Privacy Policy

Introduction

This Privacy Policy explains how Daily Budget ("we," "us," or "our") collects, uses, shares, and protects personal information when you use our mobile applications and website (the "Service").

Daily Budget is a personal budgeting tool. Because it handles financial information, we treat that information with heightened care. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

The Service is intended only for individuals 18 years of age or older located in the United States.

Information We Collect

Information You Provide

• Account information — your name, email address, and password, which is stored only as a salted hash.
• Profile photo — if you choose to add one. The image you pick is resized on your device and stored in our hosting provider's file storage, and the other members of your household can see it. You can remove it at any time, which deletes the stored file.
• Profile settings — currency, pay cycle, notification and display preferences.
• Financial information you enter — transactions, amounts, dates, merchants, categories, notes, budget targets, income, account nicknames, balances, and savings goals.
• Support communications — messages, attachments, and other content you send us.
• Optional information — anything else you choose to add to a record or a note.

Financial Account Information (When You Link an Account)

If you choose to connect a bank, credit card, or other financial account, our third-party data-aggregation provider (an "Aggregation Provider," such as Plaid Inc.) retrieves information on your behalf, which may include:

• account type, name, masked account number, and institution name;
• current and available balances;
• transaction history, including amounts, dates, descriptions, and merchant information.

Your login credentials are entered directly with the Aggregation Provider, not with us. We do not receive, store, or have access to your online banking username or password. The Aggregation Provider's handling of your credentials and data is governed by its own privacy policy, which we link to in the connection flow and which we encourage you to read.

Connections are read-only. We cannot initiate payments, transfers, or any other transaction on your accounts.

Information Collected Automatically

• Device and technical data — device model, operating system and version, app version, language, time zone, mobile network, unique device or installation identifier, and IP address.
• Usage data — features used, screens viewed, actions taken, session timestamps and duration, crash and diagnostic logs, and performance metrics.
• Cookies and similar technologies on our website — see Section 6.

Information From Third Parties

• App stores — confirmation of purchase, subscription status, and renewal and cancellation events. Apple and Google do not give us your full payment card details.
• Payment processor — for direct web subscriptions, our processor handles your card data; we receive only a token, the last four digits, the card brand, the expiration, and the billing ZIP.
• Analytics and crash-reporting providers — aggregate and diagnostic data about how the Service performs.

What We Do Not Collect

We do not collect your Social Security number, government ID numbers, biometric identifiers, precise geolocation, or health information. We do not request access to your contacts, microphone, or camera. The mobile app asks for access to your photo library, and only when you tap to add a profile photo: we receive the single image you select and nothing else, we do not scan or index your library, and declining leaves every other part of the app working. If we ever add a feature that requires new categories of data or new device permissions, we will update this Policy and, where required, obtain your consent.

How We Use Your Information

We use personal information to:

• Provide the Service — create and maintain your account, store and display your budget data, calculate totals and projections, generate summaries and reports, and sync across your devices.
• Import and categorize transactions from accounts you have linked.
• Process payments — bill your subscription, manage renewals, trials, and cancellations, and issue receipts.
• Communicate with you — account notices, security alerts, billing and renewal notices, product updates, and responses to your support requests.
• Send notifications you have enabled — budget alerts, spending summaries, and bill reminders.
• Secure the Service — authenticate you, detect and prevent fraud, abuse, and unauthorized access, and investigate suspected violations of our Terms.
• Improve the Service — diagnose bugs, measure performance, understand which features are used, and develop new functionality.
• Comply with law — meet legal, tax, accounting, and regulatory obligations, and respond to lawful requests.

Automated processing. We use automated logic to categorize transactions and generate budget insights. These outputs are informational, are not always accurate, and do not constitute financial advice. You can review and correct any categorization.

Aggregated and de-identified data. We may create aggregated or de-identified data that cannot reasonably be used to identify you, and use it for analytics, research, and product development. We will not attempt to re-identify it.

We do not use your financial data for advertising, and we do not use it to build advertising profiles or to train third-party advertising models.

How We Share Your Information

We share personal information only as described below.

Service providers. Vendors that perform functions on our behalf and are contractually restricted to using your information only for those purposes:

• Cloud hosting and storage — Vercel, which serves the app, and Supabase, where your data is stored.
• Sign-in, account authentication, and delivery of account email — Supabase.
• Delivery of product and marketing email — Resend. Receives your email address and the contents of the message being sent, and nothing else.
• Federated sign-in, if you choose it — Google, which tells us the email address and name on the account you signed in with, and receives nothing about your budget.
• Financial data aggregation, where account linking is offered — an Aggregation Provider such as Plaid Inc.
• Payment processing, where the Service is offered by subscription — a payment processor such as Stripe, Inc., and Apple or Google for purchases made through their stores.
• Analytics and crash reporting — a diagnostics provider. Where none is in use, none receives anything.
• Customer support — the inboxes named in Section 15.

Legal and safety. We may disclose information when we believe in good faith it is necessary to comply with a law, subpoena, warrant, court order, or other legal process; to enforce our Terms; to protect our rights or property; or to protect the safety of any person. Where permitted by law, we will make reasonable efforts to notify you first.

Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy, and you will have the opportunity to delete your account first.

With your direction. We will share information with a third party when you ask us to — for example, exporting your data.

We do not:

• sell your personal information for money or other valuable consideration;
• share your personal information for cross-context behavioral advertising or targeted advertising;
• disclose your financial transaction data to data brokers, marketers, or advertising networks.

Retention

We keep personal information only as long as needed for the purposes described here.

• Account and budget data — for the life of your account.
• Data after account deletion — deleted or de-identified within 30 days, except as noted below.
• Billing and transaction records — up to 7 years, as required by tax and accounting law.
• Security and access logs — up to 12 months.
• Backups — purged on our normal backup rotation, up to 90 days.

We may retain information longer where required by law, or where necessary to resolve a dispute, enforce our agreements, or prevent fraud.

Cookies and Tracking

Website. We use cookies and similar technologies that are:

• strictly necessary — authentication, session management, security, and load balancing. These cannot be disabled.
• functional — remembering preferences such as currency and display settings.
• analytics — understanding aggregate usage so we can improve the site.

Mobile apps. Our apps use a device or installation identifier for authentication, crash reporting, and aggregate analytics. We do not use advertising identifiers (IDFA or AAID) and do not track you across other companies' apps or websites.

Your controls. You can manage cookies in your browser settings; blocking strictly necessary cookies may break parts of the site. We honor the Global Privacy Control (GPC) signal on our website. Because we do not sell or share personal information for advertising, there is nothing for a Do Not Track signal to opt you out of.

Security

We maintain administrative, technical, and physical safeguards designed to protect your information, including:

• encryption in transit (TLS 1.2 or higher) and encryption at rest for stored data;
• passwords stored only as salted hashes, never in plain text or in any recoverable form;
• role-based access controls limiting employee access to what is needed for their job;
• multi-factor authentication for internal administrative systems;
• logging and monitoring, and periodic review of our security practices;
• where offered, a device-level biometric or passcode lock for the app and multi-factor authentication on your account, both of which we recommend enabling.

No system is perfectly secure. We cannot guarantee absolute security, and you are responsible for keeping your password confidential and your devices secure. If a breach affects your personal information, we will notify you and any required regulators as the law requires.

Your Privacy Rights

Depending on your state of residence, you may have the right to:

• Know and access — confirm whether we process your personal information and obtain a copy, including the categories collected, the sources, the purposes, and the categories of recipients.
• Correct — have inaccurate personal information corrected.
• Delete — request deletion of your personal information.
• Portability — receive your information in a portable, machine-readable format.
• Opt out — of sale, targeted advertising, or profiling with legal effects. We do none of these.
• Limit use of sensitive information — see Section 9.
• Non-discrimination — we will not deny service, charge different prices, or provide a lesser quality of service because you exercised a privacy right.

How to Exercise Your Rights

• In the app — your transactions export to a spreadsheet from the transactions list, and nearly everything else is editable on the screen it appears on.
• Email — support@dailybudget.ai, from the address on your account.

We will verify your identity by confirming control of the email address on your account, or by other reasonable means for a more sensitive request. We respond within 45 days and may extend once by another 45 days with notice.

Authorized agents. An agent may submit a request on your behalf with written proof of authorization; we may also ask you to confirm directly.

Appeals. If we deny your request, you may appeal by emailing support@dailybudget.ai with "Privacy Appeal" in the subject line. We will respond within 45 days with our decision and reasoning. If we deny your appeal, you may contact your state Attorney General.

Sensitive Information

Some state laws treat financial account information as sensitive personal information. We collect and process your financial account information only to provide the Service you requested — never for advertising, profiling, or inferring characteristics about you. We do not use or disclose it for any purpose beyond what is described in Section 3, so no further limitation right applies. You may withdraw your consent at any time by disconnecting any linked accounts and, if you wish, deleting the imported data.

California Residents

Notice at Collection. The categories of personal information we collect are described in Section 2. Under the CCPA and CPRA these correspond to: identifiers; commercial information; financial information; internet and network activity; and inferences drawn to categorize your spending. Purposes are in Section 3, recipients in Section 4, and retention in Section 5.

Sale and sharing. We have not sold personal information or shared it for cross-context behavioral advertising in the preceding 12 months, and we do not do so now. We do not knowingly sell or share the personal information of anyone under 16 — and the Service is limited to adults 18 and over.

Your rights — to know, delete, correct, opt out, limit use of sensitive personal information, and non-discrimination — are described in Section 8 and available through the same channels.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.

Other State Privacy Laws

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have the rights described in Section 8, including the right to appeal a denial. We do not conduct targeted advertising, sell personal data, or engage in profiling that produces legal or similarly significant effects, so no opt-out is necessary for those activities.

Children's Privacy

The Service is not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it and terminate the account. Parents or guardians who believe a minor has created an account should contact support@dailybudget.ai.

Third-Party Links and Services

The Service may link to or integrate with third-party services, including your financial institutions, our Aggregation Provider, and app stores. Their privacy practices are their own and are not covered by this Policy. Please review their policies before providing information to them.

Changes to This Policy

We may update this Policy. If changes are material, we will notify you by email or in-app notice at least 30 days before they take effect and update the effective date above. We will obtain your consent before using previously collected personal information in a materially different way than described at the time of collection. Prior versions are available on request.

Contact Us

Operated by Daily Budget — Attn: Privacy

• Privacy: support@dailybudget.ai
• Security: security@dailybudget.ai
• Support: support@dailybudget.ai

The terms of using the Service are set out separately, at /legal/terms.