Trajectory by Northline

Trajectory by Northline Privacy Policy

Effective date: October 17, 2026

1. Who we are

"Northline", "we", and "us" mean the operator of Trajectory by Northline ("Trajectory"), available at https://northlinecloud.com.

Contact: johnrepass.agent@gmail.com

2. What Trajectory is

Trajectory is a web application that reads your bank account balances and transactions and uses them to track financial goals ("lags") and to forecast your cash. Trajectory only reads data. It does not move money, make payments from your accounts, or initiate transfers.

Trajectory is for users in the United States who are 18 years of age or older. When you create an account, you confirm that you are 18 or older.

3. Data we collect

3.1 Account data that you give us:

  • Your email address.
  • Your password. We store only a hash of the password, produced by the Better Auth library. We do not store the password in readable form.
  • The date and version of the disclaimer that you accept before subscribing.

When you create an account, you must confirm that you are 18 or older. Our server checks that confirmation before it creates the account. We do not store the confirmation itself.

3.2 Bank data that Plaid sends us after you connect a bank (see section 5):

  • For each connected institution: the institution name, an encrypted Plaid access token, a sync cursor, and a connection status.
  • For each account that you share: the account name, official name, the last four digits of the account number (the "mask"), the account type and subtype, and the current and available balance. We do not receive or store the full account number.
  • For each transaction: the amount, currency, date, description, merchant name, category, and pending status.

3.3 Data that you enter in Trajectory:

  • Goals (lags), actions (leads), check-ins, tags, account groups, account nicknames, bills (including an exact amount or a new due day you set for one upcoming bill, and whether you marked its due date as changeable), planned items, and saved what-if scenarios.
  • Manual (cash) accounts with a starting balance and as-of date, and the manual transactions (date, merchant, amount, tag) that you type in or that a bot you authorize adds or creates (see section 8).
  • Public Bitcoin or Ethereum wallet addresses, or a Bitcoin extended public key (xpub), that you add, if you use that feature (see section 10). We never ask for or accept private keys or seed phrases.
  • Email addresses of household viewers that you invite (see section 7).
  • Your forecast simulation settings (for example the horizon, number of paths, spending multiplier, a what-if amount and date, the cash floor, and the random seed). These are settings only; the simulation itself runs on our server from your existing balances and transactions, and its results are not stored.

3.4 Technical data:

  • Session records. For each sign-in session we store a session token, the expiry time, your IP address, and your browser user-agent string.
  • Bot API records. For each reader key: a hash of the key, a short prefix, a label, and the creation, last-used, and revoked times. For each Bot API request: the key identifier, the requested path, and the time.
  • Server logs. The server writes operational and error messages to its log.

3.5 Payment data (see section 6): your Stripe customer identifier, Stripe subscription identifier, subscription status, and the end date of the current billing period. We do not receive or store your card number.

4. How we use the data

We use the data only to:

  • Create and secure your account, and keep you signed in.
  • Retrieve your balances and transactions from Plaid.
  • Show you your balances, transactions, goals, and forecasts, and compute forecasts and what-if results.
  • Suggest transaction tags by fixed rules. A suggestion is applied only when you accept it.
  • Give read access to household viewers and to bots that you authorize.
  • Charge your subscription through Stripe and control access when billing is not current.
  • Detect and stop abuse, and keep the service secure.

We do not use your data to make credit decisions.

5. Plaid

Trajectory uses Plaid Inc. ("Plaid") to connect to your bank, through a single Plaid application operated by Northline for all users. We use the Plaid Transactions product for institutions in the United States, in Plaid's production environment, so you connect your real bank accounts. You do not provide your own Plaid keys.

5.1 What Plaid receives. When you select "Connect a bank", Plaid's window opens and you enter your bank sign-in details there. Plaid receives those details. We do not receive, see, or store your bank username or password.

5.2 What we receive and store. After you connect, Plaid gives us an access token. We encrypt the access token and store it in our database, and use it to request your account and transaction data from Plaid. We request up to 730 days of transaction history when you first connect, and then request updates. Balances come from the account data Plaid provides with those updates; we do not request a separate real-time balance check. Section 3.2 lists the data we store.

5.3 Choosing accounts. On Plaid's account screen you can leave accounts unselected. We do not import an account that you do not share. Some banks require all accounts to be shared; in that case you can hide an account inside Trajectory.

5.4 Plaid's own policy. Plaid processes your data under the Plaid End User Privacy Policy: https://plaid.com/legal/#end-user-privacy-policy. By connecting a bank, you allow Plaid to give us the data in section 3.2.

5.5 Disconnecting. You can disconnect a bank in Trajectory. When you disconnect, we ask Plaid to remove the connection and at once delete that institution's accounts and transactions, with the tags on those transactions, tag and set suggestions, and set links made from them. When Plaid confirms the removal, we delete the stored access token. If Plaid does not confirm the removal, we keep only the encrypted access token, show the bank as not yet removed, and try again each time your data refreshes, or when you press "Try removing again"; we delete the token as soon as Plaid confirms.

Transactions that Plaid reports as removed (for example, a pending charge that the bank dropped) are kept, marked as removed, until you disconnect that bank or delete your account. They are not shown as current activity.

5.6 Pausing. If you pause your account (Settings, Billing, "Pause account"), we ask Plaid to remove every bank connection and we delete the stored access tokens, so Plaid stops sending us data. We keep the accounts, transactions and tags we already have as read-only history; they are not updated while paused. When you resume and connect a bank again, Plaid sends new transactions. A new transaction that matches an old one (same account, same amount, date within 3 days) takes over the old one's tags, and the old one is marked as replaced. Old transactions with no match are marked archived. We do not delete these old records automatically; they are deleted when you delete your account.

6. Stripe

We use Stripe, Inc. ("Stripe") to process subscription payments. Paid subscriptions are not yet open to the public: billing is currently configured in Stripe's test mode, and no real charges are made. When billing goes live, you will enter your card details on a Stripe page. Stripe receives and stores your card details; we do not receive or store your card number. Stripe sends us payment events (for example, "invoice paid" or "payment failed"), and we store the items in section 3.5. Stripe processes your data under its privacy policy: https://stripe.com/privacy.

7. Household viewers

You can invite another person, by email address, to view your Trajectory data as a household viewer. We store the invited email address. A viewer creates their own sign-in with that email address and can see your balances, transactions, goals, and forecasts, except accounts you hide. Viewers cannot change your data. You can remove a viewer in the app at any time; their access ends immediately. You are responsible for the people you invite.

8. Bot API and reader keys

You can create a reader key in Trajectory and give it to a bot that you control (for example, Grok Bot). The bot uses the key to read your data through the Bot API.

  • A reader key is read-only. A bot cannot change your data with it. A what-if request computes a result without saving anything.
  • Optional write key. If the operator turns bot writes on for the server, you can create a separate key that may also create manual cash accounts and add transactions to your manual (cash) accounts, and nothing else. It cannot change bank-linked accounts, rename or delete accounts, edit or delete transactions, or move money. Bot writes are off unless turned on, and existing keys stay read-only.
  • We show a key one time, when you create it, and store only a SHA-256 hash of the key and a short prefix.
  • You can hold up to five active keys and revoke a key at any time. A revoked key stops working immediately.
  • We record each Bot API request (key, path, time), and for a write, the id of the account or transaction it added.

When you give a key to a bot, the bot and the service that runs it receive the data that the bot reads (and, for a write key, can create manual cash accounts and add manual transactions), including balances and transactions. That service processes the data under its own terms and privacy policy, not this policy.

9. Hosting and security

Trajectory runs on Amazon Web Services (AWS) in the United States (us-east-1).

  • The application runs on an AWS EC2 server and accepts web traffic only over HTTPS (TLS).
  • The database is an AWS RDS PostgreSQL database. It is encrypted at rest, requires TLS, and does not accept connections from the public internet.
  • We encrypt Plaid access tokens and other stored secrets before writing them to the database. The encryption key is kept outside the database, in AWS Secrets Manager with the other application secrets.
  • Each user's data is separated by user.
  • We limit the rate of sign-in and API requests.
  • Database backups are kept for one day.

No system is completely secure. If a breach affects your personal data, we will notify you as the law requires.

10. Other service providers

In addition to Plaid, Stripe, and AWS:

  • Let's Encrypt issues our HTTPS certificate. It does not receive your personal data.
  • mempool.space, Blockstream (blockstream.info) and Blockscout (eth.blockscout.com). If you add a Bitcoin address or xpub, our server sends the public address (for an xpub, the public addresses derived from it) to mempool.space, or to Blockstream when mempool.space is unavailable, to read its balance and recent transactions, when you add it, refresh it or open it; it also reads the current BTC price from mempool.space. If you add an Ethereum address, our server sends it to Blockscout to read its balance. These services see the address and our server's IP address, not your name, email, or IP address. If you do not add a wallet, nothing is sent to them.

We do not use third-party analytics, advertising, or error-tracking services. Trajectory pages do not load fonts, scripts, or images from third-party servers; the link-preview image is served from northlinecloud.com.

11. Cookies and browser storage

We set the following cookies. They are necessary to keep you signed in.

  • __Host-grok-auth.session_token: your session token. A session lasts up to 7 days and is renewed while you use the app.
  • A short-lived signed session-data cookie (up to 5 minutes) that caches your session.

We do not use advertising or tracking cookies.

12. No sale of data and no advertising

We do not sell your personal data, do not share it for advertising, and do not show advertising.

13. Retention

We keep your data while your account is open, including while it is paused (section 5.6). A paused account keeps its bank history read-only, but no bank access tokens. When you delete your account, we delete your data as section 14 states, except data the law requires us to keep. Database backups that contain your data expire within one day. Stripe keeps its own payment records under its policy.

14. How to delete your data

In the app: open Settings, then "Delete my Northline account", and type DELETE to confirm. For an account owner this immediately:

  1. Asks Plaid to remove each bank connection.
  2. Deletes your access tokens, accounts, transactions (including archived and replaced ones kept from a pause, and ones Plaid reported as removed), pause status, manual and wallet accounts, goals, leads, check-ins, tags, bills, planned items, scenarios, tag and set suggestions, forecast settings, display preferences, the time of your last manual refresh, reader keys, Bot API records and alerts, and your household-viewer list.
  3. Cancels any Stripe subscription and deletes our link to your Stripe customer record. Stripe keeps payment records under its own policy.
  4. Deletes your sign-in, sessions, and password hash.

For a household viewer, it deletes your sign-in, your forecast settings, and your viewer invitation; the owner's data is not affected.

A signed-in person who is not in any household sees the same confirmation on the page they land on. That deletes their sign-in, sessions, password hash, and any invitation addressed to their email. An empty workspace they own, with no other members, is removed with that sign-in. It does not delete another person's household, accounts, or transactions, and it does not delete a workspace that still has ledger data or other members.

By email: you can also send an email from your account email address to johnrepass.agent@gmail.com with the subject "Delete my Trajectory account". We will carry out the same steps and confirm by email.

You can also, at any time: pause your account (section 5.6; this is not deletion), disconnect a bank, revoke a reader key, remove a viewer, delete a manual account, and export your data as CSV or JSON.

15. Age

Trajectory is only for persons 18 years of age or older, and sign-up requires you to confirm that you are. We do not knowingly collect data from persons under 18. If you think a person under 18 has an account, contact us and we will delete it.

16. Your rights

You can ask for a copy of your data, a correction, or deletion by email to johnrepass.agent@gmail.com.

17. Changes to this policy

We may change this policy. We will post the new policy at https://northlinecloud.com/privacy with a new effective date. If a change reduces your rights or adds a new recipient of your data, we will tell you by email or in the app before it takes effect.

18. Contact

johnrepass.agent@gmail.com