Privacy
What our apps hold, who else is involved, and how to get rid of all of it.
Last updated 27 August 2026.
What FinBeans holds
When you connect a bank, FinBeans stores your account names and types, the last few digits your bank shows, and your balances. It stores your transactions: date, amount, description, merchant and category. If you share investment or borrowing accounts, it stores your holdings and what they cost, and your next payment, due date, interest rate and statement balance.
What it does not hold
Your bank sends more than that. The rest is thrown away as it arrives rather than stored:
- Account and routing numbers
- Property addresses on mortgages
- Loan servicer addresses and guarantors
- Student loan repayment and forgiveness status
None of it is needed to tell you what you owe and when.
Your password
Sign-in is handled by AuthBeans. FinBeans is given a token and never receives your password. Passwords are stored only as an Argon2id hash, which cannot be turned back into the password itself.
Who else is involved
Plaid
Bank connections run through Plaid. You sign in at your bank's own page, so we never see those details. Plaid holds your transaction data as well as us, under their own policy.
Two specifics worth knowing. The small logo beside a transaction is loaded from Plaid by your browser, so they can see that it was asked for. And categorising transactions you typed in or imported yourself means sending the description and amount to Plaid, so that only happens when you press the button that says so.
Account and invitation emails are sent through Resend, who handle your address in order to deliver them.
Nobody else
No advertising, no tracking, and no third-party analytics on this site or in the apps.
Deleting everything
Deleting your account removes the accounts, transactions, holdings, schedules and budgets held for you. It is a real deletion rather than a flag, and it takes the finance data with the identity.
One thing we cannot do for you: some banks keep their own record of the permission you granted. Chase in particular keeps it in the Chase Security Center, and clearing it there is a separate step. Disconnecting in FinBeans revokes our access, which is not quite the same thing.
Where it lives
On servers we rent and run ourselves, in the United States. Data is encrypted in transit, and bank access tokens are encrypted at rest with a key kept apart from the database.
Children
Our apps are not for anyone under 13, and we do not knowingly collect anything from them.
Changes
If what we collect changes, the date above changes and we email account holders to say so.
Asking
Questions, or a request for a copy of what is held about you: [email protected].