Privacy Policy

Account data — your name, email address, and a hash of your password.

Financial data — accounts, balances, and transactions you add manually or that are retrieved from institutions you connect through our data aggregator (currently Plaid Inc.).

Technical data — session information (such as IP address and browser user agent) used to keep your account secure.

Solely to operate the Service for you: displaying your accounts and activity, computing budgets and net worth, keeping your session secure, and syncing with institutions you have connected. We do not sell your data, share it with advertisers, or use it to build profiles for anyone else.

Connections to financial institutions are made through Plaid. Your bank username and password are entered with Plaid, not with us — we never receive or store them. Plaid issues us an access token, which we store encrypted (AES-256-GCM) and use only to retrieve your account and transaction data. Plaid's handling of your information is governed by their end-user privacy policy, available at plaid.com/legal.

Data is stored in a PostgreSQL database controlled by the operator of this instance. Aggregator access tokens are encrypted at rest at the application layer; passwords are hashed; transport is encrypted in production deployments. No system is perfectly secure — use a strong, unique password.

Your data is retained while your account exists. Deleting your account removes your user record, and cascading deletion removes your bank connections, accounts, transactions, and budgets. Disconnecting a bank connection revokes our access and removes its synced data.

You can access and correct your data in the app, export it by request, and delete your account at any time. Depending on where you live, you may have additional statutory rights (such as under GDPR or CCPA) — requests can be made to the operator of this instance.

We may update this policy from time to time; the date above reflects the latest revision. Material changes will be communicated through the Service.

Privacy questions? See our Terms of Service for how to reach the operator of this instance.