Security and privacy
Who can see your data
Pool members see what their role allows. Admins can't look inside your account unless you give them a Lifeguard pass, and every change is logged.
People in your pools#
Your data belongs to a pool. Whoever you invite sees that pool’s data, as far as their role allows:
| Role | What they can do |
|---|---|
| Owner | Full control, including deleting the pool |
| Admin | Everything except deleting the pool |
| Editor | Manage money data (accounts, imports, budgets, bills), not members or roles |
| Contributor | View, import statements and categorise transactions |
| Viewer | Read-only |
| Kid | Read-only, and only the accounts shared with them |
| Bookkeeper | Manages business accounts; personal accounts stay hidden unless shared |
People in one pool can’t see your other pools.
AI assistants you connect#
An AI assistant you connect sees what you see, read-only or with changes, as you chose. It can’t delete anything, and you can cut it off under Settings › Connections.
Budget Smugglers admins#
Our admins can see account details: your name, email address, and when you last signed in. They can’t see inside your account: no transactions, balances or budgets.
Lifeguard#
If you want help with something, you can let an admin in with a Lifeguard pass, under Settings › Security:
- You choose how long it lasts (an hour, a day or a week) and whether they can only look or can also make changes.
- You’re emailed when they step in.
- Every change they make is marked as theirs in the audit log.
- They can never see or change your password, two-step sign-in, passkeys, API tokens or connected apps, or download or delete your account.
- You can take the pass back any time.
The people who run the server#
The database isn’t end-to-end encrypted, so whoever maintains the server could technically read it. That access is limited to the maintainer, by SSH key, from one address, and is only used to keep the service running. See encryption.
The audit log#
Each pool keeps an audit log of every change: who made it, when, and whether it came from the app, an AI assistant or a Lifeguard visit. Pool owners and admins can read it under Settings › Audit log.