Introduction

Beyond Payday is operated by HTMLGuy LLC, doing business as Beyond Payday (formerly PiggySize; "we", "our", or "us"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

Information We Collect

We collect information that you provide directly to us, including:

Account Information: Name, email address, and authentication credentials
Financial Data: Income, expenses, bills, assets, and retirement planning information you choose to track
Quiz Responses: If you complete our plan recommendation quiz, we record your answers so we can improve our recommendations and understand which features matter most. This happens when you finish the quiz, whether or not you create an account. The quiz is multiple choice: we store only the answers you picked, the plan we recommended and which version of the quiz you took. It contains no financial information and no free text. If you do not have an account, we store nothing alongside your answers that identifies you: no name, no email address, no IP address and no tracking identifier. If you go on to create an account in the same browsing session, we attach those existing answers to your account rather than storing a second copy, and they are deleted along with everything else when you delete your account.
Usage Data: Information about how you interact with our service, including pages visited and features used
Device Information: IP address, browser type, and device identifiers. When you create your account, we also record the IP address you signed up from and an approximate location derived from it by our hosting provider, and your device's timezone (e.g. Eastern, Central, Mountain, Pacific), used to show dates, times, and reminders correctly for your location.
Mobile App Information: If you use our iOS or Android app and turn on push notifications, we store a notification token for that device, the platform (iOS or Android), the app version, and when the device was last seen. See the Mobile Apps section below.
Cookies and Tracking: We use cookies and similar technologies (like local storage) to maintain your session and remember your preferences.
Family Account Data: Information related to family accounts and shared access permissions, including the family member details (such as names and birthdays) that the account owner enters
Paystub Images: If you use the paystub scanner, the image you upload is processed in memory to read the numbers and is never stored on our servers (see the AI Assistant section below)
Support & Contact Data: If you contact us through our contact form (or ask our AI assistant to file a support ticket for you), we store your name, email address, and message so we can respond. See Data Retention below for how long we keep these and what we remove afterwards
Emails We Send You: We save a copy of each email we send you, along with the address it went to and whether it was delivered, so we can troubleshoot delivery problems. Because the copy is the message itself, it includes whatever was in it — for example the name and amount of a bill in a reminder. See Data Retention below for how long we keep these and what we remove afterwards.
Partner Program Data: If you join our partner program, we store your referral code, referral activity, and commission records
Import Records: When you use Import data, your spreadsheet is read in your browser. We do not upload or keep the file itself. Once you review the preview and confirm which rows to add, we save those rows as ordinary bills, assets or debts. We also keep a small record of the import — your account and household identifiers, what you imported into, when, which source row each record came from, the identifiers of the records it created, and fingerprints of their values — so a retry cannot save the same row twice and so you can undo the import later. That record does not contain a copy of your spreadsheet, and it is deleted when your account or household is deleted. We also keep counts describing how the import went, such as how many rows were ready and how many needed correcting, to improve the importer; those counts contain no spreadsheet content, column headings or file names.
AI Assistant Data: Conversations with our Beth AI assistant, including your questions, AI responses, and related usage metrics (see AI Assistant section below)
Login & Security Information: Sign-in history (date and time, IP address, approximate location, device/browser, and sign-in method) and, if you enable two-factor authentication, your authenticator (TOTP) enrollment and one-way-hashed backup codes (see Login & Security Information section below)
Browser Extension Data: If you install our optional browser extension and connect it to your account, we store a record of that connection — a device label you choose (for example, "Chrome on my laptop"), the dates it was created and last used, and a one-way cryptographic hash of its access token. The token itself is shown to you once and cannot be recovered by us. We do not receive the websites you visit or the products you view (see the Browser Extension section below).

How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our financial tracking and retirement planning services
Process your financial data and generate insights and calculations
Enable family account features and manage shared access permissions
Send you technical notices, updates, and support messages
Send you security alerts when something important changes on your account (for example, a sign-in from a new device or location, a password change, or a change to your two-factor authentication settings)
Send optional reminders that you choose to turn on, such as bill due dates, a monthly check-in, or an annual plan checkup — these are off unless you enable them, and every reminder email includes an unsubscribe link
Send automated notifications regarding free trial status and expiration
Respond to your comments, questions, and requests
Monitor and analyze usage patterns to improve our service
Detect, prevent, and address technical issues and security threats
Block IP addresses linked to abuse, fraud, or attacks: we keep a list of blocked addresses, each with a reason and an optional expiry date, and check it when someone signs up, signs in with Google or Apple, or submits a form on our site

AI Assistant (Beth)

Our AI assistant feature ("Beth") uses artificial intelligence to help you understand your finances. When you use Beth:

What We Collect: We store your conversation messages (your questions and the AI's responses), the page you were on when chatting, tool interactions (such as calculations performed), and usage metrics (message counts, response times, token usage).
How It Works: Your messages, along with the relevant financial figures needed to answer them, are sent to Anthropic's Claude AI model for processing. Anthropic processes this data according to their own privacy policy. We recommend reviewing Anthropic's Privacy Policy for details on how they handle data.
Paystub Scanner: If you scan a paystub, the image you upload is sent to Anthropic's Claude to read the numbers, processed in memory, and never stored on our servers — we keep only the figures you choose to save. The scanner is available on every plan; Free accounts include a limited number of scans.
Save Money Tips: To show tips that fit each bill, the Save money page first matches bills to a tip type using the bill's name. For bills it can't match on its own, it sends only the bill name and its category to Anthropic's Claude, which picks one of our pre-written tip types. We don't send amounts, account details, or your name or email, and we store only the chosen tip type. Household members who don't have access to AI features never trigger this, and anyone who can edit bills can change a bill's tip type.
Import Column Suggestions: When you import a spreadsheet, you can ask AI to suggest which of your columns match Beyond Payday fields. We show you the exact column headings first and send them to Anthropic's Claude only after you agree. We never send the file, the rows inside it, or your account or household identifiers, and a suggestion changes nothing until you review it and choose to apply it. Column headings are written by you, so check them before you agree — a heading can contain personal information. You can always match columns yourself, and matching them yourself never involves AI.
Quality and Safety: Our team may review AI chat conversations for quality assurance, safety monitoring, abuse prevention, and to refine how the assistant responds. Your conversations are never used to train the underlying AI model.
Data Retention: Chat history is retained for the life of your account and is permanently deleted when you delete your account.
Local Storage: Chat history is also cached in your browser's local storage for your convenience. You can clear this at any time through your browser settings or within the chat interface.
Rate Limits: We track daily message counts per user to enforce usage limits.

Login & Security Information

To help you monitor access to your account and to protect it from unauthorized use, we collect information related to sign-ins and, if you choose to enable them, two-factor authentication features.

Sign-In History: Each time you sign in, we record the date and time, the IP address the sign-in came from, an approximate location (city, region, and country) derived from that IP address, a summary of your device and browser, and the method used to sign in (for example, password, a connected account like Google or Apple, passkey, or two-factor authentication).
Retention: We retain a rolling history of your most recent 50 sign-ins so you can review recent account activity. As new sign-ins are recorded, the oldest entries beyond the most recent 50 are automatically removed.
Two-Factor Authentication (2FA): If you enable two-factor authentication, we store the information needed to verify future sign-ins, such as your authenticator app (TOTP). If you generate backup codes, we store them only as one-way cryptographic hashes; the codes themselves are shown to you once and cannot be recovered by us.
Passkeys: If you set up a passkey to sign in, we store the passkey's public credential and related metadata — a device label (for example, "MacBook" or "YubiKey") and the dates it was created and last used — so you can sign in without entering a password. The passkey's private key stays on your device: it is never sent to us and we never store it.
Why We Collect This: We use this information to secure your account, let you review your own sign-in activity, and detect and prevent unauthorized access. It is handled under the same data sharing and security practices described elsewhere in this policy.

Browser Extension

We offer an optional browser extension that shows what a price costs in hours of your work while you shop. It is not required to use Beyond Payday, it does nothing until you install it yourself, and it communicates only with Beyond Payday — it does not send your information to any third party.

Where it runs: Only on online shopping sites we have built support for — major retailers such as Amazon, eBay, Best Buy, Walmart, and Target. It never runs on any other website. We expect to add retailers over time, so rather than freeze a list here: the sites the extension can read are always the ones listed in your browser's own permissions for it, and your browser asks you to approve any site we add before the extension can read it there. On a supported page it looks only for the product's price and a place to show its badge.
What stays on your device: The price it reads, and the page you are on, never leave your browser. We do not receive the sites you visit, the pages you view, the products you look at, or the prices it reads. The calculation happens entirely on your own device.
What we send to it: If you connect the extension to your account, we send only the figures the calculation needs: your after-tax and gross hourly pay, your daily take-home, and your retirement assumptions — the growth rate you use, your target retirement age, and how many years you have until it. We do not send account balances, bills, debts, goals, family information, or your name or email. Child accounts receive only the hourly figures, never the household's retirement assumptions.
What is stored on your device: Those figures are cached in the browser's extension storage on your own device — never synced to your browser account — for up to 24 hours, alongside the extension's access token, the list of supported shopping sites it downloads (described below), and any sites you have switched the badge off for. Disconnecting or uninstalling the extension clears them.
What we can see: When the cached figures are more than a day old, the extension asks our server for fresh ones. That request carries only its access token — no site, page, or price — and creates the same kind of record as any other visit (IP address and time), plus the "last used" date on the connection. Because that refresh happens only while you are on one of the supported shopping sites, it can tell us you used the extension that day, but not where.
Checking which stores it supports: Separately from the refresh above, the extension periodically downloads the current list of shopping sites it supports and where to find the price on each one, so that a site we have fixed or newly added starts working without you having to reinstall anything. That request is anonymous: it carries no access token and nothing that identifies you or your account, it is not tied to your connection, and every copy of the extension receives the same file. It tells us nothing about where you shop — we cannot tell from it which sites you visit, or whether you visited a shopping site at all. As with any request to a website, our server records the IP address it came from and the time.
Turning it off: You can disconnect the extension at any time from Settings, which permanently revokes its access token, and you can remove the extension from your browser like any other. You can also switch the badge off for individual sites from within the extension itself.

Connecting an Outside AI App

You can connect an outside AI app — Claude.ai, Claude Code, or another tool that speaks the Model Context Protocol — to your Beyond Payday account. Nothing is connected unless you set it up yourself: the app sends you to a Beyond Payday consent screen where you sign in and choose what it may do. Read-only lets it see your income, bills, assets, debts and net worth — the same financial details you see in Beyond Payday. Read & write lets it also add, edit and delete those records, so a tool with write access can change your real data, and its mistakes are changes to your real data. Read-only is pre-selected, so write access is a choice you have to make on purpose. A child account that connects reaches only its own records, exactly as it does in the app.

We do not vet these apps. Any developer can register one to connect, and we do not review, approve, endorse or audit them. Once you approve, your data goes straight to that app, and what happens to it there is governed by that company's privacy policy, not this one — we cannot see what the app does with your data afterwards and we are not responsible for how it handles it. Read its policy before you approve, and only connect an app you trust. On our side we record only which app called which feature and when, never the questions you asked or the answers it received, and every financial answer carries a note that the figures are estimates from your own data and not financial, tax or legal advice.

You can cut off a connection at any time from Settings → Connections, which revokes the app's access immediately, and deleting your account disconnects everything. Disconnecting stops future access; it does not reach back and delete data the app already received — only that company can do that, so ask them directly. Expired tokens and app registrations that were never used are deleted automatically after 30 days. Because these transfers happen at your direction, they are not a sale of your personal information and not "sharing" for cross-context behavioral advertising.

Analytics

We use Google Analytics to understand how visitors engage with our site. This helps us improve our service. Google Analytics uses cookies to track your interactions. The information collected is used to generate reports about website usage. You can decline analytics cookies at any time, either with the Decline button in our cookie banner or with the Analytics cookies switch in Settings → Privacy; both turn analytics collection off on that device. Our mobile apps do not show the cookie banner, so Settings → Privacy is where you make that choice there. You can also opt out by installing the Google Analytics Opt-out Browser Add-on. Ad-personalization signals in Google Analytics are disabled.

Advertising Measurement

We advertise Beyond Payday on third-party platforms, including ChatGPT (operated by OpenAI). To know whether those ads actually work, we use OpenAI's measurement pixel and conversion reporting:

Ad-click identifier: If you arrive at our site after clicking one of our ads, the pixel stores a privacy-preserving click identifier in a first-party cookie on your browser.
Conversion reports: When you create an account, we report a "registration completed" event to OpenAI. That report may include the click identifier, a one-way (SHA-256) hash of your email address, a one-way hash of your account identifier, your IP address, and your browser's user-agent string.
What it never includes: your name or email address in readable form, your password, or any of your financial data.
What it is for: measuring that an ad led to a signup so we can pay for ads based on results. We do not use it to build advertising profiles of you, and we do not show you targeted ads.
Your choice: pressing Decline in our cookie banner, or turning off Analytics cookies in Settings → Privacy, turns ad measurement off on that device, including the conversion report.
Not in our mobile apps: the measurement pixel does not run in our iOS and Android apps, and we never report an app sign-up to an advertising platform.
OpenAI processes this data under its own policies; see OpenAI's Privacy Policy.

Data Storage and Security

We implement appropriate technical and organizational measures to protect your personal information, including encryption of data in transit (TLS/HTTPS) and at rest, database row-level security that isolates each family's records, and secure authentication options including two-factor authentication. However, no method of transmission is 100% secure.

Who at Beyond Payday Can See Your Data

By default, our staff can see your account and billing details — your plan, your household members and their permissions, your invoices, and whether a feature errored — along with usage statistics that are aggregated across accounts and are not tied back to you. That is what we use to run the service, answer billing questions, and decide what to build.

By default our staff cannot see your actual financial figures. Where household content is visible to staff in our internal tools, such as your conversations with the Beth AI assistant, every amount, percentage, email address and phone number is removed on our servers before the content is displayed. Staff see the wording of a conversation, not the numbers in it.

If you ask for hands-on help and we need to see your real data to give it, a named member of staff must request access to your household and give a written reason. Only the account owner can approve that request, and the owner chooses how long it lasts — from one hour up to three days. The owner can refuse the request, can end an approved one at any time, and it expires on its own with no action needed. We email the owner when access is requested and again when it is approved. Every request, decision and use is recorded, and the owner can read that record at any time in Settings → Privacy.

While access is approved, that staff member can also download a copy of your household's data to work on the problem. Each download appears in the access record the owner can read, and is also recorded in our internal staff activity log, along with other actions our staff take on your account, such as issuing a refund or a credit.

Two honest limits. First, this governs our internal tools; the people who administer our databases and the infrastructure providers listed below necessarily retain technical access to the systems your data sits on, which is why we vet them and keep the list short. Second, we may access account content without a grant where the law requires it, or where we must to investigate abuse, fraud or a threat to someone's safety — and those accesses are logged in the same way.

Data Sharing and Disclosure

We do not sell your personal information, and we do not share your financial information with advertisers or data brokers. When advertising measurement is turned on, the OpenAI measurement pixel described in the Advertising Measurement section may be considered "sharing" for cross-context behavioral advertising under California law; you can opt out as described in the State-Specific Privacy Rights section. We share information only in these limited ways: with your consent; to provide the family-account features you use; when required by law; to an outside AI app you connect and approve yourself (see Connecting an Outside AI App); and with the trusted service providers ("subprocessors") that operate Beyond Payday on our behalf. Each subprocessor receives only the information it needs for its role:

Supabase — database hosting and account authentication.
Vercel — application hosting, automated bot/abuse protection, and the IP-based approximate location used for sign-in history.
Stripe — subscription billing and payment processing.
Anthropic — powers the Beth AI assistant, the paystub scanner, Save money tip matching, and optional import column suggestions; receives the financial figures, paystub image, bill names and categories, or spreadsheet column headings needed for that feature, and only when you use those features. Anthropic's commercial API terms prohibit using this data to train its models.
OpenAI — ad-conversion measurement for the ads we run on ChatGPT; receives only the signup conversion report described in the Advertising Measurement section above, and never your name in readable form or any of your financial data.
Apple — delivers push notifications to iPhone, iPad, and Mac through the Apple Push Notification service; receives the device token and the text of the notification.
Google Firebase Cloud Messaging — delivers push notifications to Android devices; receives the device token and the text of the notification.
Mailgun — sends our transactional email (verification, receipts, security alerts, reminders, invitations, and support messages).
Google Analytics — aggregate website-usage analytics.
Upstash — rate limiting that stops password guessing, spam, and other abuse; receives short-lived counters keyed by IP address or account ID, which expire automatically.
Google reCAPTCHA — spam and bot protection on our public contact form.

If you choose to sign in with Google or Apple, that company confirms who you are and shares the name and email address you allow it to. It is not a subprocessor and receives none of your financial data.

An app you connect yourself is not a subprocessor: it acts for you, not for us, and receives whatever access level you chose. Nobody else receives your data, unless you connect an outside AI app yourself — see Connecting an Outside AI App above.

Your Rights and Choices

You have the right to access, correct, delete, and export your personal information. You can download a complete copy of your data at any time from Settings → Your Data, and the account owner can permanently delete the account and all of its data from Settings — deletion is permanent and cannot be undone. Deleting your account also clears the email log at the same time: for every email we sent to your account or your email address, the saved copy is erased and the address and subject line are replaced with "[removed]", leaving only an unnamed record that a message was sent and delivered. Deleting your account removes your data from Beyond Payday and cuts off any connected outside AI app; it cannot delete copies an app already received. You also decide whether our staff may see your actual financial figures: support access must be requested by a named person, can only be approved by the account owner, lasts no longer than the owner chooses, can be withdrawn at any time, and is recorded in an access log the owner can read in Settings → Privacy. Refusing a request does not affect your account or your plan. If you are unable to use these self-serve tools, or you need help exercising any of these rights, contact us and we will assist you. You can also opt out of non-essential communications at any time. You can see every outside AI app connected to your account, and cut any of them off, at Settings → Connections.

Data Retention

We retain your personal information for as long as necessary to provide our services. Upon account deletion, we delete or anonymize your information, with a few limited exceptions:

Billing records: Invoice history may be retained for up to 7 years for tax compliance, with personal identifiers snapshotted.
Operational and security logs: Retained in de-identified form (they are disconnected from your identity when your account is deleted).
Staff activity log: Our record of the actions staff take in our internal tools, such as a refund or a data download, is kept as a security record and is not automatically deleted.
Payment and system job records: We keep a short record of each notification from our payment processor (which event it was and whether we handled it, not its contents) for 90 days, and a record of each run of our scheduled background jobs for 30 days. Both are then deleted automatically.
AI suggestion limits: If you use optional import column suggestions, we keep a small record of each request — account, household and request identifiers, a fingerprint of the column headings, the cost we set aside, and the time. It never holds the headings themselves, your spreadsheet values, or the AI's response. These identifiers and fingerprints are pseudonymous rather than anonymous. This record is kept even if the account is deleted, so that deleting an account cannot reset our spending limits, and it is removed on the first daily cleanup after 90 days.
Partner commission records: If you signed up through a partner's referral link, the email address on that referral record is retained to preserve the accuracy of commission records.
Email log: When we send you an email — a bill reminder, a receipt, a verification link — we save a copy of it so we can troubleshoot delivery problems and answer questions about what we sent. Because the copy is the message itself, it contains whatever was in it, such as the name and amount of a bill. We automatically erase that copy after 90 days. What remains is the outline of the send: the address we sent to, the subject line, whether it was delivered, and when. We keep the address and subject line for up to 24 months and then replace them with "[removed]"; the unnamed delivery record stays so we can see whether our email is reaching people. We do not track whether you open our emails or click links in them.
Browser extension connections: When you disconnect an extension we keep its record, marked as revoked, so you can still see that it existed and when its access ended. It is deleted when you delete your account.
Outside AI app connections: we keep the record of which apps you connected, what access you granted, and when they were used while the connection is active; expired tokens and unused app registrations are deleted automatically after 30 days, and disconnecting or deleting your account revokes access immediately.
Support and contact messages: Messages you send us through the contact form, or that our AI assistant files on your behalf, are kept for 24 months so we can handle the request, follow up on it, and resolve any dispute about it. Anyone can use the contact form, including people who do not have an account, so these messages are kept separately from your account data and deleting your account does not remove them. After 24 months we automatically strip out the personal details: your name and email address are removed, the message is unlinked from your account, and any email addresses, phone numbers and links inside the message text are replaced. What remains is the category and the wording of the problem, which we use to spot recurring issues and improve our help pages. Because a message is written in your own words it may still describe you, so we continue to handle what remains carefully rather than treating it as fully anonymous.
Why you left: After you delete your account we ask why, and we keep your answer so we can understand what to improve. What happens to the email address you give with it depends on the choice you make at the time. If you tick the box saying we may email you about your feedback, we keep the address for up to 24 months so we can actually follow up, and we use it for nothing else. If you do not tick it, we remove the address within 30 days. In both cases the reason and any comment you wrote are kept, with email addresses, phone numbers and links stripped out of the comment text, so we can see patterns in why people leave without holding on to who said what.

Children's Privacy

Beyond Payday is a family product, and we handle children's information carefully:

No logins under 13: Children under 13 may not create or hold a Beyond Payday login. A child can be invited to a login only once a birthday showing they are 13 or older is on file. Invitations for younger children, or for a child with no birthday recorded, are blocked and cannot be accepted.
Teen (13–17) logins: A parent or guardian may invite a family member aged 13 or older to a limited "child" login. Child logins see only their own financial information — not the rest of the household's — their access is controlled by the account owner's permission settings, and they cannot use the AI assistant or run the family data export. A child login that connects an outside AI app shares only what that login can already see.
Information about younger children: A parent or guardian may add children of any age as family members and record information about them (such as a name, a birthday, and savings set aside for them). This information is entered and controlled entirely by the parent or guardian — we do not collect it from the child — and the account owner can edit or delete it at any time.
No analytics or advertising for teens: While a child login is signed in, and when a teen opens a family invitation, we switch off website analytics (Google Analytics) and the OpenAI advertising measurement pixel in that browser, and we never report a teen's sign-up to an advertising platform.
How we use children's information: Information about a child is used only to provide Beyond Payday to that family. We do not sell it, use it for advertising, or build profiles of children. When a parent or guardian uses the Beth AI assistant, a child's first name, relationship and age (and any amounts linked to them) may be sent to our AI provider, Anthropic, to answer that parent's question, under the same terms as the rest of the household's data. Anthropic's commercial API terms prohibit using this data to train its models. Children cannot use the AI assistant themselves.
Parental review and deletion: The account owner can review, correct, or delete any information about a child at any time from Settings → Family, and can remove a teen's login, which signs them out and cancels any pending invitation. Removing a family member deletes their profile; amounts that were linked to them, such as income or savings, stay in the household until you delete them. If you want us to delete everything we hold about a child, including a teen's own login, contact us through our contact form and we will do it promptly.
If you believe a child under 13 has created a login, please contact us and we will promptly delete it.

State-Specific Privacy Rights

Depending on your location (e.g., California, Virginia, Colorado), you may have additional rights under state law, including the Right to Know, Right to Opt-Out, and Right to Non-Discrimination.

Your Privacy Choices (California): to opt out of the "sharing" of your personal information through our advertising measurement pixel, use the Do Not Sell or Share My Personal Information link in our website footer, press Decline in our cookie banner, or turn off Analytics cookies in Settings → Privacy. We treat a browser Global Privacy Control (GPC) signal as an opt-out of analytics and ad sharing on that browser.

Cookies and Similar Technologies

We use essential, functional, analytics, and ad-measurement cookies to keep you signed in, remember your preferences, understand how visitors use Beyond Payday, and measure whether our ads led you here. We also use your browser's local storage and temporary caching in a few specific ways:

Ad-click measurement: If you arrive at Beyond Payday from an ad we run on ChatGPT, a first-party cookie stores a privacy-preserving click identifier so we can tell the ad worked (see the Advertising Measurement section above). Pressing Decline in our cookie banner, or turning off Analytics cookies in Settings → Privacy, turns this off.
Free calculators: If you use our free public calculators, the numbers you enter are saved only in your browser's local storage on your own device, so they are still there when you return. This information is never transmitted to our servers.
AI assistant: Your Beth chat history is cached in your browser's local storage for your convenience. You can clear it at any time from your browser settings or from within the chat interface.
Offline caching: As a Progressive Web App, Beyond Payday temporarily caches pages and responses in your browser (via a service worker) so it loads quickly and tolerates a spotty connection. This cache clears like any other browser cache.
Browser extension: If you install our browser extension, the wage figures it needs are stored on your device in the browser's extension storage for up to 24 hours. The list of shopping sites it supports is stored there too, and is replaced as we update it. This is separate from the storage above and is removed when you uninstall the extension. See the Browser Extension section for what it does and does not send us.

Mobile Apps (iOS and Android)

Our iOS and Android apps show the same Beyond Payday site inside an app, using the same account and the same data described in this policy. These things work differently in the app:

Analytics choice: the apps do not show the cookie banner. Analytics start from the same regional default described in the Analytics section above, and you can turn them off at any time with the Analytics cookies switch in Settings → Privacy.
No advertising measurement: the OpenAI measurement pixel does not run in the apps, and we never report an app sign-up to an advertising platform.
Push notifications: these are off until you turn them on. When you do, we store a notification token for that device, its platform and app version, and the date we last saw it, so we can send what you asked for. Delivery goes through Apple's and Google's push services, which receive the token and the text of the notification.
What push is used for: the reminders you switch on, each off by default; account and service alerts, which are on by default and cover things like a payment we could not process, a trial ending, or a member of our staff requesting access to your figures; and offers and news, which are off unless you turn them on and are a separate choice from marketing email. You can change any of these in Settings → Notifications in the app, or turn off notifications for Beyond Payday in your device settings. Child logins have no push notifications.
What a notification says: because it can appear on a locked screen, notification text does not include your balances or the amounts you track. A reminder says something like how many bills are due, or a date.
Stopping push: signing out unlinks that device, and turning the switch off removes its record. We stop sending to a device we have not seen for 60 days, and if Apple or Google tells us a token is no longer valid we delete it.
App lock: if you turn on the app lock, your device performs the Face ID, Touch ID, or fingerprint check and tells the app only whether it succeeded. Biometric data stays on your device; we never receive or store it.
Sign-in and payment: signing in with Google or Apple, and paying for a subscription, open in your device's browser rather than inside the app. Payment is handled by Stripe as described above, and we receive no purchase information from the App Store or Google Play.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

Privacy Policy

The Short Version