Security Overview
Last Updated: October 23, 2026
1. In Transit
Every connection to Poiiints uses HTTPS, and plain HTTP is redirected to it.
2. Access to Your Data
Every request is tied to your signed-in session, and the server reads only the data that belongs to your account.
3. Sign-In
Poiiints has no passwords. You sign in with a one-time code sent to your email. We store only a one-way hash of each code, and codes expire.
4. Read-Only Access
Poiiints asks Plaid only for transactions. It can read them; it cannot move money.
5. Service Providers
Our server and database run on Railway, and the website runs on Vercel. Sign-in codes are sent through Resend, and Plaid provides bank connections. Chat is answered through OpenRouter, which passes your message to a provider that runs the AI model (currently Claude Haiku 5.5, made by Anthropic); we set OpenRouter to use only providers that don't store or train on your data. We send chat data only to OpenRouter. Visits to our homepage, TikTok page and sign-up page are measured with PostHog, which receives the pages visited, the buttons tapped, the browser and device type, an approximate location (country and city), the link that brought the visitor and a visitor ID stored in the browser — never anything typed or any account data. We use it only to measure which pages and channels bring visitors, never for advertising.
6. Deleting Your Data
Delete your account in Settings, or by email, and your data is removed.