru does not sell personal financial information for monetary consideration.

California residents may also have rights under California’s “Shine the Light” law regarding certain disclosures of personal information for direct marketing purposes.

To exercise California privacy rights, please contact privacy@diru.ai.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time as the Services evolve, legal requirements change, or operational practices develop.

If we make material changes to this Privacy Policy, we may notify users by posting updated versions within the Services, by email, or through other reasonable communication methods.

Your continued use of the Services following updated Privacy Policies constitutes acceptance of the revised Privacy Policy.

Contact us

If you have questions, requests, or concerns regarding this Privacy Policy or our privacy practices, you may contact:

diru LLC San Francisco, California privacy@diru.ai