Privacy Policy.

1. Introduction

You, Co., a Delaware public benefit corporation ("You, Co.," "we," "us," or "our"), provides consumer financial education, including the YouScore assessment, through joinyou.co and its subdomains, related applications, and communications (collectively, the "Services"). References to "you" and "your" mean the individual using the Services.

This Privacy Policy describes how we collect, use, and disclose personal information when you use the Services, and the rights and choices available to you. By using the Services, you acknowledge this Privacy Policy. This Policy does not cover third-party websites and services that we do not control (see Section 13).

Key points (the full Policy governs):

• We collect the information described in Section 2 — including detailed financial information that you provide or, if you choose, connect from your financial accounts. The YouScore requires this information to work; the more complete it is, the more useful your score.
• We use personal information to provide and improve the Services, communicate with you, maintain security, and comply with law (Section 3).
• We do not sell your financial data. We do not sell personal information for financial gain or share it for targeted advertising (Sections 5 and 7).
• Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information (Section 7).
• Questions and requests: privacy@joinyou.co (Section 15).

2. Personal information we collect

2.1 Information you provide to us

• Contact and account information, such as your name, email address, sign-in credentials such as one-time codes and passkeys (managed by our authentication provider), communication preferences, and referral information (including a referral code or link through which you arrived).
• Financial information you submit. The YouScore assessment collects detailed self-reported financial information, such as income and take-home pay; housing and other essential expenses; savings, investment, and retirement contributions; age; number of dependents; and ZIP code.
• Membership and transaction information, such as membership status and history, records of your acceptance of our terms, products ordered through the member shop, shipping address, and order history.
• Payment information. Payments are processed by our payment processor, Stripe. We do not receive or store full payment card numbers or full bank account numbers; we receive limited billing details such as name, email, amount, payment method type, and — depending on how you pay — card brand and last four digits, or bank name and the last four digits of the account number.
• Communications, such as support requests, survey responses, feedback, and information you provide when participating in member programs, such as the Founding design-partner program (including comments on our published methodology), the member community channel, and the referral program.

2.2 Information we collect automatically

When you use the Services, we and our service providers automatically collect certain information, such as:

• Device and usage information, including IP address, browser and device type, operating system, pages viewed, links clicked, referring pages, and dates and times of access.
• Approximate location inferred from your IP address and, for scoring purposes, the ZIP code you provide.
• Product analytics information about how you interact with the Services, such as features used and steps completed, collected through our analytics providers.
• Session replay information. We use session-replay technology to understand usage, diagnose problems, and improve the Services; these tools are configured to mask the values you type into assessment and score input fields.
• Email engagement information, such as whether emails we send are opened and which links are clicked.
• Cookies and similar technologies, described in Section 4.

2.3 Information from third parties

• Financial account information from data aggregators. If you choose to connect financial accounts, we receive read-only information about those accounts — such as balances, transactions, holdings, and liabilities — through our data aggregation provider(s), such as Plaid. You provide your credentials directly to the aggregator; we do not receive or store them. Aggregators' handling of your information is governed by their own privacy policies (e.g., plaid.com/legal).
• Payment and fulfillment information, such as payment confirmations from Stripe and shipping status from our fulfillment providers.
• Referral information from members who invite you to the Services.

3. How we use personal information

We use personal information for the following business purposes:

• Providing the Services — creating and managing your account; calculating and delivering your YouScore and related insights; operating the waitlist, admissions, and referral program; processing transactions; fulfilling orders; and providing member benefits and support. The YouScore is an educational financial measure.
• Communicating with you — sending transactional messages about your score, account, membership, and orders; responding to inquiries; and, subject to your choices (Section 6), sending newsletters, updates, and marketing.
• Improving and developing the Services — analytics, testing, research, troubleshooting, and developing our scoring methodology and new features.
• Aggregated and de-identified information. We may de-identify and aggregate personal information and use the resulting information for lawful purposes, including research and published statistics about financial resilience (the "YouScore Index"). We maintain and use de-identified information without attempting to re-identify it, except as permitted by law to test de-identification.
• Security and fraud prevention — monitoring, detecting, and preventing fraudulent, abusive, or unlawful activity; debugging; and enforcing our terms.
• Legal compliance — complying with applicable laws and legal processes, and meeting tax, accounting, and audit obligations.
• With your consent, or as otherwise disclosed to you at the time of collection.

4. Cookies and tracking technologies

We and our service providers use cookies, pixels, local storage, and similar technologies to operate and understand use of the Services:

• Strictly necessary cookies, required for the Services to function — for example, sign-in sessions, security, and remembering your consent choices.
• Analytics cookies and technologies, which help us understand how the Services are used.
• Preference cookies, which remember settings you choose.

Most browsers let you remove or reject cookies through browser settings; doing so may affect the availability and functionality of the Services. Our Services do not currently respond to "Do Not Track" browser signals, for which no industry standard has been adopted; see Section 7 regarding opt-out preference signals.

5. How we disclose personal information

We disclose personal information in the following circumstances:

• Service providers. Vendors that process personal information to provide services to us, under contractual limits on their use of it — including hosting and infrastructure (Vercel; Supabase), content management (Sanity), payment processing (Stripe), email delivery (Resend), newsletter delivery (Substack, if you subscribe to the ‘You got mail’ newsletter), analytics and session replay (PostHog; Plausible), authentication (Clerk), data aggregation (Plaid, if you connect accounts), text messaging (Twilio, when SMS launches), and shop production and fulfillment providers (who receive name, shipping address, and order details).
• Professional advisors, such as lawyers, accountants, auditors, and insurers, where necessary in the course of the professional services they provide to us.
• Legal and safety. To comply with applicable law or legal process; to respond to lawful requests by public authorities; and to protect the rights, property, or safety of You, Co., our members, or others.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets, personal information may be disclosed or transferred as part of the transaction, subject to applicable law.
• At your direction or with your consent — for example, if you create a public score share page (which displays your score and band, not your underlying answers), if you choose to be listed on the founding wall or on your founding page (which display your name or chosen display name and your founding number), or if you ask us to send information to a third party.
• Aggregated or de-identified information that cannot reasonably be used to identify you.

We do not sell your financial data. We do not sell personal information for financial gain, and we do not share personal information with third parties for cross-context behavioral advertising. We do not disclose personal information to data brokers, and we do not disclose your assessment answers, connected account information, or YouScore to third parties for their own purposes.

6. Your choices

• Marketing email. You can opt out of marketing email at any time by using the unsubscribe link in any marketing message or contacting privacy@joinyou.co. We will still send transactional and administrative messages relating to your account, score, membership, or orders.
• Text messages. SMS is optional and requires your separate consent, which is not a condition of membership or purchase. Message frequency varies; message and data rates may apply. Reply STOP to cancel or HELP for help. No mobile information — phone numbers, SMS consent, or text-message data — is shared with third parties or affiliates for their own marketing or promotional purposes; it is disclosed only to our text-messaging service provider to deliver the messages you requested.
• Cookies. See Section 4 for cookie controls.
• Connected accounts. If you connect financial accounts, you can disconnect them at any time in your account settings, after which we stop collecting information from them.
• Score share pages. You control whether to create a share link; you can contact us to disable one.

7. Your state privacy rights

Depending on your state of residence, you may have some or all of the following rights with respect to your personal information, subject to legal limits and exceptions:

• Right to know / access — to confirm whether we process your personal information and to access it, including the categories collected, the sources, the purposes, and the categories of third parties to which it was disclosed.
• Right to correct inaccurate personal information.
• Right to delete personal information we collected from or about you.
• Right to data portability — to obtain a copy of personal information you provided, in a portable and, where feasible, readily usable format.
• Right to opt out of the sale of personal information, the sharing or processing of personal information for targeted advertising, and certain profiling in furtherance of decisions that produce legal or similarly significant effects. We do not currently sell personal information, share it for targeted advertising, or engage in such profiling. Residents of Minnesota and Oregon may also request a list of the specific third parties to which personal information has been disclosed.
• Right to limit use of sensitive personal information (California), and rights regarding consent for sensitive data processing in other states. As described in Section 8, we do not collect the categories of information these provisions cover.
• Right to non-discrimination for exercising your rights.

Opt-out preference signals. Where required by applicable law, we recognize browser-based opt-out preference signals, such as the Global Privacy Control, as a valid request to opt out of the sale or sharing of personal information for the browser or device that sends the signal.

Exercising your rights. Submit requests to privacy@joinyou.co or, once available, through your account settings. We will verify your request by matching the information you provide against information we maintain — typically your email address — and may request additional information where necessary. We respond within the time required by applicable law (generally 45 days, with a permitted extension on notice). You may use an authorized agent to submit requests on your behalf; we may require proof of the agent's authority and direct verification with you.

Appeals. If we decline your request, we will explain why. Residents of certain states may appeal by replying to our decision with "Appeal" in the subject line; we will respond within the period required by your state's law. If your appeal is unsuccessful, you may contact your state Attorney General.

California "Shine the Light." California residents may request information about disclosures of personal information to third parties for their direct marketing purposes (Cal. Civ. Code §1798.83) by contacting privacy@joinyou.co. We do not disclose personal information to third parties for their direct marketing purposes.

8. Additional California disclosures

The following table describes the categories of personal information we have collected in the preceding 12 months, as categorized under the California Consumer Privacy Act, along with sources, purposes, and disclosures. We have not sold or shared personal information in the preceding 12 months, including personal information of consumers under 16 years of age, and we do not collect the categories of "sensitive personal information" enumerated in the CCPA. Retention criteria are described in Section 9.

9. Data retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, including providing the Services and maintaining your account, and thereafter as necessary to comply with legal, tax, accounting, and audit obligations, resolve disputes, enforce agreements, and maintain security. Retention periods depend on the type of information, the purpose of collection, and legal requirements; for example, transaction records are retained as required for tax and audit purposes, while assessment records associated with inactive registrations are deleted or de-identified after 24 months without a membership. De-identified and aggregated information may be retained and used without time limitation.

10. Data security

We maintain administrative, technical, and physical safeguards designed to protect personal information, appropriate to its sensitivity — including encryption in transit and at rest, role-based access controls, and vendor due diligence. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and regulators as required by applicable law.

11. Children's privacy

The Services are intended for users 18 years of age or older, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact privacy@joinyou.co and we will delete it as required by law.

12. International users

The Services are operated from the United States and are directed to users in the United States. If you access the Services from outside the United States, you understand that your personal information will be transferred to, processed, and stored in the United States, where privacy laws may differ from those of your jurisdiction.

13. Third-party websites and services

The Services contain links to and integrations with third-party websites and services — including Stripe-hosted checkout pages, our newsletter on Substack, the platform hosting our member community channel, professional-network sites where you may choose to display founding recognition, data aggregators, and merchants offering member discounts — whose privacy practices are governed by their own policies. We encourage you to review them.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised "Last updated" date. If we make material changes, we will provide notice as required by applicable law, such as by posting a prominent notice on the Services or emailing account holders. Your continued use of the Services after the effective date of an updated Policy constitutes your acknowledgment of it.

15. Contact us

You, Co. · Attn: Privacy · 169 Madison Ave, Suite 72302, New York, NY 10016 · privacy@joinyou.co