Privacy Policy

1. Data we collect

• Account information. When you register, we collect your email address, country and preferred language, and later the name you give us. A password is optional: we email you links to sign in and to confirm your address, and only a scrambled copy of each link is stored. If you set a password, it is stored as an irreversible hash — we cannot see or recover it. We also record when you last signed in and last used the app.
• Signing in with Google. If you sign in with Google, Google shares your name, email address and profile picture with us. We keep them to set up your account and to show your picture in the app. We don’t get your Google password or anything else from your Google account.
• Financial data you enter. Transactions (amounts, dates, merchants, categories, notes), budgets, recurring transaction schedules, savings goals and their deposits, and the CSV files you import. This is the core of the service and is only used to operate your account.
• AI interactions. Messages you send to the AI bookkeeping assistant, receipt photos you scan, category suggestions for the CSV files you import, and the AI-written summaries shown on your Overview. See section 3 for what is sent and what is kept.
• Households and private-budget access. If you start or join a household (see section 4), we keep its name, currency, time zone and the day its month starts; who is in it and their role; invitations (email, role and a scrambled copy of the one-use, 7-day link); any private-budget access an adult explicitly gives another adult; and change logs. Shared-item logs may keep shared values before and after. The private-budget activity log keeps who acted, the action, the type of item and when. When a delegate edits one of the owner’s transactions, that transaction’s history also keeps the fields they changed, before and after (type, amount, date, category, merchant and note).
• Shared household money. Shared categories, transactions, budget lines, savings goals and what goes into them, recorded in the household’s shared book, with who added and last changed each; each member’s declared contribution to the household; and each member’s monthly allowance totals (planned, spent and left).
• Children’s profiles and Child Mode. A parent may create a profile for a child who has no account: a nickname, an avatar picture chosen from a fixed set, an age range (never a birthday), an allowance and how it is split into spend, save and give, and optionally a 4–6 digit PIN, which we keep only as an irreversible hash. We do not collect a child’s name, email address, birthday, photo, location or contact details. When a parent opens Child Mode on a device, we keep a scrambled copy of that device’s access token, when it was last used and how long it stays unlocked, and what the child asks to spend, save or give, with the parent’s answer.
• Premium waitlist. If you join the waitlist, the email address you give and your language.
• Payments. If you subscribe to Premium, or to Family as a household’s owner, Stripe handles the payment on its own page. We never see or store your card details; we keep your Stripe customer ID and your subscription’s status and dates. Stripe sends your receipts and keeps payment records as the law requires.
• Page speed. Vercel Speed Insights measures how quickly pages load and respond (anonymous timings and the page address, no cookies), so we can keep the site fast.
• Usage analytics. We use Google Analytics to understand how the product is used (pages visited, features used, device and browser type). Until you allow analytics, it runs in consent mode: nothing is stored on your device and no identifier is set, and Google only counts these visits in aggregate. If you allow it, Google Analytics may also set its cookies. Google Analytics 4 does not log or store IP addresses. We never send transaction amounts, merchant names, or chat contents to analytics, and we don’t use it for advertising.
• Session recordings on our public pages. If you allow analytics, Microsoft Clarity records how our public pages (the home page, pricing, free tools, comparisons and help) are used: clicks, scrolling and mouse movement, shown to us as replays and heatmaps, with your device and browser type and an approximate location. It never runs inside the app, where your budget and transactions are, and not at all unless you allow it.
• Support communications. Emails you send us, and messages sent from our contact page: the topic, your email address, the name if you give one, the message, and your account if you were signed in. We keep them so we can reply and look back at what you told us.

2. How we use your data

• To provide and operate the service (your budgets, transactions, goals, and reports).
• To power AI features: your assistant messages are processed to suggest transactions for you to confirm, the shops in a CSV file you import are matched to your categories, and monthly figures are used to write your summary (see section 3).
• To run your household: show each member what their role or an explicit private-budget grant allows, keep allowance totals up to date, and send household or private-access notices. Notices about private-budget access or destructive delegated actions identify people and the kind of action, never amounts or private spending details.
• To improve the product, using aggregated and de-identified analytics.
• To communicate with you about your account, security, important changes, or — if you joined the waitlist — the launch of Premium.

We will never sell your personal data. We do not use your financial data for advertising.

3. AI data processing (OpenAI)

Our AI features are powered by OpenAI's API.

• Assistant. The messages you type (with the recent messages of the same conversation) and your list of categories are sent so it can read and categorize transactions. We do not store the conversation: it stays in your browser until you leave or reload the page. Only the transactions you confirm are saved. We count how many messages you send each day to apply the free plan limit, and record how much AI processing your account used each day.
• Receipt scanning. When you scan a receipt, the photo (made smaller on your device first) and your list of categories are sent so it can read the shop, date, total and lines. We do not store the photo: it is only held while it is being read. Only the transactions you check and save are kept. We count how many receipts you scan each month to apply your plan’s limit, and record how much AI processing your account used each day.
• CSV import. When a file you import leaves spending without a category, we first suggest one for each shop from how you filed that shop before; that matching happens on our servers and nothing is sent. For shops still unplaced, their descriptions as your bank wrote them, and your list of categories, are sent so the AI can suggest a category or say it isn’t sure; amounts and dates are not sent. Only when our own rules can’t tell which column of a file is which, the column names and the first five rows (which can include dates, descriptions and amounts) are sent so the AI can suggest the columns. You check every suggestion before anything is imported. The suggestions and your choices are kept with the import record and deleted when it is undone or your account is deleted; the file itself is deleted once the import finishes, or after a day if it is never imported. We count how many imports use AI each month to apply your plan’s limit, and record how much AI processing your account used each day.
• Summaries. Your monthly figures (such as totals, what is left, and the categories and savings goal names they refer to), or for a yearly summary the year’s totals by month and category, are sent to write a short summary, which we store with your account. Individual transactions are not sent for summaries. The Overview summary has its own switch. Premium weekly, monthly and yearly email summaries each require a separate opt-in in Account and can be unsubscribed from independently. Their original snapshots remain in your private archive until you delete your account. Merchant-level anomaly details are inserted by our code, not sent to the AI.
• Household summary. For a household’s owner, parents and adults, a short summary of the household’s month is written from its shared figures only (shared spending, the shared plan and goal progress). No member’s private transactions, no teen’s transactions and no allowance details are sent. Teens do not receive the household summary.
• Child Mode has no AI. Nothing a child enters in Child Mode is sent to any AI provider. With Family, the household shares a daily number of assistant messages and each member has a daily limit; the owner can see how many messages each member sent that day, never what they said.
• According to OpenAI's published API data policy, data submitted through the API is not used to train their models. OpenAI keeps abuse-monitoring logs for up to 30 days, unless longer retention is required by law or is reasonably necessary to protect its services or others from harm.
• We never send your password or login credentials to any AI provider.

4. Households and Family

With Family, people who share money can keep one household budget while each person’s own budget remains private by default.

• Your own budget is private by default. Household roles alone do not reveal it: the household sees only your allowance totals and the contribution you declare. An owner, parent or adult may explicitly give one other active adult full access to their own personal budget. That one-way grant includes all existing and future fixed income, plans, categories and transactions, which the delegate may add, edit and delete, and the reports built from them. Only the budget owner may grant or revoke access; access ends immediately on revocation, leaving, removal, becoming a teen or household closure.
• Delegated activity. We retain a minimal record of changes made by a delegate: who acted, the action, item type and time. When a delegate edits a transaction, we also keep what they changed, before and after, shown only in that transaction’s history. The budget owner and current delegate can view it; after revocation only the owner can. A reciprocal grant requires the other adult to opt in separately, and delegates cannot export the owner’s private data or use the owner’s savings, recurring, import or account features, or share the owner’s “Where your money goes” card. A delegate may use their own AI assistant to record transactions in the owner’s budget: the delegate’s messages or receipt photo are then sent with the owner’s list of categories, and count against the delegate’s own limits.
• Shared money (shared categories, transactions, plans and goals) is visible to the household’s owner, parents and adults. Teens see only the shared categories and goals marked for teens, and the shared transactions they added themselves.
• Teens are invited by the owner or a parent and have their own account. Their privacy mode is chosen by the owner or a parent, and the teen is told whenever it changes. In private mode, parents see only the teen’s allowance totals. In supervised mode, the owner and parents can see the transactions the teen adds from the moment supervision is turned on — never earlier ones — and cannot change them.
• Children’s profiles (see section 9) are visible to the owner, parents and adults, not to teens. Only the owner and parents can change them, and only they can approve what a child asks for in Child Mode.
• Leaving. Anyone but the owner can leave at any time (a supervised teen asks a parent to take them out). Their access ends at once; their own data stays in their own account, and shared transactions they added stay with the household, shown as from a “Former member”. The owner hands ownership to a parent or adult, who must accept it, before leaving.

5. Cross-border transfers

We operate from Canada. Some of our providers (OpenAI, Vercel, Google, Microsoft, Cloudflare, Twilio SendGrid, Stripe) process data in the United States. By using AI Budgie, you consent to your data being transferred to and processed in the US, where it is protected under our agreements with those providers.

6. Data retention

• Account and financial data: kept while your account is active. Minimal private-budget activity is kept with the budget owner’s book for accountability, including after access is revoked, and is deleted when that book is deleted. A transaction’s changed values are deleted when that transaction is deleted. Private-access grant records are deleted with the related household membership or household. When you delete your account (Account › Your data), it and everything in it are deleted right away.
• AI summaries and daily AI usage records: kept with your account and deleted with it. Assistant conversations are not stored by us.
• Households: a household’s shared data is kept while the household exists. When its owner closes it, it can be viewed, exported or restored for 30 days and is then permanently deleted; members’ own accounts are not affected. A deleted child’s profile can be restored for 30 days and is then permanently deleted. If you delete your account, shared records you added and your allowance totals stay with the household without your name; an owner hands the household over (or closes it) first if others are in it.
• Child Mode on a device: lasts up to 30 days, and ends at once when a parent signs the device out, archives or deletes the profile, or the child gets their own account.
• Emails you send us: kept in our inbox for as long as needed to help you, and deleted on request.
• Waitlist emails: kept until Premium launches and we have told you, or until you ask us to remove yours.
• Analytics data: retained per our Google Analytics settings (up to 14 months). Microsoft Clarity keeps recordings for 30 days and its heatmap totals for up to 13 months.
• Backups: may persist for up to 90 days after deletion, after which they are overwritten.

7. Your rights

You may at any time:

• Download a copy of your data, on your Account page under Your data.
• Correct inaccurate information (you can also change your name, country and language in your account).
• Delete your account and data, on the same page.
• As a household’s owner or parent, export everything the household shares, from the household’s settings.
• Leave a household at any time (a supervised teen asks a parent to take them out).
• Withdraw consent for analytics — or clear your cookies, and choose again when the banner returns.

AI summaries you can turn off yourself, on your Account page. For anything else, or if you can’t sign in, email hello@aibudgie.app; we respond to every request within 30 days.

8. Security

We protect your data with TLS encryption in transit, hashed passwords, and restricted access to production systems. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Children and teens

On their own, AI Budgie accounts are for people 16 and over. Within a household, it can also be used by younger people, with a parent or legal guardian in charge:

• Teens aged 13 to 17 may have their own account in a household, invited by its owner or a parent, who confirms they are the teen’s parent or legal guardian (or act with their permission) and that the teen may use AI Budgie. What other members can see of a teen’s money is described in section 4.
• Children under 13 do not have accounts. A parent may create a child profile with only a nickname, an avatar picture, an age range and an allowance (and, if they wish, a PIN), and may open Child Mode on a device for them. Child Mode shows the child their allowance and the goals meant for them, and lets them ask to spend, save or give; a parent must approve each request. Child Mode has no AI, no access to other members’ information and no way into the rest of the app.
• A parent can view, change, export or delete a child’s profile at any time. If we learn that someone under 13 has an account of their own, or someone under 16 has one outside a household, we will delete it.

10. Cookies and local storage

• Local storage (strictly necessary). Your sign-in token and your language choice are kept in your browser's local storage, not in cookies, along with small interface preferences such as tips and notices you have dismissed.
• Child Mode (strictly necessary). On a device where Child Mode is open, its access token is kept in local storage. It is separate from any adult’s sign-in and is removed when Child Mode is left on that device.
• Sidebar cookie. Remembers whether you collapsed the app sidebar, for seven days.
• Consent cookie. Remembers whether you allowed analytics, for one year.
• Google Analytics cookies. Set only after you allow analytics in the banner. Without that, Google Analytics sets no cookies and only sends anonymous, cookieless measurements.
• Microsoft Clarity cookies. Set only after you allow analytics, and only on our public pages: _clck keeps the same visitor ID for up to a year and _clsk ties one visit’s pages together for a day.

11. Changes to this policy

If we make material changes, we will notify you by email or an in-app notice before they take effect. Continued use of the service after the effective date constitutes acceptance.

12. Contact

Questions about this policy or your data: hello@aibudgie.app.