Privacy

Last updated July 2026.

Who operates Runtab

Runtab is operated by Enterprise Web Service LLC, a Minnesota limited liability company. Enterprise Web Service LLC is the data controller for any personal information Runtab collects. The company is small; there are no employees, contractors, or third parties with access to customer data besides the service providers listed below.

What data Runtab collects

• Transaction data from credit card accounts I explicitly link via Plaid: merchant name, transaction date, amount, currency, pending/posted status, and the transaction's account identifier.
• Account metadata: account name, mask (last 4 digits), account type, and institution name.
• Plaid access tokens required to fetch further updates from linked institutions.

Runtab does not collect login credentials. The user authenticates with their bank through Plaid's OAuth flow; bank credentials never pass through Runtab.

Where data is stored

A database on a Ceph-backed persistent volume in a self-hosted OpenShift cluster operated by Enterprise Web Service LLC. The cluster sits behind a firewall on a private network and is reachable publicly only through HTTPS-terminated routes with valid TLS certificates issued by Let's Encrypt. Every application request is authenticated and scoped to the requesting user's own account — one user's data is never visible to another, and this isolation is enforced by an automated test suite on every release.

Who data is shared with

• Plaid, Inc. — the bank aggregator used to connect to the linked institutions. Plaid receives the bank credentials during the OAuth flow and returns transaction data to Runtab. See Plaid's privacy policy.
• No one else. Runtab does not sell, share, or transmit personal financial data to advertisers, analytics providers, or any other third party.

How long data is kept

While your account is active. Daily balance snapshots are retained for 90 days on a rolling basis. If your free trial lapses without a subscription, Runtab automatically disconnects your bank link at Plaid within about a week (your history is retained so you can pick up where you left off if you subscribe later). You can request complete deletion of your account and all associated data at any time by emailing support@runtab.io from your account's email address; deletion is completed within 30 days.

Cookies and tracking

This website uses a small number of cookies and measurement tools:

• Anonymous visitor cookie (rt_vid) — a random identifier set on marketing pages so we can count distinct visitors. It contains no personal information, is not shared with anyone, and expires after one year.
• Session cookie — set when you sign in, to keep you signed in. Not used for tracking.
• Meta (Facebook) Pixel — loaded on public marketing pages only (never on signed-in app pages). It reports anonymous page views and signup events to Meta so we can measure advertising. Meta may set its own cookies; see Meta's privacy policy. If you use a content blocker that blocks the pixel, the site works exactly the same.
• Plaid Link SDK — a third-party script loaded only on the card-linking page. Browser sessionStorage holds the Plaid link token across an OAuth redirect and is cleared after a successful link.

There is no other analytics service, no ad network besides the Meta Pixel described above, and no sale or sharing of personal data.

Your rights

You can request access to, correction of, export of, or deletion of any personal data we hold about you. To exercise any of these rights, email admin@enterprisewebservice.com from the address associated with your account. We respond within 30 days.

Changes

Substantive changes to this policy are dated at the top. Plaid and any institutions Runtab connects to are notified of website changes via their standard review processes.