Privacy Policy

This Privacy Policy explains how Money Manager ("we", "us") collects, uses and shares information when you use the Money Manager website, web app, and the Money Manager apps for iPhone and Android (together, the "Service"). It applies to visitors of the marketing site and to people with a Money Manager account.

Money Manager is a budgeting tool. It is not a bank, a payment service or a financial advisor, and it never holds or moves your money.

Account information. When you sign in with Google or Apple we receive your name, email address, a profile image URL and a provider user ID. Apple may give us a private relay email instead of your real one. We do not receive or store a password.

Financial records you enter. Transactions, amounts, categories, accounts, budgets, bills, notes, receipt photos and shared-account memberships. This is the data the Service exists to manage, and it is the most sensitive data we hold.

Bank data through Plaid. If you link a bank account, Plaid sends us account names, account types, masked account numbers, balances and transactions. We receive a read-only access token. We never receive your bank username or password.

Statements and receipts you upload. PDF and CSV statements and receipt images are processed to extract transactions. The extracted transactions are stored in your account. Statement files are deleted after processing; receipt images are kept with their transaction until you delete it.

Device and usage information. Device type, operating system, app version, browser, language, approximate location derived from IP address, crash reports, and events such as which screens you open. We use PostHog for product analytics and Google Analytics on the marketing site.

Billing information. If you buy Premium on the web, Stripe processes your payment. We receive your subscription status, plan, the last four digits of your card and the card brand. We never see or store the full card number. Purchases in the App Store or Google Play are processed by Apple or Google under their terms.

Support messages. Anything you send to our support address, including attachments.

• To run the Service: store your records, sync them between your devices, calculate budgets and reports, send bill reminders you have turned on.
• To provide Premium features you have asked for: bank sync, receipt scanning, statement import, savings insights and the AI assistant.
• To keep the Service secure: detect abuse, prevent fraud, and protect accounts.
• To improve the Service: understand which features are used, find crashes, and test changes.
• To communicate with you: respond to support requests, send transactional email such as billing receipts, and, if you opt in, product updates. You can unsubscribe from marketing email at any time.
• To comply with law, enforce our Terms, and protect our rights and the rights of others.

We do not use your financial records to build advertising profiles, and we do not sell personal information as defined under California law.

Receipt scanning sends the receipt image to our server, where it is processed by a model to extract the merchant, date, items and total. The image is not used to train models and is not shared with advertisers.

The AI assistant converts your question into a database query using the structure of your data (table and column names), runs that query on your own device against your local copy of your records, and then sends only the small result set to be turned into a readable sentence. Your complete transaction history is not uploaded to answer a question.

Insight cards such as week-over-week change or unused subscriptions are computed from your synced records on our servers so they can be delivered to every device.

We share personal information only with service providers that help us run the Service, under contracts that limit how they can use it:

• Plaid Inc. for bank connections. Plaid's handling of your data is described in the Plaid End User Privacy Policy, which you accept when you link a bank.
• Google and Apple for sign-in. We receive the profile fields listed above and nothing else from your Google or Apple account.
• Stripe for web billing. Stripe is the merchant of record for card processing and is subject to PCI DSS.
• PostHog for product analytics and Google Analytics for marketing-site analytics.
• Cloud hosting providers in the United States that store and serve the Service.
• Email delivery providers for transactional email.

We may also disclose information if required by law, subpoena or court order, to protect the safety of any person, to investigate fraud, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to the transferred data until it is replaced.

Shared accounts. If you join a shared account, the other members can see the transactions, splits and member names in that account. They cannot see your personal accounts.

The web app uses a strictly necessary session cookie to keep you signed in. It is HTTP-only and cannot be read by page scripts. The marketing site uses analytics cookies from PostHog and Google Analytics to understand traffic. Analytics on the web app is limited to PostHog. We do not use third-party advertising cookies on the web.

Most browsers let you block or delete cookies. Blocking the session cookie will sign you out of the web app.

• Account and financial records: for as long as your account exists. Delete individual records at any time, or delete everything from Settings.
• Bank access tokens: until you disconnect the bank or delete your account, at which point the token is revoked with Plaid.
• Uploaded statement files: deleted after processing, normally within 24 hours.
• Receipt images: kept with their transaction until the transaction or the account is deleted.
• Analytics events: up to 24 months, then aggregated or deleted.
• Billing records: as long as required by tax and accounting law, typically seven years.
• Support email: up to three years after the thread is closed.

Backups are rotated on a fixed schedule, so deleted data may persist in encrypted backups for up to 30 days before it is overwritten.

All traffic between your device and our servers is encrypted with TLS. Bank connections are read-only. Sessions use secure, HTTP-only cookies. Access to production systems is limited to staff who need it and is logged. Payment card data is handled entirely by Stripe, Apple or Google.

No system is perfectly secure. If we learn of a breach that affects your personal information, we will notify you and the relevant authorities as the law requires.

Everyone: you can export your transactions as CSV, Excel or PDF from Settings, correct any record, disconnect a bank, delete individual records, delete all of your data, or delete your account by writing to us. You can opt out of marketing email with the unsubscribe link, and you can turn notifications off in Settings or your device settings.

California residents (CCPA and CPRA): you have the right to know what personal information we collect, use and disclose; to request deletion; to request correction; to opt out of the sale or sharing of personal information; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. We do not sell personal information and do not share it for cross-context behavioral advertising. We use sensitive personal information (financial records) only to provide the Service you asked for. To exercise any right, email us at the address below. We will verify your request by matching it to the email on your account and respond within 45 days. You may designate an authorized agent to act for you.

Residents of other US states with privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas and Oregon): you have similar rights of access, correction, deletion, portability and opt-out. Use the same contact to exercise them, and to appeal a decision.

Residents of the European Economic Area, United Kingdom and Switzerland: our legal bases are performance of our contract with you, our legitimate interests in running and securing the Service, your consent for optional analytics and marketing, and legal obligations. You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with your supervisory authority. Data is processed in the United States under standard contractual clauses.

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we will delete it. Users between 13 and 18 should use the Service with a parent or guardian's permission.

We are based in the United States and our servers are in the United States. If you use the Service from elsewhere, your information is transferred to and processed in the United States, which may have different data protection laws from your country.

We may update this policy as the Service and the law change. The effective date at the top always shows the current version. For material changes we will notify you in the app or by email before they take effect. Continuing to use the Service after that date means you accept the updated policy.

Questions, requests and complaints: support@themmanager.com. Please include the email address on your account so we can verify the request.