Money Actually

Privacy Policy

Last updated October 20, 2026

Money Actually is a personal financial dashboard. It is read-only: it shows you your money and never moves it. This policy explains exactly what we collect, why, who touches it, and how to get rid of it.

1. Who we are

Money Actually is operated from McKinney, Texas, at moneyactually.app. Privacy questions: support@moneyactually.app.

2. What we collect

Information you give us. Your email address and, if you create one, a password (stored only as a salted scrypt hash — we never see or store the password itself). Optionally a display name.

Sign in with Google or Apple. If you choose to sign in with Google or Apple, that company authenticates you and tells us your email address, whether it is verified, your name if you allow it, and an account identifier that lets us recognise you next time. If you use Apple’s Hide My Email, we receive only the relay address. We never receive your Google or Apple password.

Financial data, via Plaid. When you connect a bank, Plaid Inc. authenticates you directly with your institution and returns data to us. We receive:

We never receive your bank username or password. Those go directly to Plaid and your bank. We never receive full account numbers.

Payments, via Stripe. If you subscribe on our website, Stripe, Inc. collects your payment details directly on its own checkout page. We give Stripe your email address and an internal account identifier so the subscription is linked to you, and Stripe tells us identifiers for your customer record and subscription, and whether the subscription is active. We never receive or store your card number.

Payments, via Apple. If you subscribe in the iOS app, Apple sells and bills the subscription through In-App Purchase. The iOS app also gives Apple an internal account identifier with the purchase, so the subscription is tied to your account and no one else’s. Apple tells us a transaction identifier and whether the subscription is active, and we store those against your account so the subscription unlocks it. We never receive your payment details.

Payments, via Google Play. If you subscribe in the Android app, Google sells and bills the subscription through Google Play. The newer Android app also gives Google an internal account identifier with the purchase, so the subscription is tied to your account and no one else’s. Google tells us a purchase token, which plan you bought, and whether the subscription is active, and we store those against your account so the subscription unlocks it. We never receive your payment details.

Technical data. IP address and request metadata, used for rate limiting and abuse prevention, and error diagnostics when something breaks.

Your phone, in the newer Android and iPhone apps. When you sign in, the Android app tells us your phone’s model, such as “Pixel 8”, so Settings can list where you are signed in as “Money Actually on Pixel 8”. An iPhone does not give the app its model, so the iPhone app sends none, and Settings lists it as “Money Actually”. A home-screen widget, if you add one, is labelled the same way: with the model on Android, and as “iPhone” on an iPhone.

A random identifier for the app on your phone, in the newer Android and iPhone apps. The first time the app offers Google or Apple sign-in, it makes a random identifier for this installation and keeps it on the phone (ma.install.deviceId.v1, section 7). It goes to us when you sign in with Google or Apple, and we seal it into that sign-in’s one-time code, so the code can only be redeemed by the app that asked for it. It says nothing about you or the phone, and it is not used for anything else.

Your phone, when you sign in with Google in the newer iPhone app. The sign-in runs in Google’s own software inside the app. While it is open, Google may collect information from your phone, as Google’s Privacy Policy describes. Google’s software declares to Apple that this can include identifiers for you and for the phone, a phone number, a rough location, and how you use Google’s sign-in screens, which Google uses for its own analytics and to prevent fraud. In the newer Android app, sign-in goes through the phone’s own Google account screen instead. We receive only what the paragraph on signing in with Google says above, and the app keeps none of the rest.

Your phone, when you connect a bank in the newer Android and iPhone apps. The connection runs in Plaid’s own software inside the app. While it is open, Plaid may collect information from your phone, as Plaid’s End User Privacy Policy describes: your IP address and time zone setting, and a rough location from them; the phone’s model and operating system; which of Plaid’s screens you use; and network and other technical data about the phone, which Plaid uses to run the connection and to prevent fraud. Plaid may also ask for your phone number so it can recognise you next time; we never ask for it. On Android, Plaid’s software holds two permissions for this, neither of which shows a prompt: reading basic phone state (READ_BASIC_PHONE_STATE), which does not give it your phone number or the phone’s IMEI, and changing network state (CHANGE_NETWORK_STATE). On an iPhone it asks for no permission at all. We do not receive any of this, and the app keeps none of it.

Error reports, from the newer Android and iPhone apps. If the app crashes or hits an error, it may send a report to our own servers, not to an outside crash-reporting service: the kind of error, its message with numbers, quoted text, email and web addresses taken out, where in the app’s code it happened and on which screen, the app’s version and build, your phone’s operating system version and model (on an iPhone or iPad, just “iPhone” or “iPad”), and when it happened. Never your balances, your transactions, or anything you typed. A report is stored against your account, because only a signed-in app sends one, and kept for 30 days.

Error reports, from our website. If a page fails while it is showing in your browser, or something on a page you are signed in to stops working because of an error in our code, the website sends the same kind of report to our own servers: the kind of error, its message with numbers, quoted text, email and web addresses taken out, where in the website’s code it happened, which page it was (as “/accounts/[id]”, never the address with your account in it), your browser’s name and major version and your computer’s or phone’s operating system, such as “Chrome 141” and “macOS”, and when it happened. Never your balances, your transactions, or anything you typed. If you are signed in, it is stored against your account and kept for 30 days; if you are not, our server discards it without keeping anything. Our apps do not send these from the website pages they show.

Notifications, in the newer Android and iPhone apps. If you allow notifications, your phone gets a push token: an identifier that lets a notification reach this app on this phone, issued on Android by Google’s Firebase Cloud Messaging and on an iPhone by Apple’s Push Notification service. The app sends it to us, and we store it against your account and the sign-in it came from, with the kind of phone (Android or iPhone) and when we last saw it. We use it only to send the notifications you have on in Settings: that a bank connection needs you to sign in again, and, if you turn it on, a Sunday reminder that your week is ready. Each notification is a fixed sentence and the screen it opens. A notification never contains an amount, a merchant, a bank’s name or anything else of yours, because it can appear on your lock screen.

How you get through setup, on our website. To find out where setup loses people, we record a few steps against your account in our own database: which setup screens you reached, completed or skipped, and when you open the bank-connection window, which bank it was (Plaid’s identifier for it), whether it ended with a connection, how many accounts you chose, and if it did not connect, Plaid’s code for why. That is all. Never your balances, transactions, account names or anything you type. No cookie or third-party tool is involved, nothing is shared, and none of it is recorded inside our iOS or Android app.

Messages you send support. If you write to us through the support form, we keep what you write, the address to reply to, and your name if you give it. If you leave the box on the form ticked, we also attach the details it lists: whether you used the website or one of our apps, your browser and device type, when your account was created, whether your email is verified and two-factor is on, your plan, and how many bank connections you have and whether any need attention. Never your balances, your transactions, or the names of your banks or accounts.

3. What we do with it

We do not sell your data. We do not share it for advertising. We do not build profiles for anyone else. Your financial data is used to show you your finances, and for nothing else.

4. Background syncing

Once you connect an account, we keep it up to date in the background — including when you are not using the app — so your balances and transactions are current when you open it. This continues until you disconnect the account or delete your account.

5. Who we share it with

These are service providers acting on our instructions, not independent recipients:

We require each of these to protect your data to the standard described here. We will also disclose information where legally compelled, and will tell you unless prohibited from doing so.

Stripe, Google, Apple, and Expo never receive your financial data. Your accounts, balances, and transactions are shared with Plaid, which supplies them, our hosts, which store and serve them, Resend, which delivers the weekly summary if you turn it on, and — only when you ask Slip a question — Anthropic, as described above.

AI only when you ask. Nothing is sent unless you type a question to Slip, and you can turn Slip off. Nothing is sent in the background, on a schedule, or while you are simply using the app. Categorization and recurring detection run on our own servers using your data alone, and always have. If you never type a question to Slip, your figures never reach an AI service. You can turn Slip off completely in Settings.

If Money Actually is sold. If the business, or the part of it that runs this service, is sold, merged or otherwise transferred, your data may pass to the new owner as part of it. The new owner must keep to this policy, including that your data is never sold or used for advertising, or ask for your agreement before using it any other way. We will email you before the transfer happens.

6. How we protect it

No system is perfectly secure. If a breach affects your data we will notify you promptly.

7. Cookies and local storage

We use only what the app needs to work. There are no advertising, analytics, tracking or third-party cookies, no session recording, and nothing that follows you to other sites. That is why we do not show a cookie banner: there is nothing optional to agree to. The setup steps described in section 2 are recorded on our own server against your signed-in account, not with a cookie or anything stored in your browser.

Plaid’s connection window may set its own cookies while it is open, under Plaid’s policy linked above.

On your phone, in the newer Android and iPhone apps. The apps are built natively rather than showing the website, and keep these on the phone. “Secure storage” is the phone’s own: on Android, encrypted with a key held by the Android Keystore; on an iPhone, the Keychain.

The Android app turns off Android backup, so none of this goes into your phone’s backups. On an iPhone, everything in secure storage except your theme is kept for this phone only: iOS never puts it in a backup or moves it to another phone. Your iCloud or computer backup can hold the rest. The offline copy stays encrypted there, and cannot be read without its key, which stayed on the phone. iOS keeps Keychain items after an app is deleted, so if you delete the iPhone app without signing out, its sign-in token and the other secure-storage items above, the widget’s token among them, stay on the phone, where no other app can read them, until the app is installed again (it then opens signed in) or the phone is erased. You can end that sign-in at any time from Settings on our website.

8. Retention and deletion

We keep your data while your account is open. Delete it at any time in Settings → Delete account, or follow these instructions.

Deleting your account:

After a deletion we keep three minimal records, none of which contains financial data:

Support messages are kept for twelve months after you send them, so a conversation can be picked up again, and then deleted. Email already exchanged about them stays in our support mailbox until that twelve months is up, even if you delete your account sooner.

Setup steps (section 2) are kept for 400 days, so this year can be compared with last, and then deleted. They are erased with your account if you delete it sooner.

Error reports from the app (section 2) are kept for 30 days and then deleted. They are erased with your account if you delete it sooner.

Push tokens (section 2) are kept while the sign-in that registered them lasts. One is deleted when you sign out on that phone, end that sign-in from Settings, sign out everywhere, change your password or delete your account, and when Google’s Firebase Cloud Messaging or Apple’s Push Notification service tells us the app is no longer on the phone or the token is no longer valid. A daily cleanup deletes any whose sign-in has ended some other way. Turning a notification off in Settings stops it at once; the token stays until one of those.

Backups are overwritten on a rolling 30-day cycle.

If you ever paid for a subscription, Stripe keeps its own record of those payments, as payment processors must for tax, accounting, and fraud-prevention purposes, under Stripe’s Privacy Policy. If you signed in with Google or Apple, you can also remove Money Actually’s access from your Google Account or Apple ID settings at any time.

9. Your rights

You can access your data in the app, export your transactions to CSV at any time, correct your categorizations, and delete everything. Depending on where you live you may have additional rights under laws such as the GDPR or CCPA; email us and we will honour them. We extend deletion and export to everyone regardless of location.

We do not sell personal information as defined by the CCPA, and never have.

10. Children

Money Actually is not for anyone under 18. We do not knowingly collect data from children. If we learn we have, we delete it.

11. Changes

We will post any change here and update the date above. Material changes will be emailed to you before they take effect.

12. Contact

support@moneyactually.app

Pricing · Privacy · Terms · Security · Delete account

Money Actually provides information and tools, not financial, investment, tax or legal advice.