Privacy Policy
What is stored, where it lives, and what is never done with it.
Last updated Sep 1, 2026
01What is collected
What you type, plus who you are. Transactions and their amounts, dates, notes and the people you name in them; the categories, accounts and budgets you set up; links to any photo you attach; and your settings — display name, language, theme, number format and month start day. If you sign in with Google, the app is also given your account id, email address and profile picture, which is how your rows are told apart from anyone else's. If you continue without an account, you are given an anonymous id instead and no email or picture is involved. No password is ever seen or stored. If you invite somebody to a trip, the email address you type is stored alongside that trip, because matching it to their account is what lets them open it.
02Where it lives
In a Postgres database hosted by Supabase, in a schema reserved for this app. Every table has row-level security on, with a policy that matches each row against your signed-in account id — so another account querying the same table gets an empty result rather than your ledger. Trips you have shared are the one exception: those policies also match the accounts you invited, and only for the trip you invited them to. The server-side key that can bypass those policies never leaves the server.
03How it is protected
Signing in is optional. Through Google, this app never sees your password; without an account, you are given an anonymous id that only this browser holds. Either way the session is an http-only cookie, and the database checks that id against every row it hands back, so another account gets an empty ledger rather than yours — apart from a trip you invited them to, which is the only thing an invitation reaches. One thing to know if you stay a guest: that ledger is stored on the server like any other, not just on your device, and it is reachable only through this browser. Signing out as a guest, or losing the browser session, puts it permanently out of reach rather than deleting it. Adding Google before then moves everything you entered onto that account.
04What is never done
There are no analytics, no advertising, no third-party trackers and no marketing scripts. Nothing about you or your spending is sold or sent anywhere for profiling, and the only sharing that happens is the sharing you ask for by inviting somebody to a trip. Fonts are served by the app itself rather than fetched as you browse. Two things load from elsewhere, both of them pictures: your Google profile photo, which comes from Google's servers, and receipt images carried over from a Money Manager export, which still live on that app's CDN. Neither of those requests carries anything about your ledger. The two places where your own data can leave are the assistant and the microphone, described next.
05Asking the assistant
The Insights screen carries an optional assistant that answers questions about your money. It is switched off unless an Anthropic API key is configured on the server, and while it is off nothing is sent anywhere. When it is on, answering a question sends the parts of your ledger that question needs to Anthropic's API: dates, types and amounts, category and account names, balances, loan positions, and the notes and counterparty names you typed. It asks for what it needs rather than uploading the whole table — but those notes are your own words, and they do leave the server. If that is not a trade you want, leave the key unset and the feature stays inert.
06The microphone
The mic button on the assistant uses your browser's own speech recognition, which means the audio is transcribed by whoever made your browser — Google on Chrome, Apple on Safari — under their privacy policy rather than this one. This app never records, stores or uploads audio itself; it receives only the text that comes back. The button is disabled while the assistant is off; when it is on, this happens the moment you press it, so do not press it if you would rather nothing was heard.
07Reminders and notifications
Turning reminders on creates a subscription with your browser's own push service — Apple's for Safari and any iPhone home-screen install, Google's for Chrome and Android, Mozilla's for Firefox. Which company that is follows from the browser you use rather than from a choice this app makes, and web notifications cannot work without one. The notification is encrypted with keys your browser generated, so that service carries it without being able to read it; what it does learn is that something was sent to your device and when. Two of the four reminders put a figure inside that encrypted text: a budget alert names your budget and the percentage used, and a bill reminder names the entry's note and its amount. The daily nudge names no figure, and a trip reminder names only the trip. What is stored here is the delivery address your browser issued, the two keys that encrypt to it, your browser's user-agent string, your timezone, which reminders you turned on and the time you chose for the nudge — plus one row per reminder sent, holding its kind and the date it covered so the same one is not sent twice. No notification text is ever stored. Switching reminders off unsubscribes at the browser and deletes the address. An address the push service reports as gone for good is deleted on the next send; one that merely fails is kept, with the time it failed, so it can be rested a few hours and tried again. On an iPhone this works only for the home-screen install, which is Apple's restriction rather than this app's.
08Trips you share
Inviting somebody to a trip gives their account — and only their account — the right to open that one trip: its expenses, the people in it and the balances between them. Nothing else in your ledger is reachable from it. You choose whether they can add and edit expenses or only look. The invitation is a row holding the address you typed; nothing is emailed to it, the trip simply appears the next time that person opens the app, and the app never tells you whether the address already has an account here. Remove the invitation from the trip's share panel and their access goes with it, while their share of every expense stays as it was.
09Cookies and local storage
One session cookie, set when you sign in — with Google or as a guest — keeps you signed in. It is http-only, so scripts on the page cannot read it. One local-storage entry, mt-theme, remembers whether you chose light or dark so the screen does not flash white on load. Neither is used for tracking, and clearing them only signs you out and forgets the theme.
10Feedback you send
A message sent from Settings → Feedback is stored with the date it was sent, the language the app was in, and the app version — nothing more. Please do not put account numbers, passwords or anything else sensitive in it.
11Your control over it
Every entry can be edited or deleted from the screen it appears on. Settings → Import & export writes the whole history to XLSX or CSV whenever you want a copy. Deleting a transaction removes it from the database rather than hiding it; categories and accounts are archived instead, so past entries keep their history.
12Changes to this policy
If what the app stores changes, this page changes with it and the date above is updated.