What we collect, and why.

Pax Orbis is operated by Pax Orbis LLC, a New Jersey limited liability company.

Version 2026-10-30a. Last updated October 30, 2026.

Account information. The email address you sign up with and basic authentication records needed to keep your account secure.

Linked financial account data. When you connect bank accounts, balances, holdings, valuations, transactions, and related account details are retrieved through Quiltt, which uses Finicity, a Mastercard company, to reach your institution. Institution credentials are entered into and held by the applicable provider and its connectivity partners. Pax Orbis does not store your bank or brokerage login credentials.

Billing and usage information. Subscription status, plan, and renewal dates, plus basic technical logs such as device type, browser, and error reports used to keep the service running.

Which institutions you use. The Request an invite form optionally asks which banks or brokerages you use. We ask so we can check your accounts will connect before your invite. We keep the names only, never account numbers or logins, and use them only to review your request and that coverage check.

Your home and the assets you add. If you add a home or another asset, we keep what you enter: its name, its value and, for a home, its address. When you set up a tracked home, the address you type is sent once to the U.S. Census Bureau's public geocoder to find the state it is in, and we then follow the published home price index for that state (or for the whole country, if the state's is not available) to update the estimate each month. The address is not sent again, and it is never written to our logs.

Feedback you send. If you rate an answer or send feedback during the beta, we keep your rating, any note you write, the screen you were on and which answer it was about, with your account, so we can find and fix problems. Feedback you send is emailed to the founder so he can read it.

Conversations. Your messages and the agent's replies are saved in your account so you can come back to them. Delete a conversation and it is deleted, together with the review copy described next.

Review copies. To check that answers are accurate and stay within our rules, we keep a review copy of each agent turn: your question, the reply, and the figures the reply used. We keep review copies for 30 days, and for up to 90 days when an answer was flagged by our checks or you rated it down. Only the founder can open them, behind a second sign-in step, and each time they are opened is logged.

Memory. The agent saves facts you tell it or that come up in your conversations, such as a goal or a rule about your cash. You see each one as a “Remembered” line, and you can see, edit or delete every one on the Memory page, or turn memory off there.

Documents. Uploading a statement is optional. When you use “Add from a statement” for a mortgage or life insurance policy, we read the text of your PDF in our own system and hide your name, address, phone, email and account, loan and policy numbers first. That hidden-details text goes to Anthropic, the AI company that also powers your agent, which fills in figures such as the balance, rate and payment. You see every figure beside the line it came from and confirm it before anything is saved. We do not keep the PDF or its text, and we keep only the entries you confirm. Anthropic's terms let it hold what we send for up to 30 days to run the service, and longer if its safety systems flag a request (up to two years) or the law requires it. We ask for the text to be processed in the United States. Photos and scans are not read. We do not yet offer a place to store documents. You can delete confirmed entries at any time.

Connecting Google Calendar is optional and separate from signing in. If you connect it, we request only Google's read-only calendar permission (calendar.readonly). Pax Orbis cannot create, edit, or delete anything on your calendar.

What we read. Event titles and start times for the next 14 days on the calendar you select. Nothing further back, nothing beyond that window.

Why. So your agent can answer what is coming up, and so an event that looks money-relevant (payment, due, bill, statement, renewal) can be surfaced to you as a dated signal before it lands.

Calendar data is used only to produce those answers and signals for you. It is never sold, never shared with third parties for their own purposes, never used for advertising, and never used to train models. You can disconnect the calendar at any time in your account settings, which revokes our access and removes the stored connection.

Apple calendar, by link. Instead of Google, you can paste the public link iCloud gives you for one calendar. It is read-only: we can see the events on that calendar and cannot change them. The link works like a key to that calendar, so we keep it where only our servers can read it, we never show it back to you or write it to our logs, and we use it only to read event titles and start times for about the next two months, refreshed a few times a day. Anyone who has the link can see that calendar, so turn off sharing for it in the Calendar app if you stop using it. Disconnecting in your settings deletes the link and the events we read from it. We use what we read from an Apple calendar for the same purposes as a Google calendar, and in the same ways: never sold, never used for advertising, never used to train models.

We use your data to authenticate you, to display your net worth and account views, to generate any summaries included in your membership, to process your subscription, to provide support, and to detect and prevent abuse.

Any AI processing of your data is used only to generate the views and summaries you requested; it is not personalized financial advice (see Terms). We do not sell your personal or financial data, and we do not use it for advertising.

Morning note. This is optional and off until you turn it on in You, then Preferences. If you do, we email you once a day at the hour you choose. It carries the one line your agent shows, what is dated today, and, if a bank is linked, your net worth. That can include bill names and amounts, calendar event and task titles. It is sent through the email service our provider runs, from notify.paxorbis.io. Email is not a secure channel: it can be read in transit or by anyone with access to your inbox or device, so turn it off if that matters to you. We keep a short record that each note was sent. Turning it off stops future notes.

Pax noticed emails. When Pax notices something worth a look, such as a bill coming due within three days, a change in your cash runway, or the Sunday summary, we may email you a short note. These emails are on by default. They say that a note is waiting and what kind it is, and they carry no balances, amounts or merchant names: the figures stay in Pax. We send at most one a day and three a week. If you have not opened Pax for 14 days we pause these emails and the Morning note, and when you come back we ask once whether to turn them back on; notes in the app keep collecting. Each email has links to mute that kind of note, mute all notes, or stop the emails; a link only asks you to confirm, and nothing changes until you press the button. You can also turn notes, the emails or each kind on or off, at any time, in You, then Preferences, under Routines. They are sent through the same email service as the Morning note, from notify.paxorbis.io. Email is not a secure channel, so turn them off if that matters to you.

Quiltt provides linked bank connectivity and runs the connection window. Its handling of your data is governed by its Privacy Policy and Terms.

Finicity, a Mastercard company, is the data aggregator Quiltt uses to connect to your bank or brokerage and retrieve your account data. Its handling of that data is governed by its Terms and Privacy Notice, which it shows you when you connect.

FinGoal, working through Quiltt, receives your transaction details so it can clean up merchant names and assign spending categories. Its handling of that data is governed by its Privacy Policy.

Anthropic provides the AI that answers your questions. To answer, we send it your message and the parts of your financial file needed for that answer. We do not use your data to train models, and by default Anthropic does not train its models on what it receives through its API. It deletes inputs and outputs from its systems within 30 days, unless it must keep them longer to enforce its usage policy (up to 2 years if a request is flagged). Its handling of what it receives is governed by its own terms and privacy policy.

We use third-party AI service providers, including xAI Corp. and Anthropic PBC, to process your requests and the account information needed to answer them. These providers act on our behalf under contracts that limit use of your data to providing our service, prohibit using it to train their models, and require appropriate security. We share only the information needed for your request and never share your bank login credentials.

Pax isn't affiliated with or endorsed by xAI.

Stripe handles checkout, payment processing, and tax. Card details are entered with Stripe and are never held by Pax Orbis.

U.S. Census Bureau Geocoder, a free public service, receives the address of a home you track, once, when you set it up, so we can find the state it is in. It is governed by the Census Bureau's own terms and privacy policy.

We also use standard infrastructure providers for hosting, authentication, database storage, and email delivery, who process data on our instructions to run the service. We may disclose information if required by law or to protect the safety and rights of our users.

Data is encrypted in transit and at rest, and access is restricted to what's needed to operate the service. It is stored in the United States, in the AWS US West (Oregon) region, through our hosting provider Lovable Cloud. The keys that connect other services are encrypted a second time inside the app. No system is perfectly secure and we cannot guarantee absolute security.

How long we keep it. Your account data, linked account data, memory and documents stay while your account is open. Conversations stay until you delete them. Review copies are kept 30 days, or up to 90 days if flagged or rated down. Records of what you agreed to, and of bank connections you withdrew, stay for as long as your account does. Billing records are kept as long as tax and accounting law require.

How you use Pax. We record when you open Pax and which screens you use, inside our own systems, to make it better. No third party sees it. We keep it for 13 months, and deleting your account deletes it.

Locking Pax. If you set a PIN, Pax locks itself after a few minutes, and the PIN never leaves your phone.

Figures kept on your device. So Pax can still open when you have no signal, your phone or browser may keep a copy of the app's own screens and the figures you last saw: your net worth, your totals, and account names with their balances, never account numbers or bank login details. These copies are removed when you sign out.

When you delete your account. We delete your data from our live systems and ask Quiltt to delete the data it holds for you. A copy of deleted data can remain in our automatic backups for up to 30 days and is then gone.

Pax Orbis uses Quiltt (with Finicity and FinGoal) for linked bank connectivity and Stripe for billing. Each provider's own compliance program applies to the services it provides.

You can request a copy of your data, ask us to correct it, disconnect any linked account at any time, or ask us to delete your account entirely. When you delete your account, we also ask Quiltt to delete the data it holds for you. Email us and we'll act on the request. Depending on where you live, you may have additional rights under applicable privacy law.

The site uses only the cookies and local storage needed to keep you signed in, to remember your preferences and to let Pax open without a signal. It sets no analytics or advertising cookies (see the Cookie Policy). Pax Orbis is not intended for anyone under 18 and we do not knowingly collect data from children.

Your agreement. We record when you agree to our Terms and Privacy Policy and to the bank connection notice, which version you agreed to, and when you disconnect a bank. If we change these in a material way, we ask you to agree again.

We respond to access, correction and deletion requests within 30 days.

Privacy questions or requests: legal@paxorbis.io.