Do budgeting apps sell your data? A ten-minute privacy policy check
Most budgeting apps truthfully say they don't sell your financial data. The eight things to find in a privacy policy instead, checked on three apps.
Drafted with AI assistance, researched, fact-checked and edited by Dejan Bogatinovski. How we write.
On this page
Do budgeting apps sell your data? The big ones mostly say no, in plain words, and they are probably telling the truth about your transactions. That sentence is the least useful one in the policy. What differs between apps is everything around it: what counts as a "sale" under the law, what the app shares for its own advertising, which analytics tools run inside it, who holds your bank login, how long data is kept and where. Those take ten minutes to find if you know the words to search for. Below are the eight, then the same check on three real policies and on ours. For what we do with data by design, see how Tavala keeps your records private.
This is a reading guide, not legal advice. The law cited is American, mostly Californian, because that is where the definitions most policies use come from.
Before you start: two words the law defines
Search the policy for "sell" and "share". Under the California Consumer Privacy Act, a sale is disclosing personal information to a third party "for monetary or other valuable consideration". Sharing is disclosing it for cross-context behavioral advertising, "whether or not for monetary or other valuable consideration" (CCPA, Civil Code 1798.140(ad) and (ah), as published by the CPPA). Cross-context behavioral advertising means targeting ads at you based on what you do across other businesses' sites and apps (1798.140(k)). The California Attorney General's page puts it in one line: "sharing refers specifically to sharing for cross-context behavioral advertising" (California AG, CCPA).
So an app can sell nothing for money and still "sell" or "share" in the legal sense, usually through advertising cookies on its website. Many policies say exactly that, and it is worth reading which side of the line the app puts itself on.
The eight things to find
1. What is collected, and from where
Look for three sources: what you type, what arrives from your bank through an aggregator, and what your device sends by itself (identifiers, usage, crash data). A policy that lists only the first is incomplete.
2. Who it is shared with, and why
Service providers acting on the app's instructions are normal. Look for the others: advertising partners, affiliates, "business transfers" (your data goes to a buyer if the company is sold), and aggregated or de-identified data, which most policies allow the company to pass on.
3. "Sale" and "sharing", by the definitions above
The tell is a qualifier. "We never sell your financial data" covers transactions. "We do not sell personal data for monetary consideration" leaves room for the "other valuable consideration" in the definition.
4. Advertising and analytics tools
Search for "analytics", "SDK", "pixel", "session replay" and "hashed email". Session recordings and heatmaps capture how you use the app. A hashed email sent to an ad platform lets that platform match you to its own records.
5. The aggregator: who holds your bank login
If the app connects to banks, find the aggregator's name (Plaid, MX, Finicity) and whether its own privacy policy applies to you. It usually does, and it usually allows uses the app's policy does not mention. Is Plaid safe? covers Plaid's side.
6. Retention
"As long as necessary" is a phrase, not a period. Look for a number of months, and for what happens after a subscription ends.
7. Deletion
Find the button, then find the caveats: backups, legal holds, and whether closing the account deletes the data or only your access.
8. Where it is stored
Look for a country. If you live outside the United States, look for the transfer mechanism, such as the European Commission's Standard Contractual Clauses.
Three policies, checked on 24 October 2026
| What to find | YNAB | Monarch | Copilot |
|---|---|---|---|
| Sale of financial data | No: "we do not under any circumstances" sell what you provide through the product | "We will never sell your financial data." | "We do not sell your Financial Information" |
| The qualifier | It says some laws call its ad activity "selling" or "sharing" | "we do not sell Personal Data for monetary consideration" | It is "never used to generate or influence advertising" |
| Advertising | Shares "a hashed email address" with ad platforms to show YNAB ads | Cookies let "Advertising Partners" receive device and web analytics data "for targeted advertising purposes" | Shares IP addresses and hashed emails with ad platforms to show Copilot ads |
| Analytics | Third-party analytics, including "session recordings, heatmaps" | "We may use session replay technology" | "Google Analytics and Amplitude Analytics" |
| Aggregators | MX and Plaid, whose own policies "will apply" | Plaid, Finicity, MX or Spinwheel | Plaid and Finicity |
| Retention | Most account data "for up to 24 months after your subscription or trial expires" | "for as long as necessary to provide you with our Services" | "for as long as your account is active" |
| Deletion | On request, any time | Closing the account "does not erase every copy of your information from our systems" | On request, any time |
| Storage | "stored in the United States" | Not stated | "stored in the United States" |
Sources: YNAB privacy policy (effective 20 April 2026), Monarch privacy policy (effective 10 August 2026), Copilot privacy policy (last updated 6 May 2026).
Read fairly, all three are better than the average app policy. None sells transactions. All three advertise themselves with identifiers that ad platforms can match, and say so. All three run analytics inside the product. Monarch also says it may create aggregated or de-identified data "and disclose it to third parties". And the two that name a country name the United States.
The financial privacy laws behind the policy
GLBA. The Gramm-Leach-Bliley Act requires financial institutions to "explain their information-sharing practices to their customers" and their right to opt out of some sharing (FTC). The notice comes when the customer relationship starts, then once a year (FTC, Privacy Rule guide). It matters for the CCPA too: the CCPA does not apply to personal information collected under GLBA (1798.145(e)). None of the three policies above mentions GLBA.
Section 1033. The CFPB's Personal Financial Data Rights rule was issued on 22 October 2024 and took effect on 17 January 2025 (CFPB, final rule). It would require banks to make your data available to you and to apps you authorize, with limits on what those apps do with it. Here is its status as of 24 October 2026:
- The CFPB's own page says it "is in the process of writing regulations", and its last entry is the reconsideration it opened on 22 August 2025 on four issues, data privacy among them (CFPB).
- On 29 October 2025 a federal court in Kentucky stayed the rule and barred the CFPB from enforcing it while it reconsiders (ABA Banking Journal).
- The regulatory agenda estimated a proposed rule for July 2026 (reginfo.gov). The Federal Register shows no proposal since the August 2025 notice.
Until that changes, the app's policy and the aggregator's policy are the rules you agreed to.
The same check on Tavala's policy
We publish ours at /privacy/, and it gets the same eight questions.
Collected, and from where. As a guest, nothing of your records. Entries live in a database on the device, or in the browser's own storage on the web, and the policy says the app "never sends your records anywhere". Two requests do leave a guest's device: a download of the shared exchange-rate table, which carries nothing about you, and crash reports, with amounts and email addresses stripped before they leave and no link to an account (use Tavala without an account). With an account, your records sync to our servers.
Shared with whom. The full list of processors, as the policy names them: Supabase (database and sign-in), PowerSync (sync), Amazon Web Services (serves the web app and the site), Sentry (crash reports), Plaid (bank connections, only if you use them), OpenAI and Anthropic (Ask Tavala's answers, only if you turn it on), RevenueCat (store purchases), Stripe (web payments), Resend (account emails) and Umami (cookieless visit counts on the website). That is eleven, and none of them advertises to you.
Sale and sharing. "We do not sell personal data, and we do not share it for cross-context behavioural advertising, under any definition of those terms in California law or elsewhere." There is no advertising identifier and no analytics SDK in the app.
Aggregator. Plaid, for banks in the United States and Canada, as an optional add-on. Our policy says Plaid also processes data "for its own purposes", and asks you to read Plaid's policy before you connect.
Retention, deletion, storage. Records stay until you delete them; deleting the account deletes them at once, and backups roll over within 30 days. A free account nobody opens for 24 months is deleted after two warning emails. Records are stored in the European Union (Ireland) (what Tavala stores, delete your account).
Two limits, since a fair check names them: crash reports cannot be switched off inside the app, and the database on your device is not encrypted by Tavala beyond what the operating system already does.
The ten minutes, in order
- Search "sell" and "share". Note any qualifier.
- Search "advertis", "hashed", "pixel", "analytics", "session replay".
- Find the aggregator's name and open its policy.
- Find a number of months under retention.
- Read the deletion section to its last sentence.
- Find the country.
- Decide whether the app works without the bank link. If it does, the aggregator question goes away. Our guide to budget apps that don't connect to your bank lists the ones that do.
Dejan BogatinovskiFounder of Tavala. He has written software for more than ten years, builds Tavala on his own in Skopje, and checks every guide against the app or the source it cites.