Introduction

Beyond Payday is operated by HTMLGuy LLC, doing business as Beyond Payday (formerly PiggySize; "we", "our", or "us"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

Information We Collect

We collect information that you provide directly to us, including:

Account Information: Name, email address, and authentication credentials
Financial Data: Income, expenses, bills, assets, debts (including student-loan type, repayment plan and Public Service Loan Forgiveness progress you enter), and retirement planning information you choose to track
Investment Holdings, Insurance and Tax Facts: These are optional. If you add them, we store what an investment account holds (fund or stock names and ticker symbols, share counts, prices, values, cost basis and dates), whether you type them in or import them from a spreadsheet; insurance policy details, including flood, long-term care and condo policies (who is covered, the coverage amount, deductibles and liability limits — for auto, the per-person, per-accident and property damage limits and the collision and comprehensive deductibles — belongings coverage, a hurricane or wind deductible percentage, for disability and long-term care whether it is short- or long-term, the waiting period and how long it pays, any loan against the policy, which of your properties a home, condo or flood policy covers, the term, end, renewal and review dates, whether the policy comes through work, and any beneficiary note you type); equity compensation grants (grant type and date, share counts, prices and vesting schedule, the purchase price and date of employee stock purchase plan shares, how many shares were sold, moved, withheld for tax or exercised, and whether shares pay out only if the company goes public or is sold); and household tax facts (filing status, state, a state tax rate if you enter one, how many children under 17 and other dependents you have — counts only, never their names or birthdays — your deduction choice, any other taxable income you enter and any pre-tax savings you make outside your paycheck). A beneficiary note is free text, so include only what you want us to keep. Insurance premiums stay with your bills or the paycheck deductions they come out of, and holdings and grants never change an account's value on their own. You can also mark a retirement distribution as Roth and link a paycheck deduction, such as an employee stock purchase plan contribution, to the account it pays into. We never ask for diagnoses, conditions or treatment. Some things you choose to track can still hint at health matters: a medical debt and the name you give it, health, dental or vision insurance and other health-related paycheck deductions, which family members a health savings account covers, and disability or long-term care policy facts. Type only what you want us to keep — for example, call a medical debt "Hospital bill" rather than naming a condition or provider. Children with their own login never see the household tax facts.
Quiz Responses: If you complete our plan recommendation quiz, we record your answers so we can improve our recommendations and understand which features matter most. This happens when you finish the quiz, whether or not you create an account. The quiz is multiple choice: we store only the answers you picked, the plan we recommended and which version of the quiz you took. It contains no financial information and no free text. If you do not have an account, we store nothing alongside your answers that identifies you: no name, no email address, no IP address and no tracking identifier. If you go on to create an account in the same browsing session, we attach those existing answers to your account rather than storing a second copy, and they are deleted along with everything else when you delete your account.
Usage Data: Information about how you interact with our service, including pages visited and features used
Device Information: IP address, browser type, and device identifiers. When you create your account, we also record the IP address you signed up from and an approximate location derived from it by our hosting provider, and your device's timezone (e.g. Eastern, Central, Mountain, Pacific), used to show dates, times, and reminders correctly for your location.
How You Found Us: When you first visit our site, we record the website that sent you (only its domain name, such as google.com or chatgpt.com, never the full web address), any campaign tags in the link you followed (utm_source, utm_medium and utm_campaign), the page you landed on, and when you arrived. If you create an account, we save this with your account. After you sign up, we may also ask you once how you heard about Beyond Payday. Answering is optional, and if you answer we save your choice and any words you type for "Other". We use this only to understand how people find us; we do not share it with advertisers or anyone else. If you press Decline in our cookie banner, or your browser sends a Global Privacy Control signal, before you sign up, we do not record the website that sent you. You can still answer the question if you like.
Mobile App Information: If you use our iOS or Android app and turn on push notifications, we store a notification token for that device, the platform (iOS or Android), the app version, and when the device was last seen. See the Mobile Apps section below.
Cookies and Tracking: We use cookies and similar technologies (like local storage) to maintain your session and remember your preferences.
Family Account Data: Information related to family accounts and shared access permissions, including the family member details (such as names and birthdays) that the account owner enters
Paystub Images: If you use the paystub scanner, the image you upload is processed in memory to read the numbers and is never stored on our servers (see the AI Assistant section below)
Support & Contact Data: If you contact us through our contact form (or ask our AI assistant to file a support ticket for you), we store your name, email address, and message so we can respond. See Data Retention below for how long we keep these and what we remove afterwards
Emails We Send You: We save a copy of each email we send you, along with the address it went to and whether it was delivered, so we can troubleshoot delivery problems. Because the copy is the message itself, it includes whatever was in it — for example the name and amount of a bill in a reminder. See Data Retention below for how long we keep these and what we remove afterwards.
Partner Program Data: If you join our partner program, we store your referral code, referral activity, and commission records
Import Records: When you use Import data, your spreadsheet is read in your browser. We do not upload or keep the file itself. Once you review the preview and confirm which rows to add, we save those rows as ordinary bills, assets, debts or investment holdings. We also keep a small record of the import — your account and household identifiers, what you imported into, when, which source row each record came from, the identifiers of the records it created, and fingerprints of their values — so a retry cannot save the same row twice and so you can undo the import later. That record does not contain a copy of your spreadsheet, and it is deleted when your account or household is deleted. We also keep counts describing how the import went, such as how many rows were ready and how many needed correcting, to improve the importer; those counts contain no spreadsheet content, column headings or file names.
AI Assistant Data: Conversations with our Beth AI assistant, including your questions, AI responses, and related usage metrics (see AI Assistant section below)
Login & Security Information: Sign-in history (date and time, IP address, approximate location, device/browser, and sign-in method) and, if you enable two-factor authentication, your authenticator (TOTP) enrollment and one-way-hashed backup codes (see Login & Security Information section below)
Browser Extension Data: If you install our optional browser extension and connect it to your account, we store a record of that connection — a device label you choose (for example, "Chrome on my laptop"), the dates it was created and last used, and a one-way cryptographic hash of its access token. The token itself is shown to you once and cannot be recovered by us. We do not receive the websites you visit or the products you view (see the Browser Extension section below).

How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our financial tracking and retirement planning services
Process your financial data and generate insights and calculations
Enable family account features and manage shared access permissions
Send you technical notices, updates, and support messages
Send you security alerts when something important changes on your account (for example, a sign-in from a new device or location, a password change, or a change to your two-factor authentication settings)
Send optional reminders that you choose to turn on, such as bill due dates, a monthly check-in, or an annual plan checkup — these are off unless you enable them, and every reminder email includes an unsubscribe link
Send automated notifications regarding free trial status and expiration
Send up to two reminder emails, about an hour and about a day after you sign up, if you haven't verified your email address yet. Each includes a new verification code and an unsubscribe link
Send up to three reminder emails in your first nine days if you haven't finished setting up your household: about a day after you sign up if you haven't added any numbers, around day three if you've added income but no bills, and around day seven if setup still isn't finished. Each links to setup and includes an unsubscribe link, and they stop once setup is done or you unsubscribe
Respond to your comments, questions, and requests
Monitor and analyze usage patterns to improve our service
Detect, prevent, and address technical issues and security threats
Block IP addresses linked to abuse, fraud, or attacks: we keep a list of blocked addresses, each with a reason and an optional expiry date, and check it when someone signs up, signs in with Google or Apple, or submits a form on our site

AI Assistant (Beth)

Our AI assistant feature ("Beth") uses artificial intelligence to help you understand your finances. When you use Beth:

What We Collect: We store your conversation messages (your questions and the AI's responses), the page you were on when chatting, tool interactions (such as calculations performed), and usage metrics (message counts, response times, token usage).
How It Works: Your messages, along with the relevant financial figures needed to answer them, are sent to Anthropic's Claude AI model for processing. Anthropic processes this data according to their own privacy policy. We recommend reviewing Anthropic's Privacy Policy for details on how they handle data.
Paystub Scanner: If you scan a paystub, the image you upload is sent to Anthropic's Claude to read the numbers, processed in memory, and never stored on our servers — we keep only the figures you choose to save. The scanner is available on every plan; Free accounts include a limited number of scans.
Save Money Tips: To show tips that fit each bill, the Save money page first matches bills to a tip type using the bill's name. For bills it can't match on its own, it sends only the bill name and its category to Anthropic's Claude, which picks one of our pre-written tip types. We don't send amounts, account details, or your name or email, and we store only the chosen tip type. Household members who don't have access to AI features never trigger this, and anyone who can edit bills can change a bill's tip type.
Bill Category Suggestions: In quick setup, whenever you run it, if you choose to let Beth sort your bills, the names of your household's bills that have no category are sent to Anthropic's Claude to suggest a category. Bill amounts and other account details are not sent. Children's accounts never send data to AI.
Import Column Suggestions: When you import a spreadsheet, you can ask AI to suggest which of your columns match Beyond Payday fields. We show you the exact column headings first and send them to Anthropic's Claude only after you agree. We never send the file, the rows inside it, or your account or household identifiers, and a suggestion changes nothing until you review it and choose to apply it. Column headings are written by you, so check them before you agree — a heading can contain personal information. You can always match columns yourself, and matching them yourself never involves AI.
Changes Beth Proposes: Beth is read-only by default. If the owner or spouse on your household turns on Read & write, Beth can propose changes to your household's records, such as adding, editing or deleting a bill, changing your SHTF plan, or creating a what-if scenario. Nothing changes until you confirm it, and a proposal you don't confirm expires after 15 minutes. When Beth proposes a change we store the proposal: the records it would change, their values before and after, the effect on your totals, and what happened to it (for example confirmed, cancelled, expired or undone). For each change you confirm or undo we keep a record of what changed, who did it and when, so a change can be undone for 24 hours and so we can look into problems you report. For a change to your SHTF plan or a what-if scenario, that record includes a copy of the whole plan or scenario as it was before the change. Before deleting something or changing several records at once, Beth asks you to double-check in the chat, and we keep a short record of that check: the kind of change, how many records, and when, but not the values. We also record when the Read-only / Read & write setting is changed and by whom. We keep all of these records for 90 days and then delete them. If your household's account is deleted, they are deleted with it right away. If you delete your own account while your household's account stays open, the proposals and checks you made are deleted right away, and the household's record of changes you confirmed stays, no longer linked to you, until it is 90 days old. Our staff can see that a change was made, when, and what kind of change it was, but can see what was changed only if your household's account owner approves a time-limited support access request.
Quality and Safety: Our team may review AI chat conversations for quality assurance, safety monitoring, abuse prevention, and to refine how the assistant responds. Your conversations are never used to train the underlying AI model.
Data Retention: Chat history is retained for the life of your account and is permanently deleted when you delete your account.
Local Storage: Chat history is also cached in your browser's local storage for your convenience. You can clear this at any time through your browser settings or within the chat interface.
Rate Limits: We track daily message counts per user to enforce usage limits.

Login & Security Information

To help you monitor access to your account and to protect it from unauthorized use, we collect information related to sign-ins and, if you choose to enable them, two-factor authentication features.

Sign-In History: Each time you sign in, we record the date and time, the IP address the sign-in came from, an approximate location (city, region, and country) derived from that IP address, a summary of your device and browser, and the method used to sign in (for example, password, a connected account like Google or Apple, passkey, or two-factor authentication).
Retention: We retain a rolling history of your most recent 50 sign-ins so you can review recent account activity. As new sign-ins are recorded, the oldest entries beyond the most recent 50 are automatically removed.
Two-Factor Authentication (2FA): If you enable two-factor authentication, we store the information needed to verify future sign-ins, such as your authenticator app (TOTP). If you generate backup codes, we store them only as one-way cryptographic hashes; the codes themselves are shown to you once and cannot be recovered by us.
Passkeys: If you set up a passkey to sign in, we store the passkey's public credential and related metadata — a device label (for example, "MacBook" or "YubiKey") and the dates it was created and last used — so you can sign in without entering a password. The passkey's private key stays on your device: it is never sent to us and we never store it.
Why We Collect This: We use this information to secure your account, let you review your own sign-in activity, and detect and prevent unauthorized access. It is handled under the same data sharing and security practices described elsewhere in this policy.

Browser Extension

We offer an optional browser extension that shows what a price costs in hours of your work while you shop. It is not required to use Beyond Payday, it does nothing until you install it yourself, and it communicates only with Beyond Payday — it does not send your information to any third party.

Where it runs: Only on online shopping sites we have built support for — major retailers such as Amazon, eBay, Best Buy, Walmart, and Target. It never runs on any other website. We expect to add retailers over time, so rather than freeze a list here: the sites the extension can read are always the ones listed in your browser's own permissions for it, and your browser asks you to approve any site we add before the extension can read it there. On a supported page it looks only for the product's price and a place to show its badge.
What stays on your device: The price it reads, and the page you are on, never leave your browser. We do not receive the sites you visit, the pages you view, the products you look at, or the prices it reads. The calculation happens entirely on your own device.
What we send to it: If you connect the extension to your account, we send only the figures the calculation needs: your after-tax and gross hourly pay, your daily take-home, and your retirement assumptions — the growth rate you use, your target retirement age, and how many years you have until it. We do not send account balances, bills, debts, goals, family information, or your name or email. Child accounts receive only the hourly figures, never the household's retirement assumptions.
What is stored on your device: Those figures are cached in the browser's extension storage on your own device — never synced to your browser account — for up to 24 hours, alongside the extension's access token, the list of supported shopping sites it downloads (described below), and any sites you have switched the badge off for. Disconnecting or uninstalling the extension clears them.
What we can see: When the cached figures are more than a day old, the extension asks our server for fresh ones. That request carries only its access token — no site, page, or price — and creates the same kind of record as any other visit (IP address and time), plus the "last used" date on the connection. Because that refresh happens only while you are on one of the supported shopping sites, it can tell us you used the extension that day, but not where.
Checking which stores it supports: Separately from the refresh above, the extension periodically downloads the current list of shopping sites it supports and where to find the price on each one, so that a site we have fixed or newly added starts working without you having to reinstall anything. That request is anonymous: it carries no access token and nothing that identifies you or your account, it is not tied to your connection, and every copy of the extension receives the same file. It tells us nothing about where you shop — we cannot tell from it which sites you visit, or whether you visited a shopping site at all. As with any request to a website, our server records the IP address it came from and the time.
Turning it off: You can disconnect the extension at any time from Settings, which permanently revokes its access token, and you can remove the extension from your browser like any other. You can also switch the badge off for individual sites from within the extension itself.

Connecting an Outside AI App

You can connect an outside AI app — such as ChatGPT, Claude, Claude Code, or another tool that speaks the Model Context Protocol — to your Beyond Payday account. This is separate from Beth, our own assistant described above: Beth is run by us, while an app you connect is run by the company that makes it. Nothing is connected unless you set it up yourself: the app sends you to a Beyond Payday consent screen where you sign in and choose what it may do.

Read-only lets it see the same financial details you can see in Beyond Payday: your income and take-home pay, paycheck deductions, bills, assets and accounts, investment holdings, stock grants, insurance policy details (never a policy's beneficiary note), debts (including student-loan details), goals, businesses and business expenses, household tax facts, what-if scenarios, cash flow, net worth and its history, your SHTF plan, Save money tips and Social Security claiming comparisons. It can also see your name, your role in the family, your family's name, your time zone, and the names and relationships of the family members you are allowed to see. This does not include anyone's email address or full birthday; a Social Security claiming comparison shows the person's birth year. Read & write also lets it add, edit and delete bills, income and paycheck deductions, assets (including investment holdings, stock grants and insurance policy details), debts (including student-loan details) and goals; log goal contributions; change your household tax facts; add and edit businesses; change your SHTF plan; and create, change or delete what-if scenarios, so a tool with write access can change your real data, and its mistakes are changes to your real data. Read-only is pre-selected, so write access is a choice you have to make on purpose, and our separate read-only connector address never offers any write tools, whatever access was approved. Child logins (ages 13–17) cannot connect an outside AI app.

We do not vet these apps. Any developer can register one to connect, and we do not review, approve, endorse or audit them. Once you approve, your data goes straight to that app, and what happens to it there is governed by that company's privacy policy, not this one — we cannot see what the app does with your data afterwards and we are not responsible for how it handles it. Read its policy before you approve, and only connect an app you trust. On our side we record only which app called which feature and when, never the questions you asked or the answers it received, and every financial answer carries a note that the figures are estimates from your own data and not financial, tax or legal advice.

You can cut off a connection at any time from Settings → AI Connections, which revokes the app's access immediately, and deleting your account disconnects everything. Disconnecting stops future access; it does not reach back and delete data the app already received — only that company can do that, so ask them directly. Expired tokens and app registrations that were never used are deleted automatically after 30 days. Because these transfers happen at your direction, they are not a sale of your personal information and not "sharing" for cross-context behavioral advertising.

Analytics

We use Google Analytics to understand how visitors engage with our site. This helps us improve our service. Google Analytics uses cookies to track your interactions. The information collected is used to generate reports about website usage. You can decline analytics cookies at any time, either with the Decline button in our cookie banner or with the Analytics cookies switch in Settings → Privacy; both turn Google Analytics off on that device. Our mobile apps do not show the cookie banner, so Settings → Privacy is where you make that choice there. You can also opt out by installing the Google Analytics Opt-out Browser Add-on. Ad-personalization signals in Google Analytics are disabled.

Visit counts without cookies: We also count page visits in a way that uses no cookies and stores nothing on your device, so it keeps working if you turn analytics cookies off. For each visit we keep the page, the site or campaign link that sent you, your approximate region, and your device and browser type — never your IP address — and we can't link a visit to you or your account. Browsers that send Global Privacy Control or Do Not Track, and child logins, aren't counted at all. Individual visit records are deleted after 30 days; only daily totals are kept.

Advertising Measurement

We advertise Beyond Payday on third-party platforms, including ChatGPT (operated by OpenAI). To know whether those ads actually work, we use OpenAI's measurement pixel and conversion reporting:

Ad-click identifier: If you arrive at our site after clicking one of our ads, the pixel stores a privacy-preserving click identifier in a first-party cookie on your browser.
Conversion reports: When you create an account, we report a "registration completed" event to OpenAI. That report may include the click identifier, a one-way (SHA-256) hash of your email address, a one-way hash of your account identifier, your IP address, and your browser's user-agent string.
What it never includes: your name or email address in readable form, your password, or any of your financial data.
What it is for: measuring that an ad led to a signup so we can pay for ads based on results. We do not use it to build advertising profiles of you, and we do not show you targeted ads.
Your choice: pressing Decline in our cookie banner, or turning off Analytics cookies in Settings → Privacy, turns ad measurement off on that device, including the conversion report.
Not in our mobile apps: the measurement pixel does not run in our iOS and Android apps, and we never report an app sign-up to an advertising platform.
OpenAI processes this data under its own policies; see OpenAI's Privacy Policy.

Learning Center

Our Learning Center has free money lessons for every age at beyondpayday.com/learn. Lessons teach how money works; they are not financial advice.

Playing as a guest: You don't need an account. A guest's progress is kept only in the open browser tab and is gone when the tab closes. If you tell us you are 18 or older and start creating an account, we also keep the list of lessons you finished on that device for up to 2 hours, so they can be saved to your new account even if signing up opens a new tab. That copy is cleared once it is saved or when you sign out. Nothing that identifies a guest is sent to us unless it is saved to an account (see Anonymous lesson counts and Analytics and advertising below).
With an account: We save which lessons you finished, your stars and best quiz score, and the certificates you earn. Adults 18 and older get certificates with a verify link. A verify page shows the name on the certificate, what was finished and the date to anyone who has the link, so share it only with people you choose. You can change the name on a certificate or remove it in Learn; a removed certificate's link stops working.
Anonymous lesson counts: We count how many lessons are started and finished each day. These counts hold no IP address, device details, cookie or account, so they can't be linked to you or your child.
Analytics and advertising: The OpenAI advertising measurement pixel never loads on public Learning Center pages. Kids' lessons, our teen lessons (Real World Ready), lessons on sensitive topics, the age question and the grown-up hand-off page load no Google Analytics, no advertising pixel and no attribution cookies. Other public lesson pages use Google Analytics under the cookie choices described in the Analytics section. Lessons inside a signed-in account follow the app's normal analytics rules, which never apply to anyone under 18.
Kids' lessons: Kids' lessons need no sign-up and never ask a child for personal information. A grown-up can type a name on the award to print or save it; the name stays on that device and is never sent to us. Our kids' privacy notice explains them in full.

Data Storage and Security

We implement appropriate technical and organizational measures to protect your personal information, including encryption of data in transit (TLS/HTTPS) and at rest, database row-level security that isolates each family's records, and secure authentication options including two-factor authentication. However, no method of transmission is 100% secure.

Who at Beyond Payday Can See Your Data

By default, our staff can see your account and billing details — your plan, your household members and their permissions, your invoices, and whether a feature errored — along with usage statistics that are aggregated across accounts and are not tied back to you. That is what we use to run the service, answer billing questions, and decide what to build.

By default our staff cannot see your actual financial figures. Where household content is visible to staff in our internal tools, such as your conversations with the Beth AI assistant, every amount, percentage, email address and phone number is removed on our servers before the content is displayed. Staff see the wording of a conversation, not the numbers in it.

If you ask for hands-on help and we need to see your real data to give it, a named member of staff must request access to your household and give a written reason. Only the account owner can approve that request, and the owner chooses how long it lasts — from one hour up to three days. The owner can refuse the request, can end an approved one at any time, and it expires on its own with no action needed. We email the owner when access is requested and again when it is approved. Every request, decision and use is recorded, and the owner can read that record at any time in Settings → Privacy.

While access is approved, that staff member can also download a copy of your household's data to work on the problem. Each download appears in the access record the owner can read, and is also recorded in our internal staff activity log, along with other actions our staff take on your account, such as issuing a refund or a credit.

Two honest limits. First, this governs our internal tools; the people who administer our databases and the infrastructure providers listed below necessarily retain technical access to the systems your data sits on, which is why we vet them and keep the list short. Second, we may access account content without a grant where the law requires it, or where we must to investigate abuse, fraud or a threat to someone's safety — and those accesses are logged in the same way.

Data Sharing and Disclosure

We do not sell your personal information, and we do not share your financial information with advertisers or data brokers. When advertising measurement is turned on, the OpenAI measurement pixel described in the Advertising Measurement section may be considered "sharing" for cross-context behavioral advertising under California law; you can opt out as described in the State-Specific Privacy Rights section. We share information only in these limited ways: with your consent; to provide the family-account features you use; when required by law; to an outside AI app you connect and approve yourself (see Connecting an Outside AI App); and with the trusted service providers ("subprocessors") that operate Beyond Payday on our behalf. Each subprocessor receives only the information it needs for its role:

Supabase — database hosting and account authentication.
Vercel — application hosting, automated bot/abuse protection, and the IP-based approximate location used for sign-in history.
Stripe — subscription billing and payment processing.
Anthropic — powers the Beth AI assistant, the paystub scanner, Save money tip matching, optional import column suggestions, and suggesting a bill category during quick setup; receives the financial figures, paystub image, bill names and categories, or spreadsheet column headings needed for that feature, and only when you use those features. Anthropic's commercial API terms prohibit using this data to train its models.
OpenAI — ad-conversion measurement for the ads we run on ChatGPT; receives only the signup conversion report described in the Advertising Measurement section above, and never your name in readable form or any of your financial data.
Apple — delivers push notifications to iPhone, iPad, and Mac through the Apple Push Notification service; receives the device token and the text of the notification.
Google Firebase Cloud Messaging — delivers push notifications to Android devices; receives the device token and the text of the notification.
Mailgun — sends our transactional email (verification, receipts, security alerts, reminders, invitations, and support messages).
Google Analytics — aggregate website-usage analytics.
Upstash — rate limiting that stops password guessing, spam, and other abuse; receives short-lived counters keyed by IP address or account ID, which expire automatically.
Google reCAPTCHA — spam and bot protection on our public contact form.

If you choose to sign in with Google or Apple, that company confirms who you are and shares the name and email address you allow it to. It is not a subprocessor and receives none of your financial data.

An app you connect yourself is not a subprocessor: it acts for you, not for us, and receives whatever access level you chose. Beyond the service providers and sign-in companies described above, no other outside app receives your data unless you connect and approve it yourself — see Connecting an Outside AI App above.

Your Rights and Choices

You have the right to access, correct, delete, and export your personal information. You can download a copy of the records your family has entered into Beyond Payday from Settings → Your Data, and the account owner can permanently delete the account and its active personal and financial data from Settings; limited records may remain as described in Data Retention below — deletion is permanent and cannot be undone. Deleting your account also clears the email log at the same time: for every email we sent to your account or your email address, the saved copy is erased and the address and subject line are replaced with "[removed]", leaving only an unnamed record that a message was sent and delivered. Deleting your account removes your data from Beyond Payday and cuts off any connected outside AI app; it cannot delete copies an app already received. You also decide whether our staff may see your actual financial figures: support access must be requested by a named person, can only be approved by the account owner, lasts no longer than the owner chooses, can be withdrawn at any time, and is recorded in an access log the owner can read in Settings → Privacy. Refusing a request does not affect your account or your plan. If you are unable to use these self-serve tools, or you need help exercising any of these rights, contact us and we will assist you. You can also opt out of non-essential communications at any time. You can see every outside AI app connected to your account, and cut any of them off, at Settings → AI Connections.

Data Retention

We retain your personal information for as long as necessary to provide our services. If no one in a household has signed in for 12 months, we may close the household's account and permanently delete its data. Before we do, we email every member with a confirmed email address 30 days ahead and again 7, 3, 2 and 1 days ahead, and signing in once keeps the account open. Households on a paid plan or in a free trial are never closed this way. Upon account deletion, we delete or anonymize your information, with a few limited exceptions:

Billing records: Invoice history may be retained for up to 7 years for tax compliance, with personal identifiers snapshotted.
Operational and security logs: Retained in de-identified form (they are disconnected from your identity when your account is deleted).
Staff activity log: Our record of the actions staff take in our internal tools, such as a refund or a data download, is kept as a security record and is not automatically deleted.
Payment and system job records: We keep a short record of each notification from our payment processor (which event it was and whether we handled it, not its contents) for 90 days, and a record of each run of our scheduled background jobs for 30 days. Both are then deleted automatically.
AI suggestion limits: If you use optional import column suggestions, we keep a small record of each request — account, household and request identifiers, a fingerprint of the column headings, the cost we set aside, and the time. It never holds the headings themselves, your spreadsheet values, or the AI's response. These identifiers and fingerprints are pseudonymous rather than anonymous. This record is kept even if the account is deleted, so that deleting an account cannot reset our spending limits, and it is removed on the first daily cleanup after 90 days.
Beth change records: The proposals, change records and double-checks described under AI Assistant (Beth) are deleted 90 days after they are made, or right away when your household's account is deleted.
Partner commission records: If you signed up through a partner's referral link, the email address on that referral record is retained to preserve the accuracy of commission records.
Email log: When we send you an email — a bill reminder, a receipt, a verification link — we save a copy of it so we can troubleshoot delivery problems and answer questions about what we sent. Because the copy is the message itself, it contains whatever was in it, such as the name and amount of a bill. We automatically erase that copy after 90 days. What remains is the outline of the send: the address we sent to, the subject line, whether it was delivered, and when. For an account that remains open, we keep the address and subject line for up to 24 months and then replace them with "[removed]". If you delete your account first, we replace these fields with "[removed]" immediately; the unnamed delivery record stays so we can see whether our email is reaching people. We do not track whether you open our emails or click links in them.
Browser extension connections: When you disconnect an extension we keep its record, marked as revoked, so you can still see that it existed and when its access ended. It is deleted when you delete your account.
Outside AI app connections: we keep the record of which apps you connected, what access you granted, and when they were used while the connection is active; expired tokens and unused app registrations are deleted automatically after 30 days, and disconnecting or deleting your account revokes access immediately.
Support and contact messages: Messages you send us through the contact form, or that our AI assistant files on your behalf, are kept for 24 months so we can handle the request, follow up on it, and resolve any dispute about it. Anyone can use the contact form, including people who do not have an account, so these messages are kept separately from your account data and deleting your account does not remove them. After 24 months we automatically strip out the personal details: your name and email address are removed, the message is unlinked from your account, and any email addresses, phone numbers and links inside the message text are replaced. What remains is the category and the wording of the problem, which we use to spot recurring issues and improve our help pages. Because a message is written in your own words it may still describe you, so we continue to handle what remains carefully rather than treating it as fully anonymous.
Why you left: After you delete your account we ask why, and we keep your answer so we can understand what to improve. What happens to the email address you give with it depends on the choice you make at the time. If you tick the box saying we may email you about your feedback, we keep the address for up to 24 months so we can actually follow up, and we use it for nothing else. If you do not tick it, we remove the address within 30 days. In both cases the reason and any comment you wrote are kept, with email addresses, phone numbers and links stripped out of the comment text, so we can see patterns in why people leave without holding on to who said what.
Backups: copies of deleted data may remain in our hosting providers' encrypted backups for a limited period, until those backups expire.

Children's Privacy

Beyond Payday is a family product, and we handle children's information carefully:

No logins under 13: Children under 13 can't create or hold a Beyond Payday login. A child can be invited to a login only once a birthday showing they are 13 or older is on file. Invitations for younger children, or for a child with no birthday recorded, are blocked and cannot be accepted. A parent or legal guardian may instead set up Kid Mode for a child under 13, with verifiable consent, as described below.
Kid Mode (under 13): Kid Mode gives a child under 13 their own jars, goals and lessons on a device their parent chooses, without a login. Only a parent or legal guardian can turn it on, from Settings → Family, and only after reading our kids' privacy notice and giving consent, which we confirm by email. That notice explains what Kid Mode collects, how we use it, how long we keep it, and how a parent can review, download or delete it and withdraw consent at any time. Kid Mode is for tracking only: no real money moves. Kid Mode screens load no analytics or advertising tracking. Saved Kid Mode records are not sold or used for advertising or profiling. Our listed service providers process those records only on our behalf to operate Kid Mode.
Teen (13–17) logins: A parent or guardian may invite a family member aged 13 or older to a limited "child" login. Child logins see only their own financial information — not the rest of the household's — their access is controlled by the account owner's permission settings, and they cannot run the family data export. In the Teen view, lessons a teen finishes are private unless the teen turns on Share my lessons in Settings → Privacy, which shows the family owner and partner how many lessons the teen finished and the latest ones. The owner and partner can still see every money record in the family, including the ones a teen adds. Child logins cannot use any of our AI features — the Beth AI assistant, the paystub scanner, AI-matched Save money tips, or import column suggestions — and cannot connect an outside AI app, so a child's login never sends their information to an AI service.
Information about younger children: A parent or guardian may add children of any age as family members and record information about them (such as a name, a birthday, and savings set aside for them). Outside Kid Mode, this information is entered and controlled entirely by the parent or guardian — we do not collect it from the child — and the account owner can edit or delete it at any time.
No analytics or advertising for teens: While a child login is signed in, and when a teen opens a family invitation, we switch off website analytics (Google Analytics) and the OpenAI advertising measurement pixel in that browser, and we never report a teen's sign-up to an advertising platform.
How we use children's information: Information about a child is used only to provide Beyond Payday to that family. We do not sell it, use it for advertising, or build profiles of children. When a parent or guardian uses the Beth AI assistant, a child's first name, relationship and age (and any amounts linked to them) may be sent to our AI provider, Anthropic, to answer that parent's question, under the same terms as the rest of the household's data. Anthropic's commercial API terms prohibit using this data to train its models. Children cannot use our AI features or connect an outside AI app themselves. Kid Mode data — a child's jars, entries, goals, lessons, stickers and devices — is never sent to Beth or any other AI service.
Parental review and deletion: The account owner can review, correct, or delete any information about a child at any time from Settings → Family, and can remove a teen's login, which signs them out and cancels any pending invitation. Removing a family member deletes their profile; amounts that were linked to them, such as income or savings, stay in the household until you delete them. If you want us to delete everything we hold about a child, including a teen's own login, contact us through our contact form and we will do it promptly.
If you believe a child under 13 has created a login, please contact us and we will promptly delete it.

State-Specific Privacy Rights

Depending on your location (e.g., California, Virginia, Colorado), you may have additional rights under state law, including the Right to Know, Right to Opt-Out, and Right to Non-Discrimination.

Your Privacy Choices (California): to opt out of the "sharing" of your personal information through our advertising measurement pixel, use the Do Not Sell or Share My Personal Information link in our website footer, press Decline in our cookie banner, or turn off Analytics cookies in Settings → Privacy. We treat a browser Global Privacy Control (GPC) signal as an opt-out of analytics and ad sharing on that browser.

Cookies and Similar Technologies

We use essential, functional, analytics, and ad-measurement cookies to keep you signed in, remember your preferences, understand how visitors use Beyond Payday, and measure whether our ads led you here. We also use your browser's local storage and temporary caching in a few specific ways:

Ad-click measurement: If you arrive at Beyond Payday from an ad we run on ChatGPT, a first-party cookie stores a privacy-preserving click identifier so we can tell the ad worked (see the Advertising Measurement section above). Pressing Decline in our cookie banner, or turning off Analytics cookies in Settings → Privacy, turns this off.
First-visit source: A first-party cookie remembers the website that sent you and any campaign tags from your first visit, for up to 90 days, so we can save them with your account if you sign up (see "How You Found Us" above). It is never sent to anyone else. Pressing Decline in our cookie banner turns this off.
Free calculators: If you use our free public calculators, the numbers you enter are saved only in your browser's local storage on your own device, so they are still there when you return. This information is never transmitted to our servers.
AI assistant: Your Beth chat history is cached in your browser's local storage for your convenience. You can clear it at any time from your browser settings or from within the chat interface.
Offline caching: As a Progressive Web App, Beyond Payday temporarily caches pages and responses in your browser (via a service worker) so it loads quickly and tolerates a spotty connection. This cache clears like any other browser cache.
Browser extension: If you install our browser extension, the wage figures it needs are stored on your device in the browser's extension storage for up to 24 hours. The list of shopping sites it supports is stored there too, and is replaced as we update it. This is separate from the storage above and is removed when you uninstall the extension. See the Browser Extension section for what it does and does not send us.

Mobile Apps (iOS and Android)

Our iOS and Android apps show the same Beyond Payday site inside an app, using the same account and the same data described in this policy. These things work differently in the app:

Analytics choice: the apps do not show the cookie banner. Analytics start from the same regional default described in the Analytics section above, and you can turn them off at any time with the Analytics cookies switch in Settings → Privacy.
No advertising measurement: the OpenAI measurement pixel does not run in the apps, and we never report an app sign-up to an advertising platform.
Push notifications: these are off until you turn them on. When you do, we store a notification token for that device, its platform and app version, and the date we last saw it, so we can send what you asked for. Delivery goes through Apple's and Google's push services, which receive the token and the text of the notification.
What push is used for: the reminders you switch on, each off by default; account and service alerts, which are on by default and cover things like a payment we could not process, a trial ending, or a member of our staff requesting access to your figures; and offers and news, which are off unless you turn them on and are a separate choice from marketing email. You can change any of these in Settings → Notifications in the app, or turn off notifications for Beyond Payday in your device settings. Child logins have no push notifications.
What a notification says: because it can appear on a locked screen, notification text does not include your balances or the amounts you track. A reminder says something like how many bills are due, or a date.
Stopping push: signing out unlinks that device, and turning the switch off removes its record. We stop sending to a device we have not seen for 60 days, and if Apple or Google tells us a token is no longer valid we delete it.
App lock: if you turn on the app lock, your device performs the Face ID, Touch ID, or fingerprint check and tells the app only whether it succeeded. Biometric data stays on your device; we never receive or store it.
Sign-in and payment: signing in with Google or Apple, and paying for a subscription, open in your device's browser rather than inside the app. Payment is handled by Stripe as described above, and we receive no purchase information from the App Store or Google Play.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

Privacy Policy

The Short Version