Privacy Policy

1.The short version

We collect the data we need to run a personal finance app for you — and not more. We do not sell your personal information, we do not share it with advertisers, and we do not use your financial data to train AI models.

The rest of this page explains exactly what we collect, who processes it on our behalf, and how to get it back or delete it.

2.Who this applies to

This policy covers Budget & Beyond ("we", "us"), based in San Jose, California, and the Budget & Beyond website, waitlist and application. It does not cover your bank, broker or any other site we link to — they have their own policies.

3.What we collect

What you give us

Your email address when you join the waitlist. If you create an account: your name, sign-in credentials or the identifier from the sign-in provider you choose, and anything you enter into the app — budgets, goals, categories, notes and manually added transactions.

From your connected accounts

If you connect a financial institution, we receive account names and types, balances, transaction history, and — for brokerage connections — holdings and positions. We receive this read-only. We never receive or store your banking credentials; you enter those with our data provider, not with us.

What you ask the AI

The prompts you write and the portion of your financial data needed to answer them, plus the widgets that get generated.

Collected automatically

Standard technical data — IP address, browser and device type, pages viewed, and how you move through the app — along with the marketing campaign (UTM) parameters in the link that brought you here, if any.

Payment information

When paid plans launch, card details go directly to our payment processor. We store only the subscription status and the last four digits, never the full card number.

4.Why we use it

• to run the Service — import and display your accounts, calculate budgets, generate the widgets you ask for;
• to send you transactional email: waitlist confirmations, launch news, receipts and security notices;
• to keep the Service secure — detecting abuse, debugging failures and investigating suspected fraud;
• to understand how the product is used in aggregate so we know what to build next;
• to meet our legal, tax and accounting obligations.

5.Cookies and analytics

We use a small number of first-party cookies and similar storage to keep you signed in and to remember your preferences. For product analytics we use PostHog, which sets an identifier so we can count visitors and see which parts of the product get used.

We do not run advertising trackers or sell audience data. Most browsers let you block or clear cookies; the app needs its sign-in cookie to work.

6.Who processes your data for us

We share personal data only with the service providers below, only for the purposes listed, and only under contracts that require them to protect it. This list changes as the product grows; we keep it current here.

Google Cloud / Firebase

Hosting, database, authentication and serverless functions. Effectively all of your data is stored here, in the United States.

Plaid

Read-only connections to banks and card issuers, and the transaction data they return.

SnapTrade

Read-only connections to brokerage accounts and holdings.

Anthropic

The AI model behind plain-language answers and generated widgets. Prompts and the data needed to answer them are sent for processing and, under our agreement, are not used to train their models.

Resend

Sending transactional and waitlist email.

PostHog

Product analytics — how the app is used, in aggregate.

7.When else we might share it

• when you ask us to, or direct us to share it;
• to comply with a law, subpoena or lawful government request, or to enforce our Terms;
• to protect the rights, safety and property of our users, the public or us;
• in a merger, acquisition or sale of assets — in which case we will tell you before your data moves, and the buyer stays bound by this policy.

8.What we do not do

• We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
• We do not use your financial data to train AI models.
• We do not give advertisers or data brokers access to your accounts or transactions.

9.How long we keep it

We keep your account data for as long as your account is open. Delete your account and we remove or de-identify your personal data within 30 days, except for records we must keep longer for tax, accounting or fraud-prevention reasons.

Waitlist emails are kept until you unsubscribe or launch has passed. Disconnecting a financial institution stops new data from arriving and removes the stored connection; you can delete the already-imported history from within the app.

10.How we protect it

Data is encrypted in transit and at rest. Access to production systems is limited to the people who need it and is protected by multi-factor authentication. Account connections are read-only, and generated widget code runs in an isolated sandbox that cannot reach the network or another user’s data.

No system is perfectly secure. If a breach ever affects your personal data, we will notify you and the relevant regulators as the law requires.

11.Your choices and rights

Access and portability

Ask for a copy of the personal data we hold about you, in a portable format.

Correction

Fix anything inaccurate, from the app or by writing to us.

Deletion

Delete your account and the data attached to it, subject to the retention exceptions above.

Disconnect

Revoke any financial connection at any time, from the app or from your institution.

Email preferences

Unsubscribe from waitlist and product email using the link in any message. We will still send essential account and security notices.

To exercise any of these, write to info@budgetandbeyond.com from the address on your account and we will respond within the time the law allows. We will not discriminate against you for exercising a right.

Depending on where you live, you may have additional rights — for example under the California Consumer Privacy Act or the GDPR — including the right to object to or restrict certain processing, and the right to complain to your data protection authority.

12.Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal data, write to us and we will delete it.

13.Where your data lives

Our systems and our providers operate in the United States. If you use the Service from elsewhere, you understand that your data will be processed in the United States, where privacy laws may differ from your own.

14.Changes to this policy

We will update this page as the product changes, and we will revise the effective date at the top. If a change materially affects how we handle your data, we will tell you by email before it takes effect.

15.Contact

Questions, requests, or something that looks wrong? Write to info@budgetandbeyond.com and a founder will read it.

Budget & Beyond, San Jose, California, United States.