Infrastructure
- Platform
- Hosting, network, patching, physical security.
- Us
- Choosing the platform and configuring it correctly.
- You
- —
Trust
Your numbers stay yours.
Horizon Runway is not a bank, broker, or financial advisor. We don't hold or move money, and we don't guarantee future balances.
Where does my money data live?
Balances, bills, income, and scenarios are stored in your own browser by default. For Plus users, cloud backup and sync begin automatically when they sign in.
Plus keeps one copy on Lovable Cloud, reachable only through your signed-in Plus account. You can delete that copy from Settings at any time.
Other things we hold include your email address, anything you write to us and our replies, the records the hosting platform keeps whenever a page loads, and, only if you switch them on, crash reports with personal details stripped out and anonymous usage events.
What do you never have?
No bank username or password. There is no field for one anywhere in Horizon Runway, and Horizon Runway does not connect to financial institutions today. If that ever ships it will be opt-in, and this page will change first.
No card numbers. Plus payments run through Stripe Managed Payments, and the merchant of record is Sold through Link, LLC, so card details never reach us. No government ID numbers. No credit reports or scores.
No advertising trackers and nothing that follows you between sites. Visitor analytics is switched off at the platform level, so no page-view analytics script or tracking cookie runs on this site. Horizon Runway is not funded by advertising and does not sell or share your data.
How do I get it out, or delete it?
Settings → Save a copy hands you a plain file of everything you entered.
Settings → Clear everything removes the copy on your device and the cloud copy. Deleting your account closes the account, removes the cloud copy, and we email a confirmation.
Messages you send us are kept until you ask us to remove them. Ask through Support and we will delete the records tied to that address. The records the hosting platform keeps are held for a short rolling period and used only for keeping the service up and handling abuse.
What the saved file contains
- • Every account, bill, habit, and scenario you entered.
Plain JSON, readable in any text editor.
Who else touches it?
| Vendor | Purpose | What it can see | When |
|---|---|---|---|
| Lovable | Application hosting and content delivery. | Standard web request metadata: IP address, browser identification string, timestamps, and scrubbed crash reports if you switch them on. | Always |
| Lovable Cloud | Managed database, authentication, and cloud backup for Plus accounts. | Account email, account records (Terms acceptance, subscription status), messages you send us, opt-in usage events, and, for Plus users, the cloud forecast copy. Encrypted in transit and at rest; not end-to-end encrypted because Horizon Runway's server serves sync. | Always |
| Cloudflare | Network delivery and security infrastructure. | Standard web request metadata such as IP address, user agent, requested URL, and timestamp. | Always |
| Resend | Transactional email delivery — invites, replies, account mail. | Recipient email address and the contents of the message being sent. | Always |
| Stripe Managed Payments, provided by Sold through Link, LLC | Merchant of record for Plus transactions. | Payment details, receipts, refunds, cancellations, and subscription management. Horizon Runway receives subscription status and a customer identifier, not the full card number. | Only if you use it |
| Google Workspace | Business email for hello@horizonrunway.com. | Sender addresses, message contents, and related email metadata. | Always |
- Lovable
- PurposeApplication hosting and content delivery.
- What it can seeStandard web request metadata: IP address, browser identification string, timestamps, and scrubbed crash reports if you switch them on.
- WhenAlways
- Lovable Cloud
- PurposeManaged database, authentication, and cloud backup for Plus accounts.
- What it can seeAccount email, account records (Terms acceptance, subscription status), messages you send us, opt-in usage events, and, for Plus users, the cloud forecast copy. Encrypted in transit and at rest; not end-to-end encrypted because Horizon Runway's server serves sync.
- WhenAlways
- Cloudflare
- PurposeNetwork delivery and security infrastructure.
- What it can seeStandard web request metadata such as IP address, user agent, requested URL, and timestamp.
- WhenAlways
- Resend
- PurposeTransactional email delivery — invites, replies, account mail.
- What it can seeRecipient email address and the contents of the message being sent.
- WhenAlways
- Stripe Managed Payments, provided by Sold through Link, LLC
- PurposeMerchant of record for Plus transactions.
- What it can seePayment details, receipts, refunds, cancellations, and subscription management. Horizon Runway receives subscription status and a customer identifier, not the full card number.
- WhenOnly if you use it
- Google Workspace
- PurposeBusiness email for hello@horizonrunway.com.
- What it can seeSender addresses, message contents, and related email metadata.
- WhenAlways
We keep this list current. If we add a company that can see customer data, we update this page, and organizational customers on a signed agreement get notice before the change takes effect.
Who is responsible for what
The split between the hosting platform, us, and youShow
Data storage
- Platform
- Encryption at rest, backups, availability.
- Us
- Keeping each account's data reachable only from that account, and keeping stored data minimal.
- You
- Deciding whether to sign in to a Plus account and protecting your own device.
Access
- Platform
- Authentication service and session handling.
- Us
- Which routes require an account, and admin discipline.
- You
- Protecting your own sign-in and device.
Financial decisions
- Platform
- —
- Us
- An accurate forecast from the numbers entered.
- You
- The numbers entered, and the decision made from them.
What we have not done
Horizon Runway does not hold SOC 2, ISO 27001, PCI-DSS, HIPAA, or GDPR audit status. If you need audited software for your situation, Horizon Runway isn't the right fit yet.
There is no third-party penetration test of Horizon Runway. None has been done yet, and one is planned.
This page is maintained by Horizon Runway LLC to answer common security and privacy questions about Horizon Runway. It describes our own practices and the platform features we rely on. It is not an independent audit, a certification, or a legal guarantee.
Report a security issue
Write to hello@horizonrunway.com with “Security report” in the subject line. Test only against your own data, do not degrade the service for others, and give us a reasonable window to fix an issue before publishing it.
The detail behind the promise
Hosting, vendors, and how long each record is kept live in the privacy policy. What Horizon Runway is and isn't lives in the terms.
Shorter questions about how the forecast works? Read the answers.