Privacy

On the free plan, nothing. The app is static files; your budget lives in your browser's local storage and in any file you link. No request carries it anywhere.

On a paid plan we hold an account record — an email address, a plan, a billing customer id — and an encrypted blob per budget. The key for that blob is derived on your device and never sent to us, so the blob is not readable by us or by anyone who takes it from us.

Aggregate page views on the marketing pages, without cookies and without a profile. Nothing inside the app is instrumented: we do not know how many groups you have, what they are called or what they cost.

Error reports from the app carry a stack trace and a browser version. They are scrubbed of budget values before they are sent, and they are sent only if you opt in.

A payment processor, for paid plans, which holds the card details we deliberately never see. A mail provider, to send the handful of transactional emails an account requires. A host, which serves static files and stores encrypted blobs.

No advertising networks, no data brokers, no analytics vendor with access to your numbers.

Export the whole budget at any time, in the format the app reads. Delete an account from the account page; the record and every blob attached to it are removed within thirty days, and the copy on your device is untouched.

Write to privacy@whatisthebudget.app with any request about your data, and you will get an answer from a person.