Privacy Policy

The short version

Moolah is a budgeting app. It holds what you put into it so that it can add it up and show it back to you, and it does nothing else with it.

There is no advertising in Moolah, no analytics, no tracking pixels and no third-party scripts. Nothing here is sold, rented or handed to anyone for marketing, and your budget is never used to train anything. The only companies that touch your data are the ones needed to run the service — a host, a database, an email sender — and, if you choose to connect one, your bank feed provider.

You can delete your account and everything in it at any time, from Settings on the web or in the iPhone app. It goes immediately and it does not come back.

Who runs Moolah

Moolah is the service at moolahbudget.com and the Moolah app for iPhone. For anything on this page, including a request to see, correct or delete your data, write to support@moolahbudget.com.

What Moolah stores

• Your account. Your name, your email address, and your password. The password is stored only as a bcrypt hash — the password itself is never written down, which is also why a forgotten one has to be reset rather than looked up.
• Your budget. Categories, transactions, amounts, dates, descriptions, memos, bills, paychecks, debts and goals. This is financial information about you. It is there because a budget cannot work without it, and it is visible to you and to anyone you share the budget with.
• People you invite. When you share a budget, the email address you invite is stored so the invitation can be sent and accepted. Unaccepted invitations expire.
• Bank connections, if you set one up. The credential your provider issues, encrypted with AES-256-GCM, and the transactions it returns. The credential is never sent to a browser or an app; see below for what Moolah does and does not see.
• App tokens. When you sign in on the iPhone app, it is issued a token. Only a SHA-256 hash of that token is stored, so the value cannot be read back out of the database — which is why it is shown once and never again. You can revoke any token from Settings on the web.
• Course progress, if you enrol. Which lessons have opened, which commitments you marked done, and anything you wrote in a weekly reflection. Reflections are yours alone: someone you share the budget with cannot read them.
• A short security record. Failed sign-in attempts are counted against the email address and the IP address they came from, and are discarded after about fifteen minutes. Requests to the app API are counted against the token or address that made them and discarded after about an hour. Both exist to stop password guessing and runaway clients, and neither is used for anything else.

Cookies

Moolah sets a cookie when you sign in, so that the next page knows it is still you, and one more to protect the sign-in form itself. That is all. There are no advertising or analytics cookies, which is why Moolah has no cookie banner: there is nothing to consent to.

Who else can see it

Running a web app means other companies hold the data on Moolah's behalf. Each is used for one job, and none of them is given your data for their own purposes:

• Vercel hosts the site and runs its code.
• Neon holds the database, in the United States.
• Resend sends password reset and budget invitation emails, and so receives the recipient's address and the message.
• SimpleFIN Bridge and Plaid, only if you connect a bank. Each has its own privacy policy and its own relationship with you.
• Apple, if you use Siri with the iPhone app. What you say to Siri is handled by Apple under Apple's privacy policy before it ever reaches Moolah.

Data may also be disclosed if the law requires it. Nothing else leaves.

Bank connections

Moolah never sees your online banking username or password. You subscribe to SimpleFIN Bridge yourself, connect your bank there, and hand Moolah a one-time setup token; Plaid works through its own sign-in window. What Moolah holds is the access credential the provider issues, encrypted at rest, and it is deliberately impossible to read from the browser or the app.

Imported transactions are held in a review queue and do not touch your balances until you file them. Disconnecting a bank tells the provider to release the connection as well as deleting it here.

Sharing a budget

A budget you share is a budget the other person can see: its transactions, its categories and its balances. That is the point of sharing, and it is worth being clear that it cannot be partial. What is never shared is your password, your bank credential, or your course reflections.

How long it is kept

Your account and your budget are kept until you delete them. When you delete your account, everything it owns is deleted with it — your budgets and every transaction in them, your access to budgets other people own, your app tokens and your bank connections. It is immediate and it cannot be undone, which is why the app asks for your password first and names what will be lost.

Deleting a budget you own also deletes it for anyone you shared it with. Budgets other people own stay with them; only your access goes.

The database provider keeps short-lived backups for recovery, so a deleted record may persist in those for a limited period before it ages out.

Your choices

• See and change it. Everything Moolah holds about your budget is on screen in the app, and editable there.
• Delete it. Settings → Delete account, on the web or in the iPhone app.
• Cut off a device. Settings → App access, on the web, revokes any token — useful if you lose a phone, since a phone you no longer have cannot sign itself out.
• Take a copy. Settings → Your data, on the web, downloads everything in your account as a file you can keep or take to another service, and your transactions as a spreadsheet. Your password and bank credentials are never included.

Depending on where you live you may have legal rights to access, correct, delete or port your data, or to object to its use. Moolah honours those requests from anyone who asks, wherever they live.

Where it is held

Moolah's servers and database are in the United States. If you use Moolah from elsewhere, your data is transferred to and stored there.

Security

Traffic is encrypted in transit. Passwords are bcrypt hashed, app tokens are stored only as hashes, and bank credentials are encrypted with AES-256-GCM. Repeated failed sign-ins are locked out, and the app API is rate limited. No service can promise it will never be breached, and this one does not; what it can say is that the things worth stealing are not stored in a form that can simply be read.

Children

Moolah is not intended for children under 13, and accounts are not knowingly created for them. If you believe a child has an account here, write to support@moolahbudget.com and it will be removed.

Changes to this policy

If this policy changes, the date at the top changes with it. Anything that materially affects what happens to data already collected will be said plainly here rather than slipped in.