Privacy policy

MosyMoney is a budgeting app for couples. To do its job it has to see your transactions, so this page is written plainly: what we collect, what we do with it, who touches it on our behalf, and how to make it go away.

The short version

  • We never see your bank login. Bank connections run through Quiltt; your credentials go to Quiltt and your bank, not to us.
  • We don’t sell your data, show ads, or use advertising trackers. This marketing site uses Google Analytics to count visits, and the app uses PostHog to see which setup steps people finish — never your name, email, or any financial data.
  • You can delete your account yourself from Settings, and download your transactions there too. Deletion removes your data, your bank connections at Quiltt, your billing record at Stripe, and your login. The few things that outlast it are listed under “Deleting your account.”
  • Your partner sees what you share — the transactions you mark as split or theirs, and the running balance between you — never your account numbers or interest rates.

What we collect

Your account

Your name and email address, and a password if you choose one. Passwords are handled by Amazon Cognito, our sign-in provider; we never receive or store them. If you turn on two-factor authentication, Cognito stores the authenticator secret.

If you sign in with Google, Google sends us a signed identity token. From it we keep your name, email address, Google account id, profile picture, and language preference, which we use to create or match your MosyMoney account, show your name and avatar in the app, and remember your locale. We request only basic profile and email scopes — nothing from Gmail, Drive, Calendar, or Contacts. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Your Google name, email, account id, profile picture, and language preference are stored in Amazon Cognito and in our database, are shared only with the processors listed below, and are deleted with your account. You can also revoke MosyMoney’s access at any time from your Google account permissions. When a Google sign-in matches an existing MosyMoney account by verified email, we link the two and email you about it, so a link you didn’t make is visible rather than silent.

When you create your account, and again whenever this policy or the Terms of Use change materially, we ask you to agree to them and record which document you agreed to, its version (the effective date at the top of the page), and the time you agreed. We keep that record for as long as your account exists and delete it with your account.

Your financial data

To connect a bank we first create a profile for you at Quiltt, our aggregation provider, using your name and email address. Quiltt (which in turn uses providers such as Finicity and MX) then retrieves and sends us: the institution name, each account’s name, type, last four digits, and balance, an interest rate where the bank provides one or you enter it, and your transactions — date, amount, merchant or description, pending status, and the category the bank or aggregator assigned. We refresh this while your connection is active and store balance snapshots so you can see history.

Everything you add on top is also stored: income and savings targets, categories, tags, notes, splits, recurring bills, who paid what, and settlements with your partner.

Shared spaces

Inviting a partner stores their email address and sends them an invite. Once you share a space, your partner can see your name and avatar, the transactions you mark as split or theirs — including the institution and account name, category, and any notes on those rows — the recurring bills you share, and the balance between you. Account numbers, last-four masks, and interest rates on your accounts are hidden from them.

Billing

Subscriptions are processed by Stripe. Card numbers go directly to Stripe and never reach our servers. We store your plan, subscription status, and trial dates.

Public forms and support

The contact form stores the name, email, and message you submit; the waitlist form stores your email. Each submission also records your IP address and browser user agent purely for rate limiting; we scrub those after 30 days. Both forms are protected by Cloudflare Turnstile.

Technical data

Our servers keep short-lived request logs for security and debugging. We also record when you last used the app, as one timestamp on your account that’s updated at most every 15 minutes, so we can tell active accounts from dormant ones; it’s deleted with your account. The app keeps your sign-in tokens, Quiltt’s bank-connection session, and a few display preferences (like a collapsed section) in your browser’s local storage. Stripe sets its own fraud-prevention cookies on the checkout page. On this marketing site, Google Analytics sets its _ga cookies to tell returning visitors apart. The app sets no advertising or analytics cookies: PostHog runs in memory only and keeps nothing in your browser between visits.

How we use it

  • To run the product: your forecast, shared expenses, recurring bills, and calendar.
  • To categorize transactions and name recurring bills. We send Anthropic’s Claude API the merchant or description text as your bank renders it — for transactions our built-in rules can’t categorize, and for newly detected recurring bills together with the category we guessed. We never send amounts, dates, balances, account details, or your identity, though a bank description can occasionally include a payee’s name, as with a Zelle transfer. Anthropic keeps requests briefly under its API data-retention policy and does not train on them.
  • To email you about your account: sign-up and password-reset codes, partner invites, a Google sign-in being linked, a waitlist confirmation, and trial or renewal notices. These go through Amazon SES or Amazon Cognito. We don’t send marketing email.
  • To keep the service secure, prevent abuse, and answer support requests.

We don’t use your financial data to market anything to you. We may one day add an optional feature that points out ways you could save money, such as a lower mortgage rate or a better credit card, based on your connected accounts. It would stay off unless you turn it on, and we would update this policy before it launched. The Terms of Use describe it under “Personalized offers.”

We run Google Analytics on this marketing site: which pages are viewed, roughly where visitors come from, and whether the waitlist or contact form was submitted — never the email or message you typed. Google truncates IP addresses before storing them, and we haven’t enabled advertising features or Google Signals. Inside the app we use PostHog for product analytics: which screens you open and which setup steps you complete (connecting a bank, reviewing detected bills, inviting a partner, subscribing), recorded against an internal user id together with whether you signed up with Google or a password, whether setup is finished, and whether you have a partner. We never send your name, email, transactions, balances, merchant names, or the actual page address — only the screen’s name — and we don’t use session recording. We may occasionally ask for feedback in a short in-app survey; those are optional, and whatever you write in one is sent to PostHog along with the fact that you answered. Please don’t put account numbers or other sensitive details in a survey answer — use the contact form if you need to share something like that. PostHog does receive your IP address, which it uses to derive an approximate location (country and region) and then discards; it isn’t stored.

Who processes it for us

We run on a small set of providers, each under its own privacy terms, and share with them only what their job requires:

  • Quiltt — bank connections and transaction data; receives your name and email to create your profile.
  • Amazon Web Services — sign-in (Cognito) and email (SES), in the United States.
  • DigitalOcean — hosts our API and encrypted database, in the United States.
  • Cloudflare — serves this site and the app, and runs Turnstile on our public forms.
  • Stripe — payments and subscription billing.
  • Anthropic — merchant-name categorization, as described above.
  • Google — Google Analytics on this marketing site, Google sign-in if you choose it, and our support email (Google Workspace), which receives contact-form messages and anything you email us.
  • PostHog — product analytics inside the app, in the United States.

We don’t sell or rent personal data, and we don’t share it with anyone else except when the law requires it or to protect the service and its users.

How long we keep it

  • Account and financial data stay while your account exists. Deleting your account removes them.
  • Contact submissions are deleted after 12 months. Waitlist emails are kept until we’ve invited you in or you ask us to remove them. IP and browser details on both are scrubbed after 30 days.
  • Our support inbox also receives a copy of each contact-form message, along with any email you send us. Those stay until we delete them, and we’ll delete yours if you ask.
  • Webhook event logs from Quiltt and Stripe are deleted after 90 days. That includes the last Stripe event, sent when deleting your account cancels your subscription.
  • Server logs, which can include your email address, are kept only briefly by our hosting provider.
  • Product analytics in PostHog, including any survey answers, stay after you delete your account, as “Deleting your account” describes.
  • Notes on complimentary access codes may name who a code was for. They’re kept until we delete the code.
  • Database backups are encrypted and roll off on our hosting provider’s short retention schedule.

Deleting your account

Settings → Delete account removes your transactions, accounts, and settings and the record of what you agreed to, deletes your bank connections and profile at Quiltt, cancels your subscription and deletes your customer record at Stripe (Stripe keeps the payment records it is legally required to keep; there is no automatic refund), deletes your sign-in at Cognito, and removes any invites, waitlist entries, and stored contact-form messages tied to your email. If one of those external steps fails, we finish it by hand.

Some things outlast your account. Your product-analytics history stays in PostHog: the screens and setup steps recorded against your internal user id, never your name or email. Once your account is deleted and our backups and logs roll off, nothing in our own systems links that id to you, though the payment records Stripe keeps still carry it if you ever started a subscription. Any survey answers you wrote stay with it; if you want them deleted, ask us before you delete your account, while we can still find them. Copies in our support inbox, server logs, webhook logs, database backups, and any note on a complimentary access code last as long as “How long we keep it” says.

If you shared a space, your partner keeps their own data and the space continues without you, but the transactions you shared and any settlements you recorded are removed from it. Settlements your partner recorded stay in their history, including the totals worked out from your shared spending and any note on them.

Security

Data is encrypted in transit and at rest. Sign-in is handled by Amazon Cognito with optional two-factor authentication. Bank credentials never touch our systems. Sensitive server credentials are stored as secrets, never in code.

Your rights

You can view and edit your data in the app, download your transactions from Settings → Export my data, and delete it yourself at any time. Depending on where you live you may have further rights — to access, correct, export, or restrict how we use your data, including a full copy of everything we hold about you. To exercise any of them, or to ask a question, contact us and we’ll respond within 30 days.

Children

MosyMoney is for adults managing household money. It isn’t directed at anyone under 18, and we don’t knowingly collect data from them.

Changes

When this policy changes in substance we’ll post the new version here with a new effective date and, for material changes, email account holders. After a material change takes effect, the app asks you to agree to the new version before you continue.