Privacy Policy

This Privacy Policy describes how Tristar Dynamics LLC ("we," "us," "our") collects, uses, stores, and shares information when you use the TactiFunds mobile application (the "App"). By using the App, you agree to the practices described here. If you do not agree, do not use the App.

What changed in 2.0: TactiFunds no longer uses accounts. Your data is stored on your device and in your own iCloud, not on our servers. If you had an account, the App moves your data into iCloud, and our servers, with any data still on them, shut down on October 31, 2026.

TactiFunds is an independent product. It is not affiliated with, endorsed by, or sponsored by the U.S. Department of Defense, any branch of the U.S. Armed Forces, or any federal government agency. Pay tables, allowances, and benefit figures reference publicly available DoD and VA data and are provided for informational purposes only. The App does not provide financial, tax, legal, or investment advice.

1. Who we are

Controller: Tristar Dynamics LLC
Product: TactiFunds (iOS application)
Contact: support@tactifunds.com

If you have questions about this policy, your data, or want to exercise any of the rights described below, contact us at the email above.

2. What information we collect

We try to collect as little as possible. Here's everything the App handles, grouped by source.

2.1 Information you provide

You don't create an account to use the App. It asks for an email address or password only to move data from an existing account (see the last item below). When you use the App, you provide:

• A display name (optional). It is stored on your device and in your iCloud.
• Financial planning inputs you enter into the App's tools. They are stored on your device and in your iCloud, and they are not sent to us:
  • Pay grade, branch of service, years of service, dependents, ZIP code (for BAH lookup)
  • TSP balance, contribution percentages, fund allocations, retirement target year, birth year (for the catch-up contribution limit)
  • Tax filing status and dependent count
  • Emergency savings, debt balances, and monthly debt payments
  • Spouse income, military pay details, retirement, and budget data (if you choose to enter it)
  • VA disability ratings, deployment plans, SGLI coverage choices, SDP deposits
  • Budget items, daily expenses, monthly snapshots
  • Inputs to planning tools (PCS, Separation, VA Home Loan, GI Bill, Pension, etc.)
• LES (Leave & Earnings Statement) uploads: When you upload an LES PDF, the App parses it on your device to extract structured fields (gross pay, deductions, allotments, leave balance, etc.). The raw text of your LES is never stored or transmitted. Only the parsed numeric fields and your pay date are saved.
• BAH lookups. When you enter a duty-station ZIP code (yours, a military spouse's, or a GI Bill school's), the App looks up the Basic Allowance for Housing rate with CollegeRecon's BAH calculator. The request carries only that ZIP code, a pay grade, and whether there are dependents, along with the IP address every internet request carries. Your name, email, and the rest of what you enter are never sent.
• Profile photo (optional). If you set one, it's stored on your device and in your iCloud.
• Existing accounts (until October 31, 2026). If you created an account in an earlier version of the App, you sign in to it once, with your email address and password or with Sign in with Apple, so the App can move your data into your iCloud. For that account we hold your email address or Apple ID identifier, and your name if Apple shared it the first time you signed in.

2.2 Information we collect automatically

• Subscription status from Apple's StoreKit framework: whether you have an active Pro subscription, whether you're in a trial, and transaction identifiers needed to verify your entitlement. We never see your credit card, debit card, or bank information. All payment processing is handled by Apple under Apple's privacy policy.
• Purchase validation by RevenueCat. The App uses RevenueCat to validate your App Store purchases and manage your subscription. RevenueCat receives an anonymous identifier it assigns, your App Store transactions, and basic device and app details. It does not receive your name, your email address, or the data you enter.
• Diagnostic logs from Apple's standard frameworks may surface in your device's system logs (e.g., crash reports you choose to share with Apple). We do not operate our own analytics SDK and do not collect usage telemetry, page views, click streams, or session recordings.

2.3 Information we do not collect

We deliberately don't collect or ask for:

• Social Security Number, passport number, or other government identifiers
• Bank account numbers, routing numbers, or wire details
• Credit card or debit card numbers (Apple handles all payments)
• Your contacts, photos library (other than a profile photo you select), microphone, camera, or location
• Browsing history, web tracking data, or cross-app tracking identifiers (the App does not request App Tracking Transparency permission and does not track you across apps or websites)
• Health or biometric data

We also have no access to the data stored in your iCloud.

3. How we use your information

We use the information you provide to:

• Operate the App's features. Your financial inputs power the calculators, planners, and personalized recommendations you see in the App.
• Save your progress so your data is there when you reopen the App.
• Sync your data across your devices. Your data syncs through your own iCloud to your devices signed in to the same Apple Account. Apple runs this; we can't see the data.
• Verify your subscription tier and unlock the features you've subscribed to.
• Deliver in-app notifications you've opted into (e.g., payday reminders, separation milestones, drill weekend reminders).
• Communicate with you about service issues (e.g., security incidents, material changes to this policy). If you have an existing account whose data hasn't moved to iCloud yet, we email you service notices about the shutdown of our servers (up to four, through October 31, 2026).

We do not use your information for advertising. We do not sell, rent, or trade your information. We do not use your data to train machine-learning models — yours or anyone else's.

4. How we store and protect your information

4.1 Encryption at rest

On your device, the App's data is kept in its private storage, which iOS encrypts using Data Protection. Copies saved by versions before 2.0 are additionally encrypted with AES-GCM under a key kept in this device's Keychain, until you delete them.

4.2 Cloud storage

Your data is stored in the private database of your iCloud account (Apple CloudKit), not on our servers, and we cannot access it. Financial data and your display name are stored in encrypted fields. If you turn on Advanced Data Protection for iCloud, this data and your profile photo are end-to-end encrypted, so only your trusted devices can read them; otherwise they are protected under Apple's standard iCloud data protection. If iCloud is off, your data stays on your device only.

Existing accounts: until October 31, 2026, data saved by earlier versions remains in our database (operated by Supabase, see Section 5) so the App can move it to your iCloud. The database enforces row-level security, so each row is locked to the account that owns it. This data is deleted when those servers shut down.

4.3 Authentication (existing accounts only)

Until October 31, 2026, an existing account is used only to sign in once to move its data to your iCloud, to reset its password, and to delete the account.

• Email/password authentication uses industry-standard password hashing handled by our authentication provider. We never see your password in plaintext.
• Sign in with Apple uses Apple's privacy-preserving identity flow. Apple may provide us with a per-app private email relay address; emails sent to it are forwarded to your real email by Apple.

4.4 In transit

All network traffic between the App and our servers uses HTTPS/TLS encryption.

4.5 Retention

• Your data on your device and in iCloud: kept until you delete it (see Section 7). We don't hold a copy.
• Existing accounts' data on our servers: deleted on October 31, 2026, or earlier if you delete the account.
• Feedback Board posts and comments: the Feedback Board was removed from the App in version 2.0. Existing posts and comments are deleted on October 31, 2026.
• LES uploads: only the parsed fields are retained, with the rest of your data. Raw LES text is never persisted.
• Service emails: our email provider, Resend, keeps delivery logs under its own retention policy.

5. Who we share information with

We only share information with the limited third parties needed to operate the App:

We do not share data with advertising networks, data brokers, or analytics vendors.

We may disclose information if legally required by valid court order, subpoena, or other legal process — but only to the extent legally compelled, and we will notify you when permitted to do so by law.

In the unlikely event of a corporate transaction (merger, acquisition, sale of assets), user information may be transferred to the successor entity. You will be notified of any such change via the App.

6. International data transfers

The App is offered in the United States. Our cloud infrastructure may be located in the United States. If you access the App from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. Apple may store your iCloud data outside the United States, under Apple's terms. By using the App, you consent to these transfers.

7. Your rights and choices

You can manage your data directly in the App at any time:

• View and edit your data: Every value the App stores is visible in the corresponding tool — there is no hidden profile.
• Export: Your data is in your iCloud and visible in the App. For an existing account's data on our servers, email us before October 31, 2026 and we will provide a copy in a machine-readable format within 30 days.
• Delete all your data: Settings → Danger Zone → Delete All My Data. This permanently removes every value you've entered from this device and from your iCloud, including your other devices signed in to it. If you're signed in to an existing account, it also removes that account's copy on our servers. It resets the key that sealed copies saved by versions before 2.0, so a leftover copy in a backup can't be opened. To keep deleted data from being brought back from our servers, the App keeps a small record of which old account was moved, with identifiers and counts but none of your values.
• Delete an existing account: until October 31, 2026, Settings → Danger Zone → Delete My Account is available once the account's data has moved to iCloud, or you can email us. This deletes the account's sign-in and the copy of its data on our servers. The data on your device and in your iCloud stays; use Delete All My Data to erase that too. A deleted account can't be reactivated.
• Remove TactiFunds data from iCloud outside the App: iOS Settings → [your name] → iCloud → manage storage → TactiFunds. The exact labels vary by iOS version.
• Notification controls: Settings → Preferences → Notifications, or in iOS Settings → TactiFunds.

Region-specific rights

Depending on where you live, you may have additional rights under applicable law:

• California residents (CCPA/CPRA): the right to know what personal information we hold about you, the right to delete it, the right to correct inaccuracies, the right to opt out of sale or sharing (we do not sell or share personal information for cross-context behavioral advertising), and the right not to be discriminated against for exercising these rights.
• EU/EEA residents (GDPR): the right to access, rectification, erasure, restriction, data portability, and to object to processing. Our legal basis for processing is your consent (when you enter data and use the App) and contract performance (for subscriptions you purchase). You may also lodge a complaint with your local data protection authority.
• UK residents (UK GDPR): the same rights as EU residents, with the ICO as the supervisory authority.
• Other jurisdictions: contact us and we will work with you to honor any applicable local rights.

To exercise any of these rights, email us at the address in Section 1. We will respond within 30 days (or the timeframe required by your jurisdiction's law, if shorter).

8. Children's privacy

The App is intended for users aged 17 or older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, contact us and we will delete it promptly.

The App is rated 17+ in the App Store because of its references to financial decisions, military service-related content, and adult subject matter (e.g., disability ratings, life insurance).

9. Security caveats

We take security seriously, but no system is perfectly secure. You can help protect your data by:

• Protecting your device with a passcode, Face ID, or Touch ID, and keeping iOS updated
• Protecting your Apple Account with two-factor authentication
• Optionally turning on Advanced Data Protection for iCloud, so your iCloud data is end-to-end encrypted

If we become aware of a security incident affecting your data, we will notify you in accordance with applicable law.

10. Changes to this policy

We may update this Privacy Policy from time to time — for example, when we add new features or change our service providers. When we do, we will:

• Update the "Last updated" date at the top.
• For material changes, notify you in the App and/or by email before the new policy takes effect.

For existing accounts, the App's screens for moving your data and our service emails about the shutdown are notice of the changes in version 2.0.

Continued use of the App after changes take effect means you accept the updated policy. If you don't agree, you can delete your data at any time (see Section 7).

11. Contact

Questions, complaints, or requests:

Tristar Dynamics LLC
2 Arnot St, Ste 6 #1053, Lodi, NJ 07644
support@tactifunds.com

For legal process and law-enforcement requests, please use the email above with subject line "Legal Request."