Privacy Policy

Effective November 10, 2026 · Version 2026-11-10.1

Information we process

• Account information: your username, a password hash rather than your plaintext password, account identifier, invitation status, and account creation time. At signup we record the policy versions, time of acceptance, and your confirmation that you are a US resident aged 18 or older. We do not ask for a date of birth or identity document for this confirmation.
• Budget information you provide: budgets, income settings, categories, transaction labels, rules, and corrections. CSV imports are processed in your browser; the app saves the resulting budget data and import metadata, such as filenames and date ranges, rather than uploading the original CSV file.
• Connected financial information: institution and selected account details, account identifiers and masked account labels, cached current and available balances with currency and fetch time, transaction dates, amounts, descriptions, categories, pending status, and connection/synchronization status. We also store Plaid access tokens needed to keep your selected connections working.
• Technical information: essential session cookies, IP addresses used for login throttling, and operational logs. Logs can include request URLs, timestamps, response status, browser/user-agent information, and referrers.
• Communications: information you choose to send when contacting us, including your email address and message.

How we use information

We use this information to authenticate you, synchronize and display transactions, calculate budgets, apply your categories, manage invitations and connection limits, investigate problems, respond to support requests, and protect the service from misuse. We do not sell or rent your personal information, use it for targeted advertising, or run advertising analytics in Budget.

Plaid, hosting, and other disclosures

When you connect a financial account, Plaid and your financial institution handle the connection flow. Budget does not receive or store your bank-login password. Plaid processes information under its own End User Privacy Policy, which may cover information beyond the subset Budget stores. Deleting your Budget account does not itself constitute a request to delete all information Plaid independently holds; see Plaid’s privacy-request process.

DigitalOcean hosts the application and its storage and provides weekly whole-server backups. Email providers process messages sent to our contact address. These providers process information needed to supply their services. We may also disclose information when required by law or when reasonably necessary to address fraud, security incidents, or protect legal rights.

Other Budget users cannot access your budget through their accounts. Authorized administrators can access server data for operation, support, security, and recovery. A private account does not make your information inaccessible to the operator or hosting provider.

Security and cookies

We use HTTPS, password hashing, account-access checks, restricted deployment access, and encryption for application backup archives. The private key for decrypting those archives is kept separately from the application server. The running database and DigitalOcean’s whole-server backups are not protected by that separate archive key. We do not represent that every copy of your data is encrypted with a key only you possess.

We use an essential session cookie to keep you signed in. We do not add advertising cookies. Plaid may use its own technologies in its connection flow. No security measure eliminates every risk.

Retention and deletion

We keep active account and budget records while you use the service. Disconnecting a bank revokes that connection’s access but preserves imported history. Settings → Delete account requires your current password and deletes active budget data and account credentials after bank access has been revoked. If revocation fails, the app reports the failure so you can retry or contact us.

• Application archives: encrypted deployment/recovery backups are scheduled to expire within 30 days while the retention service is operating.
• Weekly hosting backups: DigitalOcean documents a four-week retention period for weekly backups. These full-server copies can include the live database and application archives. Because an archive can be captured near the end of its own retention period, copies of deleted account data may persist for approximately 58 days after deletion under the normal schedules. Downtime or failed cleanup may delay removal until cleanup resumes.
• Deletion and administrative records: we retain minimal account identifiers, administrative timestamps, invitation/connection usage records, and deletion records to prevent identity reuse, enforce beta limits, and avoid restoring deleted accounts. These records do not retain your username, password, budget, or transaction history after active-data deletion.
• Logs and correspondence: deleting an account does not automatically erase operational logs or messages you sent us. Web logs currently rotate daily and retain 14 rotated files when rotation runs; application/system logs use separate size-based rotation and do not currently have a fixed maximum age. Login-throttling records and support correspondence also have separate retention. Contact us about these records; we may need to retain information for security, legal obligations, or resolving a request.

Backup restoration must preserve and apply the latest deletion records before reopening accounts. A whole-server restore requires additional reconciliation because it can also restore an older deletion ledger. Backups are used for recovery, not to reactivate deleted accounts. Copies you downloaded remain under your control.

Your choices and requests

You can view and edit your budget, export it, disconnect banks, and delete your account in the app. To request access, correction, deletion, or ask about other privacy rights that may apply, email jackson@walterslabs.dev. We may need to verify that a request concerns your account. Do not send your password, bank credentials, recovery key, or full account numbers.

Eligibility and policy changes

This beta is only for US residents aged 18 or older. It is not intended for children or other ineligible users. If you believe an ineligible person has created an account, contact us so we can investigate and address it.

We will update the effective date when this policy changes and provide notice of material changes. Where a change requires consent, we will obtain it before applying that change. Questions about this policy can be sent to Walters Labs LLC.