Privacy and your data
A clear view of what you share and what you keep.
Your budgets
Sharing is per budget. Other members can see shared entries and totals in the budget they join. Private-block details are hidden, while their allocations may still affect shared totals. A copy retains the necessary aggregate, not another member’s private details.
Your account
Account details support sign-in, verification, password recovery and budget membership. Newsletter updates are optional. Balance does not link to a bank or initiate transfers.
Account deletion
Deletion removes your profile, email preferences, sessions and verification/reset links. Owned budgets are deleted for all members unless ownership has been transferred and accepted. Private content is removed from joined budgets; ordinary shared entries remain and totals may change.
Backups
Daily backups are kept for 30 days. Protected migration and recovery snapshots are kept separately and may remain longer. Deleted data may remain in those backups; account deletions are reapplied during restoration.
Questions or feedback
Contact [email protected] with questions about your account, privacy or your plan. Please do not send passwords or private financial details.
Payments
Stripe processes subscription payments. Account deletion cancels your Balance subscription but does not erase Stripe payment and invoice records. Contact support for billing questions.
Usage analytics
We use self-hosted Umami to understand visits and use of features such as budget creation and reports. Analytics does not include your email address, budget names, amounts or private link tokens.
Google and Apple sign-in
When enabled, these optional sign-in methods share a provider account identifier and a verified email address with Balance. Google may also supply your name. Apple may supply a private relay email address. We use this information to create or sign in to your Balance account. Your budgets are not sent to Google or Apple.
Existing accounts are connected explicitly in Settings. A short-lived security cookie protects the sign-in process. We retain an encrypted Apple authorization token to revoke the connection when you delete your account. If Apple is unavailable, revocation is retried after deletion; the encrypted token remains only until revocation succeeds. Email and password sign-in remains available.