MoneyBeh

Privacy Policy

Version 1.3 · Effective 7 September 2026 · Last updated 7 September 2026

MoneyBeh holds your bank balances, your transactions, your income, and your notes about the life you want. That is a heavy thing to be trusted with. This page tells you exactly what we hold, why we hold it, who else sees it, and how to make all of it disappear.

1. Who we are

MoneyBeh is an iOS application for planning a life you can afford to live. This policy covers the MoneyBeh app and the moneybeh.com website. In data-protection terms, MoneyBeh is the controller of the personal data described here.

2. What we collect

Information you give us

• Account details. Your email address and a password. Passwords are hashed by our authentication provider and are never stored or seen in readable form. If you use Sign in with Apple instead, we receive only the identifier Apple issues us.
• What you plan and value. Your goals, the things you have decided matter, your reflections, your assumptions about the future, and how you have chosen to categorize your own spending. This is the substance of the product, and it is yours.
• Your email address, if you ask for the blog and the podcast. The sign-up on our home page is for our writing and our show. It is not a sign-up for the app, and giving us your address here creates no account and connects to nothing financial. We keep the address and the date you gave it, and nothing else — we do not ask for your name.

Information from your bank, through Plaid

When you connect an institution, you do it inside Plaid Link. Your bank username and password go to Plaid and your bank — they never pass through MoneyBeh, and we never see them. Plaid then gives us:

• Account names, types, institutions, and balances.
• Transactions: date, amount, merchant name, whether it is still pending, and Plaid's own spending category.
• Investment holdings and investment transactions, where the account has them.

We deliberately keep less than Plaid offers. Before a transaction is ever stored, we reduce it to the handful of fields the app actually uses and discard the rest — including location data, payment metadata, and counterparty details. We do not store them and then ignore them; we never keep them at all.

If you instead connect an account through SimpleFIN, an alternative service we support, the same applies with SimpleFIN in Plaid's place.

Information from optional features

These are off unless you turn them on, and each can be disconnected at any time.

• Pay stubs. If you upload a pay stub so the app can read it for you, the file is sent to Google's Gemini API to extract the figures — employer, pay period, gross, net, and the deduction lines. See §4, because this matters.
• Gmail. If you connect a mailbox, we request read-only access and use it only to find order and shipment emails so a charge can be matched to what you actually bought. We do not store your email. Messages are read in the moment, the useful details are extracted, and the message itself is never saved. We cannot send mail as you, and we cannot change anything in your mailbox.
• File imports. If you import a spending history file, we keep the rows you chose to import.

Information we collect automatically

Very little, and this is deliberate. We keep operational logs to know whether the service is working — status codes, error types, and counts. Our logs never contain dollar amounts, transaction details, access tokens, or personal information; that is a rule enforced in our code review, not a preference.

3. Why we collect it

Where the basis is consent, you can withdraw it at any time by disconnecting the feature or deleting your account. That does not undo processing that already happened, but it stops it.

4. Who else sees your data

We do not sell your data and we do not share it for advertising. We do rely on a small number of companies to run the service, and you are entitled to know exactly who they are and what each one receives.

We may also disclose data if the law requires it, to protect someone's safety, or as part of a business transfer — in which case this policy travels with the data.

5. What we never do

• We never move your money. Our access to your accounts is read-only. The app cannot make a payment, a transfer, or a trade, and cannot change anything at your bank. This is enforced by the permissions we request, not by our restraint.
• We never sell your data, and we never share it for advertising.
• We run no trackers. No analytics companies, no ad networks, no advertising identifiers, no location collection, no behavioral profiling.
• We never pool your data with anyone else's. Your reflections are used to serve you, and are never analyzed across users.

6. How it is protected

• In transit, everything uses TLS 1.2 or better. The app declares no exceptions, so your phone enforces this on every connection it makes.
• At rest, our database and its backups are encrypted with AES-256.
• The keys to your bank connection never touch our servers. The token that lets us read your accounts is stored only in your iPhone's Keychain, protected by the Secure Enclave, and marked so it cannot travel to another device through an iCloud backup. It is not in our database, not in our logs, and not anywhere we could lose it.
• Your data is walled off in the database itself, not just in the app. Access rules live in the database, so even a bug in the app cannot show your household's data to someone else.
• You can lock the app itself with Face ID or Touch ID, so a phone someone else is holding does not show your finances. Your biometrics never leave your device.

No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your data, we will tell you what happened, what was involved, and what to do — without delay and without euphemism.

7. How long we keep it

While your account is open, we keep your financial history for as long as you want it kept. That is the point of the product: a plan built on years of history is worth more than one built on a month. We do not quietly age it out.

When you delete your account, everything goes immediately (§8). Copies can persist briefly in encrypted backups and operational logs, and age out with them. We do not keep a copy for our own purposes afterward, and there is no legal requirement that makes us hold anything back.

8. Deleting your data

Open the app and go to Settings → Account. Deletion is immediate, irreversible, and requires no email to us, no support ticket, and no waiting period. In one action:

• Every bank connection is revoked at Plaid, so our access to your institutions ends.
• Every record tied to you is deleted from the database.
• Your sign-in identity is removed.
• The tokens held on your phone are cleared.

If you share a household with someone, deleting your account removes you and your personal records; the shared household's data stays with the person still using it. If you are the last person in the household, the household and everything in it goes too.

The blog and podcast list is separate from your account. Every email we send carries an unsubscribe link, and using it removes your address. You can also email us and we will remove it. Because we do not send a confirmation email yet, an address is added the moment you submit the form — so if someone types your address by mistake, one click of unsubscribe undoes it.

9. Your rights

Depending on where you live — including under the GDPR and UK GDPR, and under California law — you have the right to access your data, correct it, delete it, object to or restrict how it is used, receive a portable copy, and withdraw consent.

Deletion you can exercise yourself, instantly, in the app. For anything else, email us and we will respond within 30 days. Data portability is a permanent commitment of ours: ask and we will send you your data. We will never charge you, and we will never make you justify the request.

California. We do not sell or share personal information as those terms are defined by the CCPA, and we will never treat you differently for exercising a right.

If you are in the UK or EU and think we have handled your data badly, you may complain to your supervisory authority. We would rather you told us first.

10. Households and shared data

MoneyBeh is built for a household, so a plan can be made by the people actually living it. If you invite someone into your household, they can see the household's shared financial picture. Personal spending you mark as private is governed by settings only you can change — not by the app's interface alone, but by the database itself.

Only invite someone you intend to share your finances with. Leaving a household stops future sharing; it does not retroactively unsee what was already visible.

11. Children

MoneyBeh is not for children and we do not knowingly collect data from anyone under 13. If a child has given us data, contact us and we will delete it. Where you record savings goals for your own children, that information is yours — we treat it as your data, not theirs, and it goes when you delete your account.

12. Changes to this policy

If we change this policy materially — a new company receiving your data, a new category of information collected — we will tell you in the app before the change takes effect, not after. The version and date at the top of this page always reflect what is currently true.

13. Contact

Questions, requests, or a security issue you want to report: reach us through the support contact listed on the MoneyBeh App Store page, or reply to any email you have received from us. We read everything.