Plainly: what happens to your data.

LANDED is a planning tool. It is not a bank, a money transmitter, or a licensed financial adviser. It never moves money, never holds funds, and never connects to a bank account. Its recommendations are estimates computed from the information you give it; you decide what to do.

Your name, email, a salted scrypt hash of your password (never the password), and session tokens stored only as hashes.

The money records you enter or import: balances, transactions, bills, savings goals, payment-route quotes, decisions, outcomes, and the lessons you confirm.

An audit log of significant actions (sign-in, outcome recorded, memory written) so you can trust what happened.

When Walrus Memory is configured, confirmed lessons and, if you opt in, a journal of past advice may be written to an encrypted namespace derived from your account ID. LANDED cannot delete blobs already written; they may remain available until their storage expires.

Nothing becomes memory without your confirmation, drafts and rejected lessons are never written, and the decision journal is off unless you turn it on.

If you connect a Sui wallet or paste a transaction digest, LANDED reads public onchain data for that address or transaction through Tatum. It never asks for a private key or seed phrase and cannot sign anything. Exchange rates come from Tatum's Data API.

If the operator of this deployment enables it, a short set of already-computed facts (amounts, the advice and its reasons, lesson summaries — never your email or account identifiers) is sent to the configured AI provider to produce a plain-language summary. The summary is discarded if it contains any number LANDED did not compute.

Walrus, Tatum and the optional AI provider receive the information described above when their features are used. Community route statistics are off by default; if you opt in, de-identified cost and delivery errors are aggregated, and a statistic is published only once at least 3 people and 5 observations contribute. The demo account is shared, so its records are visible to other demo visitors.

Export everything as JSON from Settings → Data & consent. Exclude any lesson from future advice. Change your password, which signs out every other device, or permanently delete your account from Settings → Profile. Deleting removes your account records and associated audit entries from LANDED. Walrus blobs already written remain encrypted until their storage expires and cannot be removed by LANDED.

Personal records are scoped to your account. Server-side integration keys are kept on the server. The app checks the origin of browser write requests and rate-limits selected operations. Amounts are stored in integer minor units.