Privacy Policy

1. Who we are

Bankless Budget ("we," "us," or "our") is an automated expense-tracking service that reads transaction-notification emails from your Gmail inbox and extracts spending data so you can budget without sharing bank credentials. The service is operated by Bankless Budget and can be reached at support@banklessbudget.com.

2. What data we collect

2.1 Google account profile

When you sign in with Google, we receive and store your Google account ID, email address, display name, and profile picture URL. These are used to identify your account and personalize the interface.

2.2 OAuth tokens

We store your Google OAuth access token and refresh token so the app can access Gmail and Google Sheets on your behalf without asking you to sign in every time. These tokens are encrypted at rest using Fernet symmetric encryption before being saved to the database. The encryption key is stored separately in Google Cloud Secret Manager and is never committed to source code or logs.

2.3 Gmail email content

We access your Gmail account in read-only mode (scope: gmail.readonly). We cannot send, delete, or modify your emails.

We read only emails in the Gmail label you configure (for example, "Expenses"). For each email we read, we store:

• Gmail message ID and thread ID
• Email subject line and sender address
• Email body text (used for AI parsing, then stored for reprocessing if a parse fails)
• A content hash of the normalized sender + subject + body (used to avoid redundant AI calls)
• Processing status and timestamps

We do not access emails outside your configured label. We do not read email attachments, images, or drafts.

2.4 Transaction data

From each transaction-notification email, we extract and store:

• Merchant name
• Transaction amount and currency
• Transaction date
• Last four digits of the card used (if mentioned in the email)
• Card name (if mentioned in the email, e.g., "Chase Sapphire")
• Expense category (assigned by AI or by you)
• Brief description
• Email subject line (for your reference)

You may also add transactions manually. These are stored with the same fields but are marked as "manual" rather than "email" sourced.

2.5 Budget and settings data

We store the budget categories you create (names, amounts, hints for auto-categorization), your application preferences (currency, timezone, Gmail label, Google Sheet ID), and merchant-to-category mappings you configure.

2.6 Usage and rate-limit data

We record per-user action events (e.g., "manual sync" or "force reprocess" timestamps) to enforce rate limits and prevent abuse. These records contain only the action type, your user ID, and a timestamp — no email content or transaction details.

2.7 Session data

We set a single HttpOnly, Secure session cookie containing a signed JWT token. This cookie is used solely for authentication. We do not use any analytics cookies, advertising cookies, or third-party tracking cookies.

2.8 Billing data (paid plans)

If you subscribe to a paid plan, payment is handled by Stripe. Your payment card details are entered on Stripe-hosted pages and never touch our servers. We store only your Stripe customer ID, your Stripe subscription ID, your subscription tier, billing interval, and subscription period dates — received from Stripe via cryptographically verified webhook events. Stripe may retain payment records independently as required by its own legal and financial-compliance obligations.

3. How we use your data

• To extract transactions: Email body text from your configured Gmail label is sent to Google's Gemini AI API to identify and extract transaction details (merchant, amount, date, card, category). See Section 4 for details on AI processing.
• To sync to Google Sheets: If you enable Sheets sync, your extracted transaction data is written to a Google Spreadsheet that you own, using your own Google credentials (scope: drive.file). This per-file scope only lets us access the specific spreadsheet the app creates for you — no other files in your Drive.
• To provide the dashboard: Transaction and budget data is displayed to you in the web interface (charts, tables, budget tracking).
• To enforce usage limits: Action timestamps are used to enforce subscription-tier rate limits and prevent API abuse.
• To authenticate you: Your Google identity and OAuth tokens are used to verify your identity and authorize API access to Gmail and Sheets.

4. AI processing (Gemini)

We use Google's Gemini 2.5 Flash AI model to parse transaction details from your email text. Here is exactly what happens:

1. The email subject, sender, and body text (truncated to approximately 4,000 characters) are sent to the Gemini API as a prompt.
2. The AI returns structured data: whether the email is a transaction notification, and if so, the merchant, amount, date, card details, and suggested category.
3. We store the extracted transaction data in our database. The raw AI response is not stored.

What this means for your privacy:

• Email text is transmitted to Google's Gemini API servers for processing. Google's Gemini API Terms of Service govern how Google handles this data. Under the paid API terms, Google does not use your API inputs or outputs to train their models.
• We use a content hash to avoid sending duplicate emails to the AI. If an identical email has already been processed, the prior result is reused without another AI call.
• We do not use your data to train any AI model. We do not share your data with any AI provider other than Google Gemini for the purpose of transaction extraction.

5. Google API Scopes

Bankless Budget requests the minimum Google API scopes necessary to function:

Bankless Budget's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Data storage and security

• Database: All data is stored in a PostgreSQL database hosted on Google Cloud SQL with private networking (no public IP). Data is encrypted at rest by Google Cloud.
• OAuth token encryption: Your Google access and refresh tokens are encrypted with Fernet symmetric encryption before being stored. The encryption key is managed through Google Cloud Secret Manager.
• Transport encryption: All data in transit is encrypted with TLS (HTTPS). The API enforces HTTPS in production.
• Session security: Session cookies are HttpOnly (not accessible to JavaScript), Secure (only sent over HTTPS), and have SameSite protection. CSRF protection is enforced via Origin/Referer validation on all mutating requests.
• Multi-tenant isolation: All database queries are scoped to your user ID. You cannot access another user's data through the API.
• No credential files: In deployed environments, all secrets are injected via environment variables or Google Cloud Secret Manager. No secret files are stored on disk.

7. Data sharing

We do not sell, rent, or trade your personal data. We share data only in these cases:

• Google Gemini API: Email text is sent to Google's Gemini API for transaction extraction (see Section 4).
• Google Sheets: If you enable Sheets sync, transaction data is written to a Google Sheet that you own, using your own Google credentials.
• Google Cloud Platform: Our infrastructure runs on GCP (Cloud Run, Cloud SQL, Pub/Sub). Google processes your data as a sub-processor under their Cloud Data Processing Terms.
• Stripe: If you subscribe to a paid plan, your email address — and the payment details you enter on Stripe's hosted pages — are processed by Stripe, our payment processor, under Stripe's Privacy Policy. We never see your full card number (see Section 2.8).
• Legal requirements: We may disclose data if required by law, court order, or government request.

We do not use any third-party analytics, advertising, or tracking services. We do not embed any third-party tracking scripts or pixels in the app.

8. Data retention

• Your account data, transactions, and settings are retained for as long as your account is active.
• If you delete your account, all personal and financial data is permanently deleted from our database, including transactions, processed email records, settings, budget categories, and merchant mappings. We retain an anonymous identifier and an API usage counter solely for the purpose of fraud and abuse prevention (e.g., enforcing free-tier limits).
• Temporary authentication state (PKCE codes, exchange tokens) is automatically expired and cleaned up within minutes of creation.
• Application logs may contain your user ID and alert IDs but do not contain email content, transaction amounts, or OAuth tokens. Logs are retained according to Google Cloud Logging's default retention period (30 days).

9. Your rights and choices

• Disconnect Google: You can disconnect your Google account from Settings. This revokes the app's OAuth tokens and stops all Gmail and Sheets access. Your existing transaction data is preserved. If you have an active paid subscription, cancel it first (Manage billing) — the in-app disconnect is unavailable while a subscription is active, so you aren't billed for a service that can no longer sync.
• Delete your account: You can delete your account and all associated data from Settings. Any active paid subscription is canceled immediately. This is permanent and cannot be undone.
• Revoke access in Google: You can also revoke Bankless Budget's access directly from your Google Account permissions page.
• Export your data: If Sheets sync is enabled, your transaction data is already in a Google Sheet you own. You can download it at any time.
• Contact us: For any privacy-related requests, email support@banklessbudget.com.

10. Children's privacy

Bankless Budget is not directed at children under 13 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically.

12. Contact

If you have questions about this Privacy Policy or our data practices, contact us at: support@banklessbudget.com