Privacy Policy

1. Who we are

Bankless Budget ("we," "us," or "our") is an automated expense-tracking service that reads transaction-notification emails from your Gmail inbox and extracts spending data so you can budget without sharing bank credentials. The service is operated by Bankless Budget and can be reached at support@banklessbudget.com.

The Service is offered only to individuals located in the United States (see Terms of Service, Section 3). This Privacy Policy is written accordingly and does not address non-U.S. legal regimes such as the GDPR.

2. What data we collect

2.1 Google account profile

When you sign in with Google, we receive and store your Google account ID, email address, display name, and profile picture URL. These are used to identify your account and personalize the interface.

2.2 OAuth tokens

We store your Google OAuth access token and refresh token so the app can access Gmail and Google Sheets on your behalf without asking you to sign in every time. These tokens are encrypted at rest using Fernet symmetric encryption before being saved to the database. The encryption key is stored separately in Google Cloud Secret Manager and is never committed to source code or logs.

2.3 Gmail email content

We access your Gmail account in read-only mode (scope: gmail.readonly). We cannot send, delete, or modify your emails.

We read only emails in the Gmail label you configure (for example, "Expenses"). For each email we read, we store:

• Gmail message ID and thread ID
• Email subject line and sender address
• Email body text (used for AI parsing, then stored for reprocessing if a parse fails)
• A content hash of the normalized sender + subject + body (used to avoid redundant AI calls)
• Processing status and timestamps

We do not access emails outside your configured label. We do not read email attachments, images, or drafts.

2.4 Transaction data

From each transaction-notification email, we extract and store:

• Merchant name
• Transaction amount and currency
• Transaction date
• Last four digits of the card used (if mentioned in the email)
• Card name (if mentioned in the email, e.g., "Chase Sapphire")
• Expense category (assigned by AI or by you)
• Brief description
• Email subject line (for your reference)

You may also add transactions manually. These are stored with the same fields but are marked as "manual" rather than "email" sourced.

2.5 Budget and settings data

We store the budget categories you create (names, amounts, hints for auto-categorization), your application preferences (currency, Gmail label, Google Sheet ID), and merchant-to-category mappings you configure.

2.6 Usage and rate-limit data

We record per-user action events (e.g., "manual sync" or "force reprocess" timestamps) to enforce rate limits and prevent abuse. These records contain only the action type, your user ID, and a timestamp — no email content or transaction details.

2.7 Session data

We set a single HttpOnly, Secure session cookie containing a signed JWT token. This cookie is used solely for authentication. We do not use any analytics cookies, advertising cookies, or third-party tracking cookies.

2.8 Billing data (paid plans)

If you subscribe to a paid plan, payment is handled by Stripe. Your payment card details are entered on Stripe-hosted pages and never touch our servers. We store only your Stripe customer ID, your Stripe subscription ID, your subscription tier, billing interval, and subscription period dates — received from Stripe via cryptographically verified webhook events. Stripe may retain payment records independently as required by its own legal and financial-compliance obligations.

3. How we use your data

• To extract transactions: Email body text from your configured Gmail label is sent to Google's Gemini AI API to identify and extract transaction details (merchant, amount, date, card, category). See Section 4 for details on AI processing.
• To sync to Google Sheets: If you enable Sheets sync, your extracted transaction data is written to a Google Spreadsheet that you own, using your own Google credentials (scope: drive.file). This per-file scope only lets us access the specific spreadsheet the app creates for you — no other files in your Drive.
• To provide the dashboard: Transaction and budget data is displayed to you in the web interface (charts, tables, budget tracking).
• To enforce usage limits: Action timestamps are used to enforce subscription-tier rate limits and prevent API abuse.
• To authenticate you: Your Google identity and OAuth tokens are used to verify your identity and authorize API access to Gmail and Sheets.

4. AI processing (Gemini)

We use Google's Gemini 2.5 Flash AI model to parse transaction details from your email text. Here is exactly what happens:

1. The email subject, sender, and body text (truncated to approximately 4,000 characters) are sent to the Gemini API as a prompt.
2. The AI returns structured data: whether the email is a transaction notification, and if so, the merchant, amount, date, card details, and suggested category.
3. We store the extracted transaction data in our database. The raw AI response is not stored.

What this means for your privacy:

• Email text is transmitted to Google's Gemini API servers for processing. Google's Gemini API Terms of Service govern how Google handles this data. Under the paid API terms, Google does not use your API inputs or outputs to train their models.
• We use a content hash to avoid sending duplicate emails to the AI. If an identical email has already been processed, the prior result is reused without another AI call.
• We do not use your data to train any AI model. We do not share your data with any AI provider other than Google Gemini for the purpose of transaction extraction.

5. Google API Scopes

Bankless Budget requests the minimum Google API scopes necessary to function:

Bankless Budget's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Data storage and security

• Database: All data is stored in a PostgreSQL database hosted on Google Cloud SQL with private networking (no public IP). Data is encrypted at rest by Google Cloud.
• OAuth token encryption: Your Google access and refresh tokens are encrypted with Fernet symmetric encryption before being stored. The encryption key is managed through Google Cloud Secret Manager.
• Transport encryption: All data in transit is encrypted with TLS (HTTPS). The API enforces HTTPS in production.
• Session security: Session cookies are HttpOnly (not accessible to JavaScript), Secure (only sent over HTTPS), and have SameSite protection. CSRF protection is enforced via Origin/Referer validation on all mutating requests.
• Multi-tenant isolation: All database queries are scoped to your user ID. You cannot access another user's data through the API.
• No credential files: In deployed environments, all secrets are injected via environment variables or Google Cloud Secret Manager. No secret files are stored on disk.

7. Data sharing

We do not sell, rent, or trade your personal data. We share data only in these cases:

• Google Gemini API: Email text is sent to Google's Gemini API for transaction extraction (see Section 4).
• Google Sheets: If you enable Sheets sync, transaction data is written to a Google Sheet that you own, using your own Google credentials.
• Google Cloud Platform: Our infrastructure runs on GCP (Cloud Run, Cloud SQL, Pub/Sub). Google processes your data as a sub-processor under their Cloud Data Processing Terms.
• Stripe: If you subscribe to a paid plan, your email address — and the payment details you enter on Stripe's hosted pages — are processed by Stripe, our payment processor, under Stripe's Privacy Policy. We never see your full card number (see Section 2.8).
• Legal requirements: We may disclose data if required by law, court order, or government request.

We do not use any third-party analytics, advertising, or tracking services. We do not embed any third-party tracking scripts or pixels in the app.

8. Data retention

• Transaction history is retained for a limited period that depends on your plan. The Free plan keeps the current calendar month plus the three before it. The Plus and Pro plans keep the current calendar year plus the three before it — so throughout 2026, a paid plan holds 2023, 2024, 2025 and 2026. Once a month or year falls outside your plan's period, both those transactions and the source emails we parsed them from — including their subject, sender, and message body — are permanently deleted from our database. This deletion is not reversible, and we do not keep a copy.
• We also do not read email older than your plan's window in the first place: searches of your mailbox are limited to that period, so we never import mail we have committed to deleting.
• Deletion runs on the first day of a period, US Pacific time, and removes the period that has just fallen outside your plan's window. On the Free plan that is the first of each month, removing one month. On Plus and Pro it is January 1, removing one whole calendar year — once a year rather than every month, so the warning below is worth reading when it appears. We show that warning in the app in the days beforehand, naming the period and the date, while the data is still visible and exportable. If your plan changes to one with a shorter period (for example, when a paid subscription ends), you also keep the ability to download your transactions as a spreadsheet file or send them to Google Sheets for a grace period, and we hold off deleting anything until that grace period ends. Transactions you have already synced to your own Google Sheet remain in your Google account and are unaffected — we never delete anything from your Drive.
• Your account, settings, budget categories, and merchant mappings are retained for as long as your account is active, regardless of the transaction history window.
• If you delete your account, all personal and financial data is permanently deleted from our database, including transactions, processed email records, settings, budget categories, and merchant mappings. We retain an anonymous identifier and an API usage counter solely for the purpose of fraud and abuse prevention (e.g., enforcing free-tier limits).
• Temporary authentication state (PKCE codes, exchange tokens) is automatically expired and cleaned up within minutes of creation.
• Application logs may contain your user ID and alert IDs but do not contain email content, transaction amounts, or OAuth tokens. Logs are retained according to Google Cloud Logging's default retention period (30 days).

9. Your rights and choices

• Disconnect Google: You can disconnect your Google account from Settings. This revokes the app's OAuth tokens and stops all Gmail and Sheets access. Your existing transaction data is preserved. If you have an active paid subscription, cancel it first (Manage billing) — the in-app disconnect is unavailable while a subscription is active, so you aren't billed for a service that can no longer sync.
• Delete your account: You can delete your account and all associated data from Settings. Any active paid subscription is canceled immediately. This is permanent and cannot be undone.
• Revoke access in Google: You can also revoke Bankless Budget's access directly from your Google Account permissions page.
• Export your data: If Sheets sync is enabled, your transaction data is already in a Google Sheet you own. You can download it at any time.
• Contact us: For any privacy-related requests, email support@banklessbudget.com.

10. State privacy rights

California and a number of other states have enacted comprehensive consumer privacy laws. This section describes how those laws apply to Bankless Budget. Because the Service is offered only in the United States (Section 1), we address U.S. state law here rather than the GDPR or other non-U.S. regimes.

10.1 We do not sell or share your personal information

We do not sell or share personal information, as those terms are defined under the California Consumer Privacy Act (as amended by the CPRA) and similar state laws. We run no advertising business and no analytics, advertising, or tracking cookies or pixels (Section 2.7) — so there are no cross-context behavioral advertising practices to opt out of.

10.2 Your rights

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, or another state with a comprehensive privacy law, you may have the right to:

• Know and access the personal information we hold about you
• Correct inaccurate personal information
• Delete your personal information
• Obtain a copy of your data in a portable format
• Not be discriminated against for exercising any of these rights — we will not deny you the Service, charge you a different price, or provide a different level of service

We do not use sensitive personal information for any purpose beyond providing the Service you requested, so there is no separate "limit the use of sensitive personal information" request to make.

You can exercise most of these rights directly from the Settings page (Section 9) or by emailing support@banklessbudget.com. We verify requests using your authenticated account session; if you email us instead, we will verify your identity using the email address on your account before fulfilling a request that discloses or deletes personal information.

10.3 Categories of personal information

In the past 12 months we have collected the categories of personal information described in Section 2 — identifiers (Section 2.1), Gmail-sourced transaction and email metadata (Sections 2.3–2.4), budget and settings data (Section 2.5), and limited account-security data (Section 2.7) — directly from you and from the Google APIs you authorize, for the purposes described in Section 3. We have not sold or shared any of these categories.

11. Children's privacy

Bankless Budget is not directed at children under 13 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically.

13. Contact

If you have questions about this Privacy Policy or our data practices, contact us at: support@banklessbudget.com