Money Manager

Privacy notice

Last updated 23 August 2026.

This describes what Money Manager stores, what it deliberately cannot see, and who else is involved. It is written to be read rather than to be defensible, and every claim in it corresponds to something in the code rather than to an intention.

What we store

  • Your account: email address, display name, a hash of your password (never the password), your language, and when you last signed in.
  • Your household's financial records: the accounts, transactions, categories, rules, budgets and savings goals you create or import.
  • Bank connection details: which bank, when consent expires, and the identifiers needed to fetch transactions. If you supply your own open banking key it is encrypted before storage with a key held outside the database.
  • Billing: your Stripe customer identifier and the state of your subscription. Not your card — see below.

What we never see

  • Your statement files. A PDF or CSV you import is parsed in your browser. Only the resulting transactions are sent to us. The file itself never leaves your device.
  • Your card details. Payment happens entirely on Stripe's own pages. We receive a customer identifier and a subscription status, and nothing that could be used to charge you.
  • Your banking password. You authorise a bank connection on your own bank's website. We never receive the credentials you type there.
  • Your two-factor secret, in usable form. It is encrypted with a key held outside the database.

How households are kept apart

Every table holding household data has row-level security enabled and forced in Postgres, and the application connects with a database role that is not permitted to bypass it. The server checks both of these at start-up and refuses to run if either is untrue. That means isolation does not depend on every query remembering to filter — it is enforced underneath them.

The administration screen used to operate the service shows how many transactions, accounts and people a household holds. It has no means of showing what those transactions are.

Advertising on the free plan

The free plan carries advertising. Advert slots are given nothing about you or your household: no amounts, no payees, no category, not even a household identifier. Where a third-party network is used, its script is loaded only for households on the free plan, and never on a page while it is being set up.

Who else is involved

  • Stripe — payments and subscription management. Stripe receives your email address and whatever billing details you give it directly.
  • Enable Banking — the regulated intermediary for bank connections, where you use one.
  • Resend — sends the emails that confirm your address and reset your password.
  • Cloudflare — carries traffic to the service and shields it from abuse.
  • A language-model provider — only for transactions your own rules and history could not categorise, and only if your household has automatic categorisation switched on. What is sent is the transaction's description, amount, currency, date and account type. Never your name, your account numbers, your balances, or anything identifying you.

The service and its database run on a server in Germany. Backups are stored encrypted, in Finland.

How long we keep it

Your records stay until you delete them or close your account. Deleting your account removes your households' data. Encrypted backups are kept for a rolling period and then expire, so a deletion takes effect in the backups within that window rather than instantly.

Your rights

Under the GDPR you can ask for a copy of your data, ask for it to be corrected or deleted, object to processing, or take your data elsewhere. Export is built in and available on every plan without asking anybody: everything you hold can be downloaded as CSV. For anything else, write to privacy@money-manager.app.

You can also complain to your national data protection authority. In Hungary that is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH).

Cookies

One cookie, for your session, so that you stay signed in. It is httpOnly, sent only to this site, and there is no advertising or analytics cookie set by us. Nothing here needs a consent banner because nothing here tracks you.

Changes

If this notice changes in a way that affects you, we will say so by email before it takes effect rather than quietly changing the date at the top.