Privacy policy
Last updated 3 October 2026
Budget Smugglers is a budgeting app. This policy explains what information we collect when you use the website at budgetsmugglers.app and the app at my.budgetsmugglers.app, what we do with it, and the choices you have. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
The short version: your financial data is yours. We use it to run the app for you. We don't sell it, we don't use it for advertising, and we don't share it except with the services that help us run the app.
What we collect
- Waiting list. Your email address, plus your first name and bank if you choose to give them.
- Your account. Your name, email address and password (stored only as a secure hash). If you sign in with Google, we receive your name, email address and profile picture from Google.
- Your financial data. Whatever you put into the app: accounts, transactions and statements you import, categories, rules, budgets, goals, bills, loans and savings details.
- Security and sign-in information. Sessions, two-step sign-in and passkey settings, and the IP address and browser of each sign-in, so we can warn you about sign-ins you don't recognise.
- Activity. An audit log of changes made in each pool, and a record of emails we've sent you (not their contents).
We never ask for or store your bank's login details. The optional browser extension runs in your own browser while you're logged in to your bank, downloads your statement, and sends only that statement to your account.
How we use it
- To run the app: show your budgets, categorise transactions, forecast bills and so on.
- To keep your account secure, including sign-in alerts and two-step sign-in.
- To email you: your waiting-list invite, password resets, security alerts, and any reminders or digests you switch on.
- To fix problems and keep the service running.
Google user data
If you choose "Continue with Google", we receive your name, email address and profile picture. We use them only to create your account, sign you in, and show your name and picture in the app. If you sign in with Google without an invite, we use your name and email address to put you on the waiting list. We don't request access to your Gmail, Drive, contacts or any other Google data, and we don't share Google user data with anyone or use it for advertising. Our use of information received from Google APIs adheres to theGoogle API Services User Data Policy, including the Limited Use requirements. You can disconnect Google from your account under Settings › Security, or remove our access from your Google Account.
Who we share it with
We use a small number of providers to run the service. They only process data on our behalf:
- Cloudflare, which carries traffic to the website and app.
- Resend, which delivers our emails.
- Google, only if you choose to sign in with Google.
- Anthropic, only if AI categorisation is switched on for your pool. It receives merchant text, whether money went in or out, and a rounded amount, never your name or account details.
If you connect an AI assistant such as Claude to your account, it can read (and, if you allow it, change) your data through the access you grant. That assistant is run by its own provider under their terms, and you can revoke its access at any time under Settings › Connections.
The people you share a pool with can see that pool's data, as controlled by their role. We'll also disclose information if the law requires it.
Some providers may process data outside Australia. We choose providers that protect it to a standard comparable to Australian law.
Admin access
Our admins can see account details such as your name, email address and when you last signed in. They can't see inside your account unless you give them a lifeguard pass under Settings › Security. You choose how long it lasts and whether they can make changes, you're emailed when it's used, and you can revoke it at any time.
Cookies
We use cookies only to keep you signed in and to remember your settings, such as light or dark mode. We don't use advertising or tracking cookies, and the website has no third-party analytics.
How long we keep it
We keep your data while you have an account. If you ask us to delete your account, we delete it along with any pools only you use; pools you share stay with their other members. Waiting-list entries are kept until you're invited, join, or ask us to remove you. Backups are overwritten on a rolling basis.
Security
Data travels over HTTPS. Passwords are hashed, and two-step sign-in and passkeys are available. No system is perfectly secure, but we work to protect your information and will tell you if a breach is likely to cause you serious harm.
Your choices
- Ask for a copy of your information, or ask us to correct it.
- Ask us to delete your account or remove you from the waiting list.
- Switch off optional emails under Settings › Notifications, or with the unsubscribe link in them.
Email [email protected] for any of these. If you're not happy with how we've handled a privacy concern, you can contact theOffice of the Australian Information Commissioner.
Changes
If we change this policy, we'll update the date at the top. For significant changes, we'll let account holders know by email.
Contact
Questions? Email [email protected].