Privacy
What leaves your device, what we keep, and how to make us delete it.
Last updated 24 August 2026.
The short version: your money stays on your device, and the most we ever hold about you is an email address and whether you have paid.
What never leaves your device
Everything in the planner. Balances, income, bills, debts, cards, goals, imported statements, the projections themselves. These live in your browser's storage and are never uploaded, not in a backup, not in an error report, not in support. We could not hand them over if we were asked to, which is the point.
A statement file you import is read in the browser and never sent anywhere.
What we keep, in full
| What | Why | For how long |
|---|---|---|
| Your email address | To sign you in and to email receipts and service notices | Until you ask us to delete the account |
| Sign-in codes | Kept hashed, so a leak of them cannot sign anyone in | Minutes — they expire and are deleted |
| A Stripe customer identifier | To match a payment to an account | Until you ask us to delete the account |
| Subscription status, plan and paid-through date | To decide whether the app is unlocked | Until you ask us to delete the account |
| The day your trial started | So one trial is one trial | Until you ask us to delete the account |
| Whether a welcome email was sent | So it is sent once and not twice | Until you ask us to delete the account |
| Whether each trial reminder was sent | So a trial ending is mentioned once, not every few hours | Until you ask us to delete the account |
That is the whole list of what we hold about you. There is no name field, no password, no address and no card number, because those columns do not exist in the database.
What we count
We do keep counts. Not of you — of things. One row per day per event: "on 3 September, eleven people opened the app". A row holds a date, a name from a fixed list, and a number, and that is the entire table.
There is no account id on it, no session, no address, no IP, no browser or device, and no ordering between one event and the next. Nothing about a count can be narrowed to a person, and there is nothing in the database it could be joined to that would narrow it. We can tell that eleven people opened the app; we cannot tell which eleven, and neither can anybody who takes the database.
What is counted: pages viewed on the marketing site and the guides, the app being opened, the sign-in screen being reached, a code being asked for, a sign-in, a trial starting, a planner reaching the point of forecasting, checkout being opened, a subscription starting, a switch to yearly, a cancellation, an account deletion, and a crash. Nothing else, because the server refuses any name that is not on that list.
It exists to answer two questions — whether the guides bring anybody, and where people give up — and it is built this way because the alternative is the ordinary kind of analytics, which answers the same questions by following people around. No third party sees any of it; the counts are in our own database and go nowhere else.
When the app crashes
If the app hits an error, the error message and the top few lines of where it happened in the code are sent to us and written to our deploy log, so a fault that only happens on somebody else's device is not invisible. The count of crashes is kept; the message is not stored in the database.
Nothing from your planner is in that report — not a balance, not a payee, not a figure. There is no code path that could reach it. The message is also run through the same redaction used on bank statements before it is sent, because a stack trace is written by whoever wrote the error and one day somebody will put a value in one.
Cookies
One, set when you sign in. It holds a signed reference to your account and nothing else, and it is what keeps you signed in between visits. There is no advertising cookie and no analytics cookie — the counts above need neither, which is why there is no consent banner to click past.
The app also uses your browser's own storage for the planner itself, and for one marker per counted milestone so a thing that happens once is counted once. None of that is sent anywhere.
Who else touches it
- Stripe — takes payments and holds your card details. We never see the card. Stripe has its own privacy policy and is the party that keeps your payment information.
- Resend — delivers sign-in codes and receipts, and therefore handles your email address.
- Railway — hosts the server and the database the table above lives in.
- Google Fonts — the site loads two typefaces from Google, which means Google sees the request and your IP address. The page is designed to be perfectly readable if that request never completes.
There is nobody else. We do not sell anything to anyone, and we have never shared this data for advertising, because there is not enough of it to be worth anything to an advertiser.
Deleting it
There is a button. Open the app, go to the plan screen, and delete your account there — it removes the address, the subscription record and the trial date in one go, and it does not wait on anybody answering an email.
If you cannot reach the app, email [email protected] from the address you signed up with and we will do it by hand. Stripe keeps its own record of payments for as long as tax law requires, which is not ours to overrule.
Deleting the account does not delete your figures, because we never had them. The planner on your device is untouched either way — which is worth saying plainly, since "delete my account" reasonably sounds like it would take the budget with it.
If you are subscribed, deleting stops the billing immediately rather than at the end of the period, because afterwards there is nothing left to stop it with. The rest of that period is not refunded, and the licence on your device keeps the app open until it runs out.
Your rights
Wherever you are, you can ask what we hold, ask for a copy, ask us to correct it, and ask us to delete it. Given the table above, the answer to the first two is usually one line long. We do not charge for any of this and we do not ask why.
Children
The app is not intended for under-16s and we do not knowingly keep accounts for them.
If this changes
If we ever add anything that could identify a person from how they use the app — a third-party analytics service, a session recorder, a cookie that follows anyone — this page changes first and account holders are emailed. As of 24 August 2026 there is none of it, and the counting described above is deliberately built so that it never becomes any of it.