Privacy Policy

Your account. Your name, email address, and a password that we never see in readable form. If you turn on two factor authentication we store the settings for it, including recovery codes in a hashed form we cannot reverse.

Your budget. The envelopes you create, what you plan to put in them, your income sources and pay cycle, your goals, your categories and labels, and any notes you write.

Your bank information, if you connect a bank. We use Akahu, a New Zealand open banking provider, so your bank login is entered with Akahu and never with us. What we then receive and store is your account names, types and balances, and your transactions: date, amount, merchant and the bank's own description. We also hold the access token Akahu gives us so we can keep your accounts up to date.

Your wider financial position, if you enter it. Assets, liabilities, property, vehicles and net worth snapshots you choose to record.

Receipts and attachments. Any receipt photos or files you attach to a transaction or a goal.

Your household, if you use those features. Shopping lists, meal plans, recipes, to do lists and calendar events. If you connect a calendar, you authorise that yourself and can disconnect it at any time.

Your children, if you use the Kids module. A child's first name, an avatar, their date of birth if you enter it, their chores, pocket money, savings goals, and any bank accounts you choose to assign to them. If a chore asks for photo proof, the photo your child takes. See Children's information below, which is a section worth reading properly.

What you say to Billi. Billi is the coaching companion inside the app. The questions you type are stored so we can see which ones Billi answers badly and improve them. There is one deliberate exception, described under Safety below.

Technical and usage information. Your IP address and browser, which any website receives, plus, if you accept analytics cookies, which pages you visit and which features you use. Analytics is off unless you turn it on.

To run the app you asked for: to show you your budget, import and categorise your transactions, keep your balances current, send the emails you have asked for, and take payment if you subscribe.

To keep accounts secure, which includes rate limiting sign in attempts and protecting children's PIN logins from guessing.

To understand which parts of the app help and which do not, so we can fix the ones that do not. That is the analytics you can switch off, and switching it off does not change how the app works for you.

We do not sell your personal information. We do not share it with advertisers. We do not use your financial data to market anything to you.

We use other companies to run the service. Each one only receives what it needs to do its job.

• Supabase hosts our database, sign in system and file storage. This is where your information lives.
• Vercel hosts and runs the app itself.
• Akahu provides the bank connection. You authorise Akahu directly, and you can withdraw that authorisation at any time.
• Upstash provides a short lived cache. Your accounts and transactions are held there for a few minutes at a time so the app does not have to ask your bank again on every screen.
• Resend sends our emails, so it receives your email address and the content of what we send.
• Stripe handles subscription billing. Your card details go to Stripe and never reach us.
• Google, only if you choose to connect a calendar, and only for that calendar's events.
• Orchid Horizon Hub, our own internal tool, receives product analytics if you have accepted analytics cookies. It receives an anonymous account identifier and nothing else: no name, no email address, no financial information.

Two more are loaded by your browser rather than by us, which means they receive your IP address without any information being sent from our side:

• Cloudflare Turnstile checks that our public waitlist, contact and claim forms are being used by a person rather than a bot. It is only on those public forms.
• Shielded appears on every page once you are signed in. It is a safety feature and it is explained under Safety below.

We will also disclose information if the law requires it, or where it is necessary to prevent a serious threat to someone's life, health or safety.

Your information is stored in Sydney, Australia, in Amazon Web Services' ap-southeast-2 region. That covers our database, our file storage, the app itself and the short lived cache. Akahu holds its part in New Zealand.

Some of the companies listed above are based overseas and may process information outside New Zealand and Australia, in particular Stripe, Resend, Google and Cloudflare. Where that happens, we rely on those providers' contractual commitments to protect your information to a standard comparable to the New Zealand Privacy Act.

Your budget and transaction history: for as long as your account exists. A budgeting app that forgets last year cannot show you a trend, level a power bill across the seasons, or tell you what you actually spend at Christmas. Keeping it is the point of the product. When you delete your account it goes.

Chore photos: until the chore is approved or declined. A photo exists so a parent can decide whether a chore was done. The moment they decide, the photo is deleted from our storage, whichever way they decided.

Analytics events and Billi conversations: 90 days. These are useful in aggregate for a few months and are not useful for years, so they are deleted automatically.

Waitlist and contact messages. A waitlist entry is kept until launch. A message you send us is kept as correspondence. Ask us and we will delete either.

The Kids module is set up and controlled by a parent or guardian. A child does not create their own account. A parent adds a child profile, and the information in it is entered by the parent or by the child using the login key the parent gives them.

A child signs in with a login key and a PIN, not an email address. We do not ask a child for an email address or a phone number.

If a chore asks for photo proof, the photo is stored privately, can only be viewed through the app by the parent who owns that child profile, and is deleted as soon as that parent approves or declines the chore. We do not use these photos for anything else.

Analytics never carries a child identifier. Deleting the parent's account deletes the child profiles under it.

If you are a parent and you want a child's information removed at any point, email us and we will do it.

On every page, once you are signed in, there is a small Shielded logo. Shielded is a New Zealand service that gives someone experiencing domestic violence a way to reach support from inside an ordinary website, and a way to leave the page quickly.

It is loaded on every page rather than only when it is used, on purpose. It has to already be there before someone needs it, and loading it only on request would itself be a signal that something was being looked for. The cost of that choice is that Shielded receives your IP address on each page, in the same way any image or script loaded from another site does. We think that is the right trade and we would rather tell you about it than hide it.

If you raise something with Billi that suggests you may be at risk, Billi points you to support and what you typed is not stored. Neither the message nor the reply is kept. The same applies to anything caught by our content moderation.

Your connection to the app is encrypted, and your information is encrypted where it is stored. Your password is stored hashed, so we cannot read it and cannot tell you what it is.

You can turn on two factor authentication, which adds a second check from an authenticator app, with backup codes in case you lose your phone.

Your bank login is never entered into My Budget Mate. It goes to Akahu, and we receive only the access Akahu grants us.

No system is perfectly secure, and we will not pretend otherwise. If something happens that affects your information, we will tell you and the Office of the Privacy Commissioner as the Privacy Act requires.

We use cookies that are necessary to sign you in and keep you signed in. Those cannot be switched off without breaking the app.

Analytics cookies are off by default. If you accept them, we record which pages you visit and which features you use, against an anonymous identifier. We also honour your browser's Do Not Track setting.

You can change your mind at any time. There is more detail in our Cookie Policy.

Under the Privacy Act you can ask us for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. You can do both from Settings, and you can email us if you would rather.

Export. Settings has a data export, so you do not have to ask us for the common case.

Delete. You can delete your account from Settings. When you do, we withdraw your bank connection with Akahu first, and if that withdrawal does not succeed we stop and tell you rather than deleting anything. That is deliberate: deleting our copy of the connection without withdrawing it would leave an authorisation alive at Akahu that nobody could ever reach again. Once it is withdrawn, your data is deleted.

Complain. If you are not happy with how we have handled your information, tell us first and we will try to put it right. You can also complain to the Office of the Privacy Commissioner at privacy.org.nz.

If we change this policy we will update the date at the top. If a change materially affects how we handle your information, we will tell you in the app or by email rather than relying on you to notice.