Merum Privacy Policy

Effective date: October 26, 2026

Merum shows you one view of everything you own. To do that, it reads your account balances and holdings. This policy explains what we collect, why, who else touches it, and what you can do about it.

Who we are

Merum is made by Deadrise Systems LLC, a Virginia company. When this policy says "we" or "Merum," it means Deadrise Systems LLC. You can reach us at [email protected].

What we collect

Account basics. Your email address and password. Passwords are stored hashed, following standard security practice. If you sign in with Apple, we receive the identifier and the email address Apple shares, which may be an address Apple hides for you.

Plaid. When you connect a bank or brokerage, you sign in through Plaid, not through us. Plaid sends us the institution name, account name, type, last four digits, balances, and holdings. We do not receive your login credentials. Plaid may ask you to share transactions so it can keep your balances current; we do not read or store your transactions.

Connected exchanges. When you connect a crypto exchange, you grant read-only access through the exchange's own sign-in or a read-only API key. We check that the key cannot trade or withdraw before we accept it. We receive your balances and quantities.

Watch-only wallets. If you add a self-custody wallet, you give us a public address, extended public key, or descriptor. We refuse anything that looks like a private key or seed phrase. We use the address to read balances from the blockchain.

Manual entries. Anything you type in yourself: an asset name, a quantity, a value, a date.

Purchases. Subscriptions are handled by Apple through the App Store, and Apple takes the payment. When you subscribe, the app gives Apple your account's internal identifier, so that Apple's notices tell us which account a purchase belongs to. Apple then tells us the state of your subscription: the plan, whether it is in its free trial, active, being retried or ended, the date it renews or ends, and the number Apple gives the purchase, which carries no name, email or payment details. We never see your payment card. Apple keeps its own record of your purchases under its privacy policy.

Notification address. If you allow notifications, your phone gives Merum an address that Apple's notification service uses to reach it, called a device token. We keep it on our servers with your account, share it only with Apple to deliver a notification, and use it for nothing else.

Technical data. If the app crashes or errors, we receive the device model, operating system version, and a description of the error. We strip balances, account numbers, and tokens from these reports before they leave your device.

Usage data. We record how the app is used: which screens you open, whether a connection succeeded, and counts such as how many holdings you have and in which asset classes. These records are keyed to your account's internal identifier, never to your name or email, and they never contain balances, values, account numbers, or institution names. We use them to understand what works and what does not. On merum.money we record how the site is used the way most websites do: the pages you visit, the site that linked you to us, any campaign tag on the link, your browser, operating system, screen size and approximate location, what you click, and a replay of your visit in which anything you type is hidden. These are keyed to a random identifier in a first-party cookie, not to you, and they are sent only to our own domain.

Support. If you email us, we keep the email so we can answer it, and so we can respond to requests we are required to answer under applicable law. Deleting your account does not delete our correspondence with you.

What we do not collect

We do not collect your precise location, your contacts, your photos, advertising identifiers, or your browsing activity. We do not use tracking pixels, advertising identifiers, or analytics that profile you across apps or sites. The usage data above is first party: it is not shared for advertising, and it is deleted with your account.

How we use your data

We use your data to operate Merum: to show your net worth, keep your connected accounts current, price your holdings, convert currencies, keep the app reliable, answer your questions, and comply with the law. We do not use your financial data to build marketing profiles, train models, or make decisions about you.

Who we share it with

We share data only with the companies that help us run the service, and only what each one needs:

• Plaid, which connects your bank and brokerage accounts. Plaid's handling of your data is governed by the Plaid End User Privacy Policy.
• Supabase, which hosts our database and sign-in.
• Cloudflare, which serves our website and network infrastructure.
• Google, whose Workspace hosts our support and privacy mailboxes, so a message you send us is stored there.
• Postmark, which delivers the emails we send you: your sign-in and password-reset codes, and account notices. It sees your email address and the message.
• Sentry, which receives our error and system logs: the technical data described above.
• PostHog, which stores the usage data described above, in the United States.
• Apple, which processes subscriptions, delivers notifications and distributes the app.
• Blockchain data providers, which see the wallet addresses you add so we can read balances.

Each of these is bound by contract to use your data only to provide their service to us. We may also disclose data if the law requires it, to protect our users or the public, or if Merum is sold or merged, in which case this policy will still apply to your data and we will tell you first.

We do not sell personal information and we do not share it for cross-context behavioral advertising.

Partner privacy policies

Each partner handles the data it receives under its own policy:

• Plaid
• Apple
• Supabase
• Cloudflare
• Postmark

How we protect it

Your data is encrypted in transit and at rest. Access tokens and API keys are stored encrypted on our servers, never on your device. Merum has read-only access to your accounts, so even a full compromise of Merum could not move your money. No system is perfectly secure; if we learn of a breach affecting your data, we will notify you without unreasonable delay.

Your choices and rights

• Disconnect any account, exchange, or wallet at any time. We delete its data and revoke our access.
• Edit or delete any manual entry.
• Export your data in a machine-readable format on request.
• Delete your account in Settings, or by emailing [email protected]. We delete your data within 30 days, except records we must keep by law or for security, which we keep only as long as required.
• Ask us what we hold about you, or to correct it, by emailing [email protected]. We will respond within 45 days and will not treat you differently for asking.

If you live in a state with additional privacy rights, such as California, you have those rights too, and the same email is the way to use them.

How long we keep it

We keep your data while your account is open. Balance history stays so your net-worth chart works. When you disconnect an account or delete your Merum account, the related data is deleted as described above. Backups roll off within 30 days after that.

Age requirement

Merum is for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has an account, email us and we will delete it.

Changes

We may update this policy from time to time. The date at the top shows the current version.

Contact