Privacy policy

Who this covers

Bill Tracker is a private budgeting app for one household. It is built and run by one person, and its only users are the two members of that household. This page explains what the app stores, why, who can see it, and how to get it removed. Questions go to [email protected].

What the app stores

• Your name, email address and photo, received from the sign-in service when you sign in. Bill Tracker never sees your password.
• What you enter: bills, payments, paychecks, account balances, savings goals, debts, categories, notes and reminder settings.
• Bank statements you upload, and the transactions and balances the app reads from a bank account you connect through Plaid.
• Conversations you have with the in-app assistant, and how much those conversations cost to run.
• A push notification token for your phone, if you turn reminders on.

Connected bank accounts

Connecting a bank account is optional and only happens when you start it yourself. Plaid, a bank data provider, shows its own consent screen and handles the login to your bank. Bill Tracker never receives your bank username or password. From a connected account the app receives transactions and the current balance, and nothing else. It does not request account or routing numbers and cannot move money.

The credential Plaid gives the app for a connected account is stored encrypted and never leaves the server. You can disconnect an account at any time from Settings. Disconnecting deletes that credential and tells Plaid to remove the connection. Plaid's handling of your data is described in Plaid's end user privacy policy.

How the data is used

Everything the app stores is used to show the household its bills, plan paydays, match bank activity to scheduled payments, and send the reminders you asked for. The in-app assistant reads the same data to answer your questions and proposes changes that only apply after you confirm them. Messages you send to the assistant are processed by Anthropic's Claude API to produce replies.

Nothing is sold, shared with advertisers, or used for any purpose other than running the app for your household.

Who can see it

Both household members can see the shared household records. Personal settings, notification choices, assistant conversations and each person's connected bank accounts are visible only to that person. The operator of the app can access the server that stores the data and does so only to run and repair the service.

Third parties that process data on the app's behalf: Plaid for bank connections, Anthropic for assistant replies, Apple for push notifications, and Sentry for error reports, which exclude financial values and personal details.

Where it lives and how it is protected

Data is stored on a server the operator owns and administers, in the United States, and reaches your browser or phone only over encrypted connections. Backups are copies kept on a second machine the operator owns. Bank connection credentials are encrypted at rest.

Your choices

• Export everything the household has stored from Settings, Data and exports.
• Disconnect a bank account from Settings at any time.
• Turn reminders off from Settings, Notifications.
• Leave the household from Settings, Household.
• Ask for your account or the whole household's data to be deleted by emailing [email protected]. Deletion is completed within 30 days, including removal from backups.

Retention

Data is kept for as long as the household uses the app. Connected bank data is removed when the account is disconnected. Deleted data leaves the backups at the next backup after the deletion.

Changes

If this policy changes, the effective date above moves and both members are told in the app before the change applies.