Legal

Privacy Policy

Last updated: July 15, 2026

In My Stash ("In My Stash," "we," "us") is a personal budgeting app. Our core principle: your financial data stays on your device, and we're built so we can't see it.

What we collect

By default, nothing leaves your device. Your balances, transactions, budgets, and settings are stored locally on your device. We operate no server that receives this data in the default configuration.

Optional encrypted backup/sync. If you turn on backup, your data is end-to-end encrypted on your device before it is stored in a location you control. We cannot read it; we do not hold the key.
Optional read-only bank connection. If you connect a bank, a minimal relay obtains a read-only access credential to fetch balances and transactions. It cannot move, send, or withdraw money. Balances and transactions are delivered to your device and stored encrypted there; the relay does not retain your financial data beyond the moment needed to complete a fetch.
No analytics, no advertising, no third-party trackers, and no SDKs that profile you. We do not sell or share your personal information.

Service providers (subprocessors)

Plaid and SimpleFIN — read-only bank data aggregators. You authenticate directly with your bank through their secure flow; In My Stash never sees your bank login credentials.
Cloudflare — hosts the stateless relay. The relay stores only a read-only access token, encrypted at rest, and never stores your transactions or balances.

How we use data

Only to make the app work for you — computing your available balance, holding back upcoming commitments, and answering "stash or spend?". We do not use your data to build advertising or marketing profiles.

Your rights (CCPA/CPRA and other U.S. state privacy laws)

Access / export — export all your data from Settings at any time.
Delete — erase all data from within the app; immediate. Disconnecting a bank revokes the read-only token and deletes its stored record.
No sale or sharing — we do not sell or share personal information; you may contact us to confirm.
We honor these rights for all users regardless of state of residence.

Security

Encryption in transit (TLS 1.2+) and at rest (AES-GCM). The relay stores each user's read-only bank token under a double-encryption envelope and never persists financial data. Optional app lock protects on-device data. See our Security Whitepaper for detail.

Data retention

Financial transactions and balances are not retained on our servers. The relay retains only an encrypted read-only access token while your connection is active; disconnecting deletes it. On-device data is retained until you delete it.

Children

In My Stash is not directed to children under 13 and does not knowingly collect their data.

Not financial advice

In My Stash is a decision tool, not licensed financial advice.

Changes & contact

We will post changes here with a new "last updated" date. Questions: privacy@inmystash.com.