Privacy Policy

Last updated: March 16, 2026

BudgetBuddy is committed to protecting your privacy. This policy explains what information we collect, how we use it, and your choices.

1. Information We Collect

• Phone number — collected at sign-up for authentication via SMS one-time passcode.
• Financial data — transaction history, account balances, and institution names retrieved through Plaid when you link a bank account.
• Manually entered data — transactions, amounts, and store names you type or speak into the app.
• Receipt images — photos you upload for receipt scanning. Images are sent to our AI service for analysis and are not stored permanently.
• Usage data — basic app activity logs used to diagnose errors and improve the service.

2. How We Use Your Information

• To authenticate your identity and maintain your account.
• To display your transaction history, spending summaries, and budget progress.
• To classify transactions and generate AI-powered insights.
• To improve the accuracy and reliability of the app.

3. Data Sharing

We do not sell your personal information. We share data only with the following third parties as necessary to operate the service:

• Plaid Technologies, Inc. — to connect your bank accounts. See Plaid's Privacy Policy.
• Anthropic, PBC — receipt images are processed by Anthropic's Claude API for analysis. Anthropic's Privacy Policy applies to this processing.
• Google Cloud — our backend infrastructure runs on Google Cloud Platform. Data is stored in Google Cloud Datastore in the United States.

4. Banking Credentials

We never see or store your bank username or password. Bank account access is managed entirely by Plaid using tokenized credentials.

5. Consent

By creating an account and using BudgetBuddy, you consent to the collection, processing, and storage of your data as described in this policy. When you link a bank account through Plaid, you explicitly authorize BudgetBuddy to retrieve your transaction data for the purpose of budgeting and spending analysis. You may withdraw consent at any time by unlinking your account or deleting your BudgetBuddy account.

6. Data Retention and Deletion

Your data is retained for as long as your account is active. When you delete your account (via the Profile screen in the app or by contacting us), we permanently delete all associated data — including transaction history, spending preferences, and category settings — from our servers within 30 days. Plaid access tokens are revoked immediately upon account deletion or unlinking of a bank account. You may also request deletion of specific data by contacting us at sreehal@ucdavis.edu.

7. Security

We implement the following security measures to protect your data:

• All data in transit is encrypted using HTTPS with TLS 1.2 or higher.
• All data at rest is encrypted via Google Cloud Platform's default encryption (AES-256).
• Plaid access tokens are stored securely and are never exposed to the client application.
• We never store your bank username, password, or login credentials — all bank authentication is handled by Plaid using tokenized credentials.
• User authentication is performed via SMS one-time passcode (multi-factor authentication).
• Access to production infrastructure is restricted to authorized developers with multi-factor authentication enabled.

8. Children's Privacy

BudgetBuddy is not directed at children under 13. We do not knowingly collect personal information from children under 13.

9. Your Rights

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate data.
• Deletion — request deletion of your data, or delete your account directly within the app.
• Portability — request your data in a machine-readable format.
• Revoke consent — unlink your bank account or delete your account at any time.

To exercise any of these rights, contact us at sreehal@ucdavis.edu. We will respond within 30 days.

10. California Privacy Rights (CCPA)

If you are a California resident, you have the right to know what personal information we collect, request deletion of your data, and opt out of the sale of your data. We do not sell personal information. To exercise your rights, contact us at sreehal@ucdavis.edu.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app. Continued use after changes are posted constitutes acceptance.

12. Contact

If you have questions about this Privacy Policy, contact us at sreehal@ucdavis.edu.