Built like the banking apps you already trust.
A tool that reads your spending has to earn that access. Here's exactly what happens to your data — including the parts that aren't flattering.
Bank sign-in happens with Plaid, not with us. Your username and password never touch our servers — we receive a limited token.
The connection can read transactions, balances and — for credit cards — the APR, statement balance and due date. It cannot move money, make payments, or change anything about your account.
Access tokens are AES-256-GCM encrypted before storage, with the key held separately. A database dump yields ciphertext, not access.
We never ask for your Social Security number or card numbers, and nothing here touches your credit report.
Disconnecting deletes the token from our storage and revokes it at Plaid in the same action. Access ends immediately.
No advertising network, no third-party trackers, no data sales. Rankings can't even read which cards pay us — by design.
Bank connections are powered by Plaid — the same infrastructure used by thousands of financial apps, connecting to 12,000+ institutions. You authenticate directly with Plaid; Credit Upside only ever holds a revocable, read-only token. How Plaid itself handles your data: Plaid End User Privacy Policy.
CSV upload is entirely local
When you drop a statement into the app, it's parsed by JavaScript running on your own machine. The file is never uploaded, never transmitted, and never stored on a server. Turn off your network connection after the page loads and it still works.
You can verify this yourself — open your browser's network tab and drop a CSV in. There's no request. We do count whether an import parsed cleanly or dropped most of its rows — that is a single anonymous counter with a name like “csv_lossy” and no payload, so we can tell a broken parser from a quiet day. It carries no merchant, no amount and no row of your file. One honest caveat for PDFs: the first time you drop one, the app fetches the pdf.js parsing library from a CDN (cdnjs.cloudflare.com) so it can read the file. That's the library coming in — your statement still never goes out.
Exactly what a bank connection reads
Two Plaid products, nothing else. Transactions supplies the charges the optimizer scores and the balances shown on each card. Liabilities supplies, for credit cards only, the APR, the latest statement balance and the next due date — that is what powers the annual-fee and payoff screens (whether interest is outrunning rewards, and when a fee posts). Neither product can initiate a payment or transfer, and we never request identity, income, or investment data.
How long we keep things
- Transactions and balances — for as long as the account is linked. Disconnecting deletes them along with the token.
- Sign-in events (the time, whether it succeeded, and the IP address it came from — the record that lets a login that wasn't you be spotted) — 90 days, then deleted.
- Page-view counters — aggregate daily totals per page, with no cookie and no identifier — 13 months, so a year can be compared with the one before it, then deleted.
- Your account — until you delete it. Deletion is one click in Settings, immediate, and removes every row we hold for you.
How your account is protected
Signing in takes two factors, every time: your password plus a single-use 6-digit code emailed to you. A password alone never opens a session — someone who steals it still can't get in without your inbox. The same gate protects signup itself: no account exists until the code emailed to the address is entered, so nobody can create an account with an email that isn't theirs.
You can mark a device as trusted for 30 days to skip the code on your own machines. Changing or resetting your password immediately signs out every other device and forgets every trusted device. Sessions are signed, HTTP-only cookies that expire after 12 hours; sign-in attempts are rate-limited and accounts lock after repeated failures. Our own admin tools sit behind a separate zero-trust identity wall (Cloudflare Access) on top of their own authentication.
How access tokens are stored
The token Plaid issues is encrypted with AES-GCM before it's written to storage, using a key held separately as a server secret. Someone who obtained a dump of the database would get ciphertext, not tokens. This is verified by an automated test that asserts the token is unreadable in storage and that a wrong key yields nothing rather than leaking.
Sessions are signed HTTP-only cookies, sign-in is rate-limited per IP, and every data route rejects requests without a valid session.
Who processes your data
Three service providers, each doing one job: Cloudflare hosts the app and database, Plaid provides read-only bank connections if you choose to link one, and Resend delivers our email (verification codes, sign-in codes, the optional monthly digest). No advertising networks, no data brokers, no analytics vendors. The full list, with what each one sees, is in the privacy policy.
The honest caveats
This is an early product. It hasn't been through a third-party security audit or a SOC 2 examination. If you're deciding whether to link a real account, that's a fair thing to weigh — and CSV upload gives you the full product with none of that risk.
Disconnecting removes the token from our storage and revokes it at Plaid in the same action, so access ends immediately rather than merely being hidden.