Privacy Policy

1. Who we are

Bankless Budget ("we," "us," or "our") is an automated expense-tracking service that reads transaction-notification emails from your Gmail inbox and extracts spending data so you can budget without sharing bank credentials. The service is operated by ByteEnthusiast LLC, a Missouri limited liability company doing business as Bankless Budget, which is the controller of the personal information described in this policy and can be reached at support@banklessbudget.com.

The Service is offered only to individuals located in the United States (see Terms of Service, Section 3). This Privacy Policy is written accordingly and does not address non-U.S. legal regimes such as the GDPR.

2. What data we collect

2.1 Google account profile

When you sign in with Google, we receive and store your Google account ID, email address, display name, and profile picture URL. These are used to identify your account, personalize the interface, email you account notices, and send you the alert emails you choose in the app (Section 3). If you share a budget or join one, the people in it see some of them too (Section 2.10).

2.2 OAuth tokens

We store your Google OAuth access token and refresh token so the app can access Gmail and Google Sheets on your behalf without asking you to sign in every time. These tokens are encrypted at rest using Fernet symmetric encryption before being saved to the database. The encryption key is stored separately in Google Cloud Secret Manager and is never committed to source code or logs.

2.3 Gmail email content

We access your Gmail account in read-only mode (scope: gmail.readonly). We cannot send, delete, or modify your emails.

We read only emails in the Gmail label you configure (for example, "Expenses"). For each email we read, we store:

• Gmail message ID and thread ID
• Email subject line and sender address
• Email body text (used for AI parsing, then stored for reprocessing if a parse fails)
• A content hash of the normalized sender + subject + body (used to avoid redundant AI calls)
• Processing status and timestamps

We do not access emails outside your configured label. We do not read email attachments, images, or drafts.

2.4 Transaction data

From each transaction-notification email, we extract and store:

• Merchant name
• Transaction amount and currency
• Transaction date
• Last four digits of the card used (if mentioned in the email)
• Card name (if mentioned in the email, e.g., "Chase Sapphire")
• Expense category (assigned by AI or by you)
• Brief description
• Email subject line (for your reference)

You may also add transactions manually. These are stored with the same fields but are marked as "manual" rather than "email" sourced.

2.5 Budget and settings data

We store the budget categories you create (names, amounts, and the merchant clues used to categorize purchases), your application preferences (currency, Gmail label, Google Sheet ID), the merchant rules you set — which category a merchant’s purchases go to, whether its charges repeat and how often, and when you cancelled them — any charge you left out of a recurring charge, and the recurring charges you set up.

2.6 Usage and rate-limit data

We record per-user action events (e.g., "manual sync" or "force reprocess" timestamps) to enforce rate limits and prevent abuse. These records contain only the action type, your user ID, and a timestamp — no email content or transaction details.

2.7 Session data

We set a single HttpOnly, Secure session cookie containing a signed JWT token. This cookie is used solely for authentication. We do not use any analytics cookies, advertising cookies, or third-party tracking cookies.

2.8 Billing data (paid plans)

If you subscribe to a paid plan, payment is handled by Stripe. Your payment card details are entered on Stripe-hosted pages and never touch our servers. We store only your Stripe customer ID, your Stripe subscription ID, your subscription tier, billing interval, and subscription period dates — received from Stripe via cryptographically verified webhook events. Stripe may retain payment records independently as required by its own legal and financial-compliance obligations.

2.9 How you found us

If you reached us through a link we published somewhere — a directory listing, an article, a social post — that link carries a short label naming the place it was published (for example reddit or alternativeto). We record that label on your account when it is created, so we can tell which of our own listings people actually come from. It is a fixed word we chose, not a description of you, your browsing, or the page you came from; it is recorded once at signup and never updated afterwards. If you reached us directly, or the link carried no label, nothing is recorded. We use no third-party analytics or advertising services to collect it (Sections 2.7 and 7).

2.10 Budget sharing

On the Plus plan you can share your budget with other people. If you invite someone, we store the email address you enter and the role you choose for them. We use the address to send the invite and to check that the person who accepts it is the one you invited, and we delete it once the invite is accepted or cancelled, or within an hour of it expiring.

If someone invites you and you join, we store your profile details (Section 2.1), your role, and when you joined. When you add or edit a purchase in that budget, we record that you did. If you join with a Google account that has no budget of its own here, Google gives us only those profile details: we never ask for access to your Gmail or Google Sheets, and we store no OAuth tokens for you (Section 2.2).

You can have a budget of your own and be in other people’s too. Each budget stays separate, and your own Gmail access, settings and billing never become part of a budget you join.

3. How we use your data

• To extract transactions: Email body text from your configured Gmail label is sent to Google's Gemini AI API to identify and extract transaction details (merchant, amount, date, card, category). See Section 4 for details on AI processing.
• To sync to Google Sheets: If you enable Sheets sync, your extracted transaction data is written to a Google Spreadsheet that you own, using your own Google credentials (scope: drive.file). This per-file scope only lets us access the specific spreadsheet the app creates for you — no other files in your Drive.
• To provide the dashboard: Transaction and budget data is displayed to you in the web interface (charts, tables, budget tracking, and the charges that repeat, which we find by comparing merchants, amounts and dates in your own transactions).
• To enforce usage limits: Action timestamps are used to enforce subscription-tier rate limits and prevent API abuse.
• To authenticate you: Your Google identity and OAuth tokens are used to verify your identity and authorize API access to Gmail and Sheets.
• To send account notices: When something about your account needs you — for example, Google stopped our access and automatic importing paused — we email your account address, through our email provider (see Mailgun in Section 7). These are account notices, not marketing.
• To send the alert emails you choose: We send the alert emails you choose in the app, such as budget alerts, to your account address, through our email provider (see Mailgun in Section 7). They can be about your own budget or one shared with you. Each kind is off until you turn it on, and every email has a link to turn it off.
• To run budget sharing: We use an address you invite to send the invite and to check who accepts it. We show the people in a budget what its pages show (Section 7), and who added or last edited each purchase. When someone joins your budget, we email you who it was. That notice can’t be turned off, because it tells you who can now see your budget.

4. AI processing (Gemini)

We use Google's Gemini AI models to parse transaction details from your email text. Here is exactly what happens:

1. The email subject, sender, and body text (truncated to approximately 12,000 characters) are sent to the Gemini API as a prompt.
2. The AI returns structured data: whether the email is a transaction notification, and if so, the merchant, amount, date, card details, and suggested category.
3. We store the extracted transaction data in our database. The raw AI response is not stored.

What this means for your privacy:

• Email text is transmitted to Google's Gemini API servers for processing. Google's Gemini API Terms of Service govern how Google handles this data. Under the paid API terms, Google does not use your API inputs or outputs to train their models.
• We use a content hash to avoid sending duplicate emails to the AI. If an identical email has already been processed, the prior result is reused without another AI call.
• We do not use your data to train any AI model. We do not share your data with any AI provider other than Google Gemini for the purpose of transaction extraction.

5. Google API Scopes

Bankless Budget requests the minimum Google API scopes necessary to function:

Bankless Budget's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Data storage and security

• Database: All data is stored in a PostgreSQL database hosted on Google Cloud SQL with private networking (no public IP). Data is encrypted at rest by Google Cloud.
• OAuth token encryption: Your Google access and refresh tokens are encrypted with Fernet symmetric encryption before being stored. The encryption key is managed through Google Cloud Secret Manager.
• Transport encryption: All data in transit is encrypted with TLS (HTTPS). The API enforces HTTPS in production.
• Session security: Session cookies are HttpOnly (not accessible to JavaScript), Secure (only sent over HTTPS), and have SameSite protection. CSRF protection is enforced via Origin/Referer validation on all mutating requests.
• Multi-tenant isolation: All database queries are scoped to your account, or to a budget its owner shared with you. You cannot access another user’s data through the API, except a budget you were invited to, and there only what your role allows. Your role is checked on every request, so when an owner changes it or removes you, that applies straight away.
• When we look at your data: We do not view the content of your emails or your transactions unless you give us permission to look at specific data, for example to help with a support request you sent us; it is necessary for security, such as investigating a bug or abuse; or it is required by law. To run and support the service we may view information about your account that is not email content or transactions, such as your plan, whether Google is connected, the status of your imports, and counts of processed emails, as well as aggregated statistics that do not identify you.
• No credential files: In deployed environments, all secrets are injected via environment variables or Google Cloud Secret Manager. No secret files are stored on disk.

7. Data sharing

We do not sell, rent, or trade your personal data. We share data only in these cases:

• Google Gemini API: Email text is sent to Google's Gemini API for transaction extraction (see Section 4).
• Google Sheets: If you enable Sheets sync, transaction data is written to a Google Sheet that you own, using your own Google credentials.
• Google Cloud Platform: Our infrastructure runs on GCP (Cloud Run, Cloud SQL, Pub/Sub). Google processes your data as a sub-processor under their Cloud Data Processing Terms.
• Stripe: If you subscribe to a paid plan, your email address — and the payment details you enter on Stripe's hosted pages — are processed by Stripe, our payment processor, under Stripe's Privacy Policy. We never see your full card number (see Section 2.8).
• Mailgun: When we need to email you about your account — for example, that Google stopped our access and your imports have paused — or send an alert email you chose, or an invite you asked us to send, the recipient’s email address and the message itself are processed by Mailgun, our email provider, under Mailgun's Privacy Policy. These messages say what happened and link to the app: they never contain transaction amounts, merchants, or email content. An alert may name something in the budget it is about, such as one of its categories. An invite names the person who sent it and the role they chose, and a notice that someone joined your budget names them and gives their email address. Mailgun keeps delivery logs for about one day on our plan.
• With people you invite: If you share your budget, the people you invite see, at your direction, what is on the pages you share: your purchases (including the subject line and sender of the bank alert each came from, never the rest of the email), budgets and categories, merchant rules, and recurring charges. They also see your name and picture, and whether your Google connection needs reconnecting, so they know why new purchases have stopped. They can change what their role allows. They never get your Gmail or Google Sheets access, your Google connection itself, your settings or your billing.
• With the budget you join: If you join someone else’s budget, its owner sees your name, email address, picture, role and when you joined, and everyone in it sees your name on the purchases you added or last edited. Nothing from a budget of your own is shown to them.
• Legal requirements: We may disclose data if required by law, court order, or government request.

We do not use any third-party analytics, advertising, or tracking services. We do not embed any third-party tracking scripts or pixels in the app.

8. Data retention

• Transaction history is retained for a limited period that depends on your plan. The Free plan keeps the current calendar month plus the three before it. The Plus plan keeps the current calendar year plus the three before it — so throughout 2026, a paid plan holds 2023, 2024, 2025 and 2026. Once a month or year falls outside your plan's period, both those transactions and the source emails we parsed them from — including their subject, sender, and message body — are permanently deleted from our database. This deletion is not reversible. Our database is backed up automatically so that it can be restored after a failure; backups are kept for up to 14 days, so deleted data can remain in them until they expire, and we use them only for that recovery purpose.
• We also do not read email older than your plan's window in the first place: searches of your mailbox are limited to that period, so we never import mail we have committed to deleting.
• Deletion runs on the first day of a period, US Pacific time, and removes the period that has just fallen outside your plan's window. On the Free plan that is the first of each month, removing one month. On Plus it is January 1, removing one whole calendar year — once a year rather than every month, so the warning below is worth reading when it appears. We show that warning in the app in the days beforehand, naming the period and the date, while the data is still visible and exportable. If your plan changes to one with a shorter period (for example, when a paid subscription ends), you also keep the ability to download your transactions as a spreadsheet file or send them to Google Sheets for a grace period, and we hold off deleting anything until that grace period ends. Transactions you have already synced to your own Google Sheet remain in your Google account and are unaffected — we never delete anything from your Drive.
• Your account, settings, budget categories, and merchant rules are retained for as long as your account is active, regardless of the transaction history window.
• Budget sharing: an invited address is deleted once the invite is accepted or cancelled, or within an hour of it expiring. A membership lasts until the owner removes the person, the person leaves, or either account is deleted; if the owner’s plan stops including sharing, it is kept but paused until the plan is renewed. Purchases a member added or edited belong to the budget they were made in, so they stay when the member leaves, and if the member deletes their account, their name is removed from them. If you choose “Don’t send me invites” in an invite email, we keep a one-way hash of your address — not the address itself — so that nobody can invite it again.
• If you delete your account, all personal and financial data is permanently deleted from our database, including transactions, processed email records, settings, budget categories, and merchant rules — including the referral label described in Section 2.9, any notification we had queued but not yet sent, the invites you sent, and your memberships, both of budgets you shared (whose members lose access to them) and of budgets you joined. We retain an anonymous identifier and an API usage counter solely for the purpose of fraud and abuse prevention (e.g., enforcing free-tier limits). If an email we sent you ever bounced or was reported as spam, we also keep a one-way hash of your email address — not the address itself — so that we never email it again; an address that could not receive mail does not become deliverable because an account closed, and re-sending to it would harm delivery for everyone else. As with any deletion, the data can remain in our automated database backups for up to 14 days until they expire (see the first item above).
• Temporary authentication state (PKCE codes, exchange tokens) is automatically expired and cleaned up within minutes of creation.
• Application logs may contain your user ID and alert IDs but do not contain email content, transaction amounts, or OAuth tokens. Most logs are retained for 30 days. A narrow subset is kept for up to 400 days in a separate store: error and warning records, which we need to investigate a fault long after it is reported, and daily aggregate counts and signup-channel counts, which contain no user identifier at all.

9. Your rights and choices

• Disconnect Google: You can disconnect your Google account from Settings. This revokes the app's OAuth tokens and stops all Gmail and Sheets access. Your existing transaction data is preserved. If you have an active paid subscription, cancel it first (Manage billing) — the in-app disconnect is unavailable while a subscription is active, so you aren't billed for a service that can no longer sync.
• Delete your account: You can delete your account and all associated data from Settings, or from your Account page if you have no budget of your own. Any active paid subscription is canceled immediately. This is permanent and cannot be undone.
• Stop sharing: If you share your budget, you can remove anyone from Settings → Sharing at any time, and cancel an invite before it is accepted. If you joined someone else’s budget, you can leave it at any time, or delete your account. Every invite email has a link to stop invites to your address from anyone.
• Revoke access in Google: You can also revoke Bankless Budget's access directly from your Google Account permissions page.
• Export your data: If Sheets sync is enabled, your transaction data is already in a Google Sheet you own. You can download it at any time.
• Contact us: For any privacy-related requests, email support@banklessbudget.com.

10. State privacy rights

California and a number of other states have enacted comprehensive consumer privacy laws. This section describes how those laws apply to Bankless Budget. Because the Service is offered only in the United States (Section 1), we address U.S. state law here rather than the GDPR or other non-U.S. regimes.

10.1 We do not sell or share your personal information

We do not sell or share personal information, as those terms are defined under the California Consumer Privacy Act (as amended by the CPRA) and similar state laws. We run no advertising business and no analytics, advertising, or tracking cookies or pixels (Section 2.7) — so there are no cross-context behavioral advertising practices to opt out of. When you share your budget, showing it to the people you invite is a disclosure you direct, which these laws do not treat as a sale or a share.

10.2 Your rights

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, or another state with a comprehensive privacy law, you may have the right to:

• Know and access the personal information we hold about you
• Correct inaccurate personal information
• Delete your personal information
• Obtain a copy of your data in a portable format
• Not be discriminated against for exercising any of these rights — we will not deny you the Service, charge you a different price, or provide a different level of service

We do not use sensitive personal information for any purpose beyond providing the Service you requested, so there is no separate "limit the use of sensitive personal information" request to make.

You can exercise most of these rights directly from the Settings page (Section 9) or by emailing support@banklessbudget.com. We verify requests using your authenticated account session; if you email us instead, we will verify your identity using the email address on your account before fulfilling a request that discloses or deletes personal information.

10.3 Categories of personal information

In the past 12 months we have collected the categories of personal information described in Section 2 — identifiers (Section 2.1), Gmail-sourced transaction and email metadata (Sections 2.3–2.4), budget and settings data (Section 2.5), limited account-security data (Section 2.7), the signup referral label described in Section 2.9, and budget-sharing data (Section 2.10) — directly from you, from the Google APIs you authorize, and, for the email address an invite is sent to, from the person who invites you, for the purposes described in Section 3. We have not sold or shared any of these categories.

11. Children's privacy

Bankless Budget is not directed at children under 13 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically.

13. Contact

If you have questions about this Privacy Policy or our data practices, contact us at: support@banklessbudget.com

ByteEnthusiast LLC d/b/a Bankless Budget, Missouri, United States.