Privacy Policy

Last updated: September 2026

1. Introduction

Money Me ("we", "our", or "us") operates the personal finance management application available at money-me.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are committed to protecting your personal data and your right to privacy. By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

  • Your email address (provided via Google OAuth or email registration)
  • A username, which we generate from the part of your email address before the @
  • Your Google account identifier, if you sign in with Google
  • Account preferences and settings, including your notification choices, currency, date format, theme and time zone
  • Your progress through the in-app onboarding guide

2.2 Financial Data

To provide the Service, we store financial information that you voluntarily enter, including:

  • Bank account names and balances
  • Expense details (names, amounts, categories, and payment schedules)
  • Income records
  • Savings goals and progress
  • Debt and IOU records

This data is stored so that you can see it in the Service. It is also what is used to build your summaries, reminders and notifications (see section 3), and what an AI client can read and change if you connect one (see section 2.6).

We do not connect directly to your bank accounts. All financial data is manually entered by you.

2.3 Authentication Data

We use Google OAuth 2.0 for authentication. When you sign in with Google, Google shares your email address, name and profile picture with us. We store your email address and Google account identifier, and use your email address to create your username; we do not store your name or profile picture. We do not receive or store your Google password. We also offer email and password authentication, in which case your password is hashed (bcrypt) before storage. If you sign up with email, we also store a verification token and, if you request a password reset, a reset token, each with an expiry time.

2.4 Payment Data

Subscription payments are processed by Stripe. When you subscribe, Stripe collects your payment card details directly. We do not store your full card number, CVV, or other sensitive payment information on our servers. We store only:

  • Your Stripe customer ID
  • Subscription status (active, cancelled, etc.)
  • Subscription plan details and billing period

2.5 Automatically Collected Data

When you use the Service, we automatically record on your account:

  • Sign-in and activity information: when you last signed in and were last active, how many times you have signed in, and which recent days you were active
  • Whether you have used our Android app
  • Your time zone, as reported by your browser

We do not use third-party analytics or advertising tools. Where enabled, the sign-in, registration and email-verification pages use Cloudflare Turnstile, a bot check: your browser loads a script from Cloudflare, and we send Cloudflare the check token and your IP address to verify it. Like any web service, our hosting provider (Vercel) and our servers handle your IP address and browser details when you make a request, and we use your IP address in short-lived, in-memory counters to limit abuse of sign-in and similar endpoints. We do not store your IP address on your account.

2.6 Notifications, Devices and AI Connections

  • Push notifications: if you turn them on, we store a push subscription for each browser or device you register (the address supplied by your browser's push service and its encryption keys, plus a short browser identifier and registration times). Notification content is delivered through your browser vendor's push service.
  • Notification history: a log of notifications we have sent you, shown in the in-app notification bell.
  • Emails: we send account emails (verification and password reset) and, unless you switch them off in Settings, notification emails such as a daily summary, a weekly digest, a re-engagement email, a one-off survey and a one-off feedback request. We record when each was sent, and whether your address bounced or was reported as spam so we can stop sending to it.
  • AI assistant (MCP) and widget connections: if you connect an AI client, we store the access codes or OAuth grants you create (a hashed access code, its name and when it was last used, and OAuth client registration details and tokens), and the AI client can read and change the financial data in your account through those tools. What the AI client and its provider do with that data is governed by their own terms and privacy policies, not ours. Home-screen widget pairing works in a similar way. You can remove access codes on the AI page.
  • Contact form: if you use it, we email your name, email address and message to our support inbox. We do not store it in your account.

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the Service
  • Authenticate your identity and manage your account
  • Process subscription payments through Stripe
  • Calculate financial summaries, analytics, and insights
  • Send account emails (verification, password reset) and the reminders, summaries and notification emails described in section 2.6
  • Respond to your enquiries and support requests
  • Detect, prevent, and address technical issues or security threats
  • Comply with legal obligations

4. Data Storage and Security

Your data is stored in Amazon DynamoDB, a managed database service provided by Amazon Web Services (AWS). Data is encrypted at rest and in transit. We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction.

These measures include:

  • Encryption of data at rest (AES-256) and in transit (TLS 1.2+)
  • Secure authentication with bcrypt-hashed passwords and signed, HTTP-only session cookies
  • Server-side input validation and parameterised database queries
  • Access controls limiting data access to authorised processes only

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure.

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your data with:

  • Stripe: For payment processing. Stripe's use of your data is governed by the Stripe Privacy Policy.
  • Amazon Web Services (AWS): For data storage (DynamoDB) and for sending our emails (Amazon SES).
  • Vercel: For application hosting and delivery.
  • Cloudflare (Turnstile): For bot protection on the sign-in, registration and email-verification pages, where enabled. Cloudflare receives a check token and your IP address.
  • Browser push services: If you enable push notifications, notifications are sent through the push service run by your browser or device vendor.
  • AI clients you connect: If you connect an AI assistant, the data it requests is sent to that client at your instruction.
  • Google: For OAuth authentication services. Google's use of your data is governed by the Google Privacy Policy.
  • Legal requirements: If required by law, regulation, or legal process.

6. Cookies

We use cookies to keep you signed in and to secure sign-in, and browser local storage to remember your preferences and dismissed prompts. We do not use advertising or analytics cookies. For detailed information about the cookies we use, please see our Cookie Policy.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, you can delete it yourself in Settings (Profile, then Delete Account). When you confirm, we delete your profile and the data stored against your account in our database, such as your financial data, preferences, push subscriptions and notification history. This cannot be undone. A small number of records are handled separately, as listed below. If you think anything has been missed, contact us at support@money-me.com.

Deleting your account also cancels any paid subscription straight away, with no further charges. Refunds follow our Terms (section 4.5). Some things are not removed by deleting your account. Stripe keeps its own payment records under its own policies. Our email and hosting providers keep their own delivery and request logs. OAuth connections for AI clients and widget pairing codes expire on their own (access after 1 hour, renewal after 30 days, and pairing codes after 5 minutes).

8. Your Rights (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) and UK GDPR:

  • Right of access: You can request a copy of the personal data we hold about you.
  • Right to rectification: You can request that we correct inaccurate or incomplete data.
  • Right to erasure: You can request that we delete your personal data, subject to certain exceptions.
  • Right to restrict processing: You can request that we limit how we use your data.
  • Right to data portability: You can request your data in a structured, commonly used, and machine-readable format.
  • Right to object: You can object to our processing of your data in certain circumstances.
  • Right to withdraw consent: Where we rely on your consent, you can withdraw it at any time.

You can correct most of your data yourself in the Service. Subscribers can download their expenses, income, savings goals and wishlist as CSV files from Settings (Export Data), and anyone can delete their account as described in section 7. For any other request, or to exercise any of these rights, please contact us at support@money-me.com. We will respond to your request within 30 days.

9. Children's Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly.

10. International Data Transfers

Your data may be processed and stored in countries outside of your country of residence, including the United States (where AWS and Vercel operate). Where we transfer data outside the EEA or UK, we rely on the transfer safeguards offered by those providers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this page periodically for any changes.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: support@money-me.com

Website: money-me.com