Privacy Policy

1. What we collect

To provide the app, we collect and store:

• Account information — name, email address, and a hashed password (or passkey/social sign-in credential).
• Transaction data — amount, date, merchant, masked account reference, category, note, and split details, whether entered manually or extracted from a connected mailbox.
• People & loan records — names and balances for people you split expenses with or record informal loans against.
• Integration credentials — OAuth tokens for any Gmail mailbox, Splitwise account, or MCP client you connect.
• Device & session data — active sessions, device identifiers for those sessions, IP address and timestamp at login, so you can review and revoke access.

We do not collect data you don't give us or explicitly connect — there is no background contact-list, location, or ad-identifier collection.

2. Gmail data & the gmail.readonly scope

If you choose to connect a Gmail mailbox, Money Manager requests only Google's gmail.readonly scope, which is read-only. We use it to watch for bank-alert style emails and extract four things from a matched alert: the amount, the date, the merchant name, and the last few digits of the account. We do not store full email message bodies as a matter of course; a raw reference to the source message is kept, field-level encrypted, solely so a mis-parsed alert can be reprocessed, and it is never used to read unrelated mail.

This use of Gmail data complies with the Google API Services User Data Policy, including the Limited Use requirements: we do not use Gmail data for advertising, we do not allow humans to read it except for abuse investigation, security incidents, or to comply with law, and we do not transfer it to any third party except as necessary to provide or improve the app's own features (e.g. pushing a categorized split to Splitwise, if you choose to). You can revoke Money Manager's access at any time from Settings → Integrations in the app, or directly from your Google Account's third-party access page.

3. How we use your data

We use the data above to:

• turn bank alerts and manual entries into a categorized transaction ledger, and compute your net worth, monthly trends and category breakdowns from it;
• track balances between you and the people you split expenses or record loans with;
• push a split expense to Splitwise, and respond to requests from an MCP client, only when you explicitly initiate either action;
• secure your account — fraud and abuse detection, rate limiting, and step-up re-authentication on sensitive actions; and
• operate the service itself — debugging, uptime, and responding to support requests you send us.

We do not use your financial data for advertising, and we do not build behavioral profiles for marketing.

4. Third parties — Google, Splitwise, MCP clients

We do not sell or rent your data. Data leaves our systems only in these cases, and only for the connections you set up:

• Google — to read bank-alert emails from a mailbox you connect, as described above.
• Splitwise — if you connect a Splitwise account and choose to push a split expense, that expense's details are sent to Splitwise under your own Splitwise credentials and their own privacy practices.
• MCP clients — an AI client you explicitly authorize (e.g. Claude) can read or write data within the scopes you grant it (for example, transactions:write), and only until you revoke the grant.
• Infrastructure providers — our hosting, database and key-management providers process data on our behalf, under contract, solely to run the service.

We may also disclose data if required by law, to protect the rights or safety of our users, or in connection with a merger or asset sale — in which case we would notify affected users first where legally possible.

5. Retention & encryption

The database is encrypted at rest. On top of that, the most sensitive fields — OAuth access/refresh tokens and raw email source references — get additional field-level envelope encryption, keyed by a KMS-managed key rather than a single static application secret. Account numbers are masked at the API layer before they ever reach the app, not only in the interface.

We retain your data for as long as your account is active. Deleting your account (see §6) removes your transactions, people/loan records, integration credentials and sessions; backups age out on our standard backup retention cycle.

6. Your rights — access, export, deletion

From Settings in the app, without contacting support, you can:

• Export your data — a copy of your transactions, people, loans and account data; and
• Delete your account — permanently removes your data from our systems, in line with App Store and Google Play in-app account-deletion requirements.

We aim to fulfil export and deletion requests, including any made by emailing us directly, within 30 days. Disconnecting an integration or deleting your account requires step-up re-authentication (your password or biometric) first, to prevent someone else from doing it on your behalf.

7. Security practices

Money Manager handles real financial data, so:

• Passwords are hashed with argon2id and never stored or logged in plaintext; new passwords are checked against breached-password lists via k-anonymity, without your full password ever leaving your device.
• Sessions use short-lived access tokens with refresh-token rotation and reuse detection — a stolen, already-used refresh token revokes the entire session family.
• Tokens live in the app's platform Keychain/Keystore, never in plain local storage.
• TOTP two-factor authentication, passkeys, and single-use backup codes are available to every account.
• Step-up re-authentication is required for connecting/disconnecting integrations, revoking sessions, changing email/password, and deleting the account.
• Login failures return a generic error and are rate-limited, to prevent account enumeration and brute-force attempts.

No method of storage or transmission is 100% secure, but this is the standard we hold ourselves to; if you believe you've found a vulnerability, please report it to the contact below.

8. Children's privacy

Money Manager is a personal-finance tool intended for adults managing their own money, and is not directed at children under 13 (or the relevant age of digital consent in your country). We do not knowingly collect data from children; if we learn we have, we will delete it.

9. Changes to this policy

If this policy changes, we'll update the "Last updated" date at the top of this page and, for material changes, note it in the app and record the new policy version and acceptance timestamp against your account. Continued use of the app after a change constitutes acceptance of the revised policy.

10. Contact

Questions about this policy, or requests to access, export or delete your data, can be sent to shreyansh@shrynshjn.com.