Privacy policy

• Bank access is read-only. The application cannot move money, and the features that would let it do so are not connected.
• We never see or store bank usernames and passwords. Those go directly to Plaid.
• Nothing is sold, shared for advertising, or used to train anything.
• There are no analytics, no advertising trackers, and no third-party cookies.
• Disconnect a bank and its data is permanently deleted within 30 days.

Identity. Signing in uses Google. From that we receive a name, email address and profile picture. There is no password for members, so none is stored.

Financial data, through Plaid. When a bank or card is connected, the application receives account names, types and the last few digits of the account number; balances; transaction history, including date, amount, description and the merchant the bank reports; and, for credit cards, statement due dates, minimum payments and interest rates.

What is added by hand. Categories, rules, notes, corrections, and any transactions imported from a CSV file that is older than the bank will provide.

Bank credentials are never collected. Connecting an account happens inside Plaid’s own interface. Credentials go to Plaid and the bank. This application receives a token that permits reading, and nothing else.

Showing the household its own spending: categorising transactions, grouping them by vendor, detecting recurring bills, tracking due dates, and sending the alerts the two members configure for themselves.

It is not used for anything else. There is no advertising, no profiling, no sale of data, no sharing with data brokers, and no use of this data to train machine-learning models.

These are the only third parties involved, and what each one gets:

• Plaid connects to the banks and provides the account and transaction data. Plaid handles the bank credentials; this application never does.
• Supabase hosts the database where the data is stored.
• Vercel hosts the application itself and serves it over HTTPS.
• Google provides sign-in, and receives nothing about the household’s finances.

Three further services are planned and not yet enabled: an email and SMS provider for alerts, which would receive the text of an alert and the recipient address or number; an AI provider for written insights, which would receive only the figures a specific question needs; and a calendar service, which would receive bill names, amounts and due dates in order to place reminders on the household’s own shared calendar. If those are switched on, account numbers and access tokens are never included, and this page is updated at the same time.

Data is disclosed to no one else, with the ordinary exception of a valid legal demand.

• Everything travels over HTTPS. The site refuses plain HTTP.
• The database encrypts data at rest, and every table is protected by row-level security so that a query can only ever return this household’s rows.
• The tokens that permit reading from a bank are encrypted a second time, by the application, before they are written down. They are never sent to the browser.
• Signing in requires Google two-step verification, and connecting a new bank requires having signed in within the last 12 hours.
• The accounts used to administer the database and the hosting are themselves protected by multi-factor authentication.

The full detail is in the published access control policy.

Account and transaction data is kept for as long as the corresponding bank connection is linked, so that spending can be compared against previous years.

When a bank is disconnected, the instruction to forget it is sent to Plaid and that connection’s accounts, transactions and stored token are permanently deleted within 30 days. This is a real deletion, not a flag that hides the rows.

Deleting everything is available on request from either member, and removes all of that household’s data on the same basis.

This policy and the retention periods in it are reviewed once a year. The full detail is in the published data retention and disposal policy.

Both members can see everything the application holds, because that is what the application is for. Either can export it, correct it, disconnect any bank, or ask for all of it to be deleted. There is no separate request process: they are the operators.

This application is not directed at children and is not made available to them. No accounts exist other than the two household members.

If what is collected, who receives it, or how long it is kept changes, this page changes with it and the date at the top is updated.

This application is operated privately by the household that uses it. Questions about this policy go to the operator at the address listed in the connected Plaid account.