Your Security is Our Priority
Your bank login is entered in Plaid's window, not Spendalyst. Here's exactly how your information is handled.
Data Encryption
256-bit AES Encryption
All your data is encrypted using the same standard used by banks and government agencies. This means your information is scrambled into an unreadable format that only authorized systems can decode.
TLS 1.3 in Transit
Every piece of data moving between your device and our servers is protected with the latest Transport Layer Security protocol. This creates a secure tunnel that prevents anyone from intercepting your information.
Encrypted at Rest
When your data is stored on our servers, it remains encrypted. Even if someone gained physical access to our servers, they couldn't read your information without the encryption keys.
Plaid Integration
We partner with Plaid, the industry leader in secure financial data connections. Plaid is trusted by millions of users and powers apps like Venmo, Coinbase, and Robinhood.
We Never See Your Credentials
Your bank username and password are entered directly into Plaid's secure interface. We never have access to your login credentials—not even for a moment.
Read-Only Access
Spendalyst can only view your transaction data. We cannot move money, make payments, or change anything in your bank account. It's like looking through a window—we can see, but we can't touch.
Encrypted, read-only access
Plaid uses 256-bit AES encryption, TLS 1.3 in transit, and read-only access to your accounts. Your bank credentials are never stored on our servers.
Disconnect Anytime
You can disconnect your bank account from Spendalyst at any time, directly from your dashboard. When you disconnect, we stop receiving new data immediately.
About Plaid: Plaid provides the read-only connection between Spendalyst and supported banks and credit unions. Learn more at plaid.com
Privacy Policies
What We Collect
- Transaction data (merchant name, amount, date, category)
- Account balances (to provide accurate insights)
- Email address (for account access and notifications)
What We Never Collect
- ✕Your bank login credentials
- ✕Your Social Security number
- ✕Your account or routing numbers
How We Use Your Data
- To analyze your spending patterns and provide insights
- To detect subscriptions and recurring charges
- To generate personalized recommendations
- To send you weekly insights (if opted in)
- To answer you in the money coach and support chat. Those two features send the spending figures and your question to an AI model provider (via the Lovable AI Gateway, currently Google Gemini models) to write the reply. Your bank login is never sent, and nothing is used for advertising. The providers we rely on today are listed in our Privacy Policy.
What We Never Do
- ✕Sell your data to third parties
- ✕Share your data with advertisers
- ✕Use your data for anything other than helping you
Your Rights
Access Your Data
Request a copy of all the data we have about you at any time.
Delete Your Data
Request complete deletion of your account and all associated data.
Disconnect Anytime
Unlink your bank accounts instantly from your dashboard settings.
Cancel Anytime
No contracts, no hidden fees. Cancel your subscription whenever you want.
Common questions about your data
Can Spendalyst move money out of my bank account?
No. Plaid gives us read-only access. We can see your transactions but we cannot initiate any transfer, payment, or withdrawal. This is enforced at the Plaid layer — even if we wanted to, the technical capability does not exist.
What happens to my data if I delete my account?
Your transactions, findings, profile and Plaid connection are all deleted, and the data is permanently removed within 30 days. We keep only the minimum required for legal and tax records, which is your billing history for seven years.
Does Spendalyst sell my financial data?
Never. Our business model is the subscription. We do not sell or rent your personal financial data, or share it with advertisers or data brokers. Necessary service providers process data as described in our Privacy Policy.
Where is my data stored?
On Supabase infrastructure in the United States, encrypted at rest and in transit. Payment data is handled by Stripe. We do not store credit card numbers on our own servers.
What if there's a data breach?
We follow industry-standard incident response practices. If a breach affects your data, we will notify you by email within 72 hours of discovery, as required by applicable law.
Have Questions?
We're happy to answer any questions about how we protect your data.
Contact Our Security Team