Merum Privacy Policy

Effective date: September 23, 2026

Merum shows you one view of everything you own. To do that, it reads your account balances and holdings. This policy explains what we collect, why, who else touches it, and what you can do about it.

Who we are

Merum is made by Deadrise Systems LLC, a Virginia company. When this policy says "we" or "Merum," it means Deadrise Systems LLC. You can reach us at [email protected].

What we collect

Account basics. Your email address and password. Passwords are stored hashed, following standard security practice. If you sign in with Apple or another provider later, we receive the identifier and email that provider shares.

Plaid. When you connect a bank or brokerage, you sign in through Plaid, not through us. Plaid sends us the institution name, account name, type, last four digits, balances, and holdings. We do not receive your login credentials. Plaid may ask you to share transactions so it can keep your balances current; we do not read or store your transactions.

Connected exchanges. When you connect a crypto exchange, you grant read-only access through the exchange's own sign-in or a read-only API key. We check that the key cannot trade or withdraw before we accept it. We receive your balances and quantities.

Watch-only wallets. If you add a self-custody wallet, you give us a public address, extended public key, or descriptor. We refuse anything that looks like a private key or seed phrase. We use the address to read balances from the blockchain.

Manual entries. Anything you type in yourself: an asset name, a quantity, a value, a date.

Purchases. Subscriptions are handled by Apple through the App Store. Apple tells us whether your subscription is active. We never see your payment card.

Technical data. If the app crashes or errors, we receive the device model, operating system version, and a description of the error. We strip balances, account numbers, and tokens from these reports before they leave your device.

Support. If you email us, we keep the email so we can answer it.

What we do not collect

We do not collect your precise location, your contacts, your photos, advertising identifiers, or your browsing activity. We do not use tracking pixels or third-party analytics that profile you across apps.

How we use your data

We use your data to operate Merum: to show your net worth, keep your connected accounts current, price your holdings, convert currencies, keep the app reliable, answer your questions, and comply with the law. We do not use your financial data to build marketing profiles, train models, or make decisions about you.

Who we share it with

We share data only with the companies that help us run the service, and only what each one needs:

• Plaid, which connects your bank and brokerage accounts. Plaid's handling of your data is governed by the Plaid End User Privacy Policy.
• Supabase, which hosts our database and sign-in.
• Cloudflare, which serves our website and network infrastructure.
• Apple, which processes subscriptions and distributes the app.
• Blockchain data providers, which see the wallet addresses you add so we can read balances.

Each of these is bound by contract to use your data only to provide their service to us. We may also disclose data if the law requires it, to protect our users or the public, or if Merum is sold or merged, in which case this policy will still apply to your data and we will tell you first.

We do not sell personal information and we do not share it for cross-context behavioral advertising.

Partner privacy policies

Each partner handles the data it receives under its own policy:

• Plaid
• Apple
• Supabase
• Cloudflare

How we protect it

Your data is encrypted in transit and at rest. Access tokens and API keys are stored encrypted on our servers, never on your device. Merum has read-only access to your accounts, so even a full compromise of Merum could not move your money. No system is perfectly secure; if we learn of a breach affecting your data, we will notify you without unreasonable delay.

Your choices and rights

• Disconnect any account, exchange, or wallet at any time. We delete its data and revoke our access.
• Edit or delete any manual entry.
• Export your data in a machine-readable format on request.
• Delete your account by emailing [email protected]. We delete your data within 30 days, except records we must keep by law or for security, which we keep only as long as required.
• Ask us what we hold about you, or to correct it, by emailing [email protected]. We will respond within 45 days and will not treat you differently for asking.

If you live in a state with additional privacy rights, such as California, you have those rights too, and the same email is the way to use them.

How long we keep it

We keep your data while your account is open. Balance history stays so your net-worth chart works. When you disconnect an account or delete your Merum account, the related data is deleted as described above. Backups roll off within 30 days after that.

Age requirement

Merum is for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has an account, email us and we will delete it.

Changes

We may update this policy from time to time. The date at the top shows the current version.

Contact