How Beyond Payday protects your data

Beyond Payday protects your data with a simple starting rule: it never asks for your bank login, so there's no bank password to store or leak in the first place. Beyond that, your connection is encrypted, your family's numbers are walled off from every other family's, Beyond Payday never sells your information, and you can permanently delete everything yourself whenever you want.

How it works

• No bank credentials, ever. You type your numbers in yourself. Beyond Payday has no bank-linking feature, so there's no bank username or password for it to store in the first place.
• Encrypted connection. Every connection to Beyond Payday is encrypted with HTTPS/TLS, the standard secure-connection technology used across the web — the padlock-in-the-address-bar protection you'd expect from any reputable site.
• Your family's data is walled off. Behind the scenes, Beyond Payday's database checks who's asking before returning any information, so your family's numbers stay separate from every other family's account. Staff always see account and billing metadata, never your actual figures, unless you approve a named, time-limited support access grant — see Grant staff temporary access to your numbers.
• No selling your data. Beyond Payday doesn't sell your personal information to advertisers, data brokers, or anyone else.
• You can take your data with you. The Your Data card in Settings (opens in a new tab) has a Download my data button that saves everything your family entered as a .zip — a full JSON copy plus a CSV for each type of data, free on every plan.
• You control deletion. The account owner can permanently delete the account from Settings, using a typed confirmation. This removes your financial data, family memberships, and login — for good.
• The browser extension is kept to a minimum. If you connect the Beyond Payday browser extension, it receives your hourly pay and retirement assumptions and nothing else, and the prices it reads never leave your browser. See Use the browser extension while you shop.

An example with real numbers

Say you add a savings account as an asset. That number travels from your browser to Beyond Payday over an encrypted connection, then gets saved under your family's account in Beyond Payday's database. Household access follows your family's sharing permissions. Staff can see that a savings account exists as part of account-level and billing metadata, but not its balance, unless you approve a support access grant. Child accounts can see only assets assigned to them, including joint assets. It's never sent to a bank, and it's never sold.

If you're on Pro and ask Beth a question like "what's my net worth?", Beyond Payday sends the relevant numbers to Anthropic, the company that powers the AI, so it can generate an answer. Anthropic's terms say this data isn't used to train their models, but it does get transmitted to answer your question. The same goes for any outside AI assistant you choose to connect through AI Connections: what it reads goes to that assistant's company, under its own terms — see Is it safe to connect an AI assistant?. Service providers also process data to host and operate Beyond Payday. The security page (opens in a new tab) and privacy policy (opens in a new tab) explain these uses and access in more detail.

Assumptions and limits

• Not end-to-end encrypted. Your connection to Beyond Payday is encrypted, and data at rest is protected by our hosting providers' standard security — but this isn't end-to-end encryption. Beyond Payday's own systems can technically access account data, for example to provide support.
• Deletion is owner-only. Only the account owner can permanently delete the whole account. Other family members can be removed individually, but can't trigger a full account deletion.
• Some billing records are kept longer. After you delete your account, Beyond Payday retains some billing-related records, like your email for invoice history, for up to 7 years for tax and accounting purposes — separate from your financial data, which is deleted immediately.