Privacy

What we receive

We receive only the facts you authorize Muse to share, as structured fields rather than raw content. Depending on the check you ask for, that can include:

• Purchases, charges, refunds and subscriptions, including Amazon orders: a merchant name, a date, an amount and currency, and typed fields such as an order or transaction reference, refund or cancellation status, return date, billing cadence, source provenance, evidence locator and deadline.
• Unclaimed property: findings from an official state search, such as the state, the holder’s name, the amount and the official page they came from.
• Card benefits: the name of a card you hold and whether you have used each credit.
• Bills, plans, coupons and flights: the amounts, dates and terms a check needs.
• Hotel reservations: the hotel, dates, guests, room, price and cancellation terms of a booking, and the rates Muse found for the same stay. A hotel review is never stored.
• Your account email address, so you can sign in and connect Muse.

What we refuse

The service rejects, rather than stores, anything that looks like a card or bank account number, a password, token, API key, CVV or PIN, a government identifier, a complete email body, an attachment, or health information. Rejected values are never written to logs or echoed back in an error.

What we never do

• Sign in to your bank, card issuer, airline, or merchant account.
• Muse supplies the relevant details you authorize. Find Me Money doesn’t access your inbox directly.
• Send a message, file a claim, or cancel anything on your behalf.
• Hold, move, or take a fee from any money you recover.
• Sell your financial facts or use them for advertising.
• Use your data to train AI models, or to build profiles unrelated to the checks you ask for.

Who we share it with

Results go back to Muse, which shows them to you. To run the service we use Supabase for sign-in and our database, and Fly.io for hosting; they process data only to provide that infrastructure. We do not share your data with advertisers, data brokers, or the merchants, card issuers and hotels you ask us to check.

How we protect it

Data travels over HTTPS. Claim packets and minimized source records are encrypted by the application before they are stored, and each account can read only its own data.

How long we keep things

• Raw request data: held in memory for the lifetime of the request only.
• Minimized source records: encrypted typed fields only, retained for 90 days, or while linked to an open case. Raw source content is never stored. You can request a stateless evaluation with persistence disabled.
• Hotel booking reviews: not stored. The request is evaluated in memory, and only the redacted audit event below is kept.
• Candidate fingerprints: 24 hours. These are keyed hashes used to spot an accidental resubmission, not the records themselves.
• Derived opportunities: 90 days, or for as long as they are linked to an open case.
• Claim packet drafts: 30 days.
• Case metadata and outcome events: until you delete them, or 24 months after the case closes. Outcomes retain their provenance, and any evidence locator is limited to a bounded reference rather than source content.
• Watch instructions (a check you ask Muse to run again later): until you remove them or delete your account.
• Redacted audit events: 180 days. These never contain a request payload or a bearer token.
• Product measurement: event names, times, a pseudonymous account reference and optional feedback score for up to 180 days. This measures scans, drafts and reported results; verified payment and support events are included only when available. No financial record content is included. Account deletion removes these events; operator reports contain aggregates only.

Your controls

You can disconnect the connector in Muse at any time, which revokes our access immediately. You can switch Muse between full and read-only access on your connection access page. You can see the scopes you granted in Muse, and you can ask us to delete your account and all connector data from the deletion page.

Contact

Questions about this policy go to support. Please do not include card numbers, credentials, or full statements in a support request.