Privacy Policy

1. Introduction

Epic Digital Interactive Media LLC (“we,” “us,” “our”) is committed to protecting your privacy and safeguarding your personal information. This Privacy Policy applies to our website https://epicdigital.media and to any integrations with third‑party services, including our use of the YNAB API via OAuth.

We comply with applicable data protection laws, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as amended by the CPRA.

2. Information We Collect & How We Use It

We collect only the minimum data necessary to operate and improve our services:

• OAuth Access Tokens (from YNAB) to allow authorized, secure access to your budget data.
• Usage Data such as log files, device/browser information, and interaction history for performance, analytics, and troubleshooting.

Purposes: to provide and maintain requested services; enable authorized access to YNAB data (read‑only unless otherwise specified); improve our platform and user experience; and comply with legal obligations.

We do not collect banking credentials, account passwords, or sensitive personal identifiers beyond what is necessary to fulfill the service.

3. OAuth Scopes & Permissions

We follow the principle of least privilege, requesting only the scopes necessary for the requested functionality.

• By default, we request read‑only access unless broader permissions are explicitly needed and explained during authorization.
• Endpoints that modify budgets remain inaccessible unless you grant write permissions.
• Our Privacy Policy URL is clearly provided in our OAuth configuration and displayed to users during authorization.

4. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal data under one or more of the following legal bases:

• Consent: when you authorize our app to access your YNAB account via OAuth.
• Contract: to fulfill our service obligations.
• Legitimate Interests: to maintain and improve our services.
• Legal Obligation: where we must retain or process data to comply with applicable laws.

5. Your Privacy Rights (GDPR & CCPA)

If you are in the EEA (GDPR):

• Access a copy of your personal data
• Rectify inaccurate information
• Request deletion of your data
• Restrict or object to processing
• Data portability (receive your data in a machine‑readable format)
• Withdraw consent at any time

If you are a California resident (CCPA/CPRA):

• Right to know the categories and specific pieces of personal information collected, used, disclosed, or shared
• Right to request deletion of your personal information
• Right to correct inaccurate personal information
• Right to opt‑out of sale or sharing of personal information (we do not sell or share your data for cross‑context behavioral advertising)
• Right to limit use of sensitive personal information (we do not use SPI for purposes requiring this right)
• Right to non‑discrimination for exercising your privacy rights

How to exercise your rights: Email us at hello@epicdigital.media. We will verify your identity before processing a request.

Do Not Sell or Share My Personal Information: We do not sell or share your personal information. If our practices change, we will update this section and provide a clear opt‑out mechanism.

6. Data Storage & Security

• All data is transmitted over HTTPS and encrypted at rest using industry standards.
• OAuth tokens are stored securely with access controls and are inaccessible to unauthorized personnel.
• We perform periodic security reviews and access audits.

7. Data Retention

We retain OAuth tokens and related data only as long as necessary to provide the service or to comply with legal obligations. If you revoke OAuth access or request deletion, we will delete associated tokens and personal data promptly and securely.

8. Third‑Party Sharing & Transfers

• We do not sell, rent, or trade personal information.
• Data is shared only with essential service providers (e.g., hosting, analytics) under contractual obligations to protect your data.
• If personal data is transferred outside the EEA, we use legally recognized safeguards such as Standard Contractual Clauses.

9. Revoking Access & Deletion Requests

• Revoke OAuth access at any time through your YNAB account settings.
• Request deletion of your stored data by contacting hello@epicdigital.media.
• Upon revocation or verified deletion request, we will promptly and securely remove tokens and associated personal data.

10. Attribution & Relationship with YNAB

We are not affiliated with, endorsed by, or sponsored by You Need A Budget, LLC (YNAB). Any reference to YNAB is solely to describe our integration functionality.

11. Changes to This Policy

We may update this policy from time to time. The “Last Updated” date reflects the latest changes. Significant updates will be communicated via our website or within the application.

12. Contact Us

If you are in the EEA, you may also contact your local data protection authority. If you are in California, you may contact the California Attorney General’s Office.