Security and privacy
Third parties
Every outside service Budget Smugglers uses, and what each one receives.
Budget Smugglers doesn’t sell your data, show ads, or run analytics or tracking scripts. Cookies are only used to keep you signed in and remember your settings.
A handful of services help run the app.
Always#
| Service | What it does | What it receives |
|---|---|---|
| Onidel | Hosts the server in Sydney | Stores the encrypted disk the database lives on |
| Cloudflare | Carries traffic to the website and app; stores backups | Your requests as they pass through, and the encrypted backups, which it can’t open |
| Resend | Delivers our emails | Your email address and the emails we send you (sign-in codes, alerts, reminders you turned on) |
Only if you use them#
| Service | When | What it receives |
|---|---|---|
| You choose “Continue with Google” | Confirms who you are. We get your name, email and picture. Google gets nothing from your budget. | |
| Anthropic | A pool owner turns on AI categorising | The merchant text of transactions that rules couldn’t sort, whether money went in or out, and a rounded amount. Never your name, account names or balances. |
| Your AI assistant | You connect one | Whatever it asks for and you allowed. It’s run by its own provider, under their terms. |
| Yahoo Finance, or EODHD with your own key | You track shares | Only the share codes to price, asked by the server. Nothing about you or your holdings. |
| CoinGecko and Coinbase | You track crypto | Only the coins to price, asked by the server. Nothing about you or your holdings. |
| OpenFreeMap | You open the map | Your browser loads map tiles directly, so it sees which part of the world you’re looking at, and your IP address. Never your transactions. |
Place names on the map come from a copy of the GeoNames database on our own server, so looking up places sends nothing out.
Your bank#
Your bank only ever talks to you. The Sync extension works inside your own browser while you’re logged in, and only sends the downloaded statement to your account.
Data outside Australia#
Your database stays in Sydney. Some of the services above (Cloudflare, Resend, Anthropic, Google) may process what they receive in other countries. The privacy policy covers this formally.