Privacy & security
The safest place
for your data is
your own device.
So that is where we keep it. Everything below describes how the app behaves today — not an aspiration, and not a policy that a future release might quietly revise.
The short version
No bank connection means nothing to steal.
Most budgeting apps read your accounts through an aggregator, which means somebody is holding credentials or long-lived tokens for your bank. We do not do that, so there is no such thing as a Minturn Money breach that exposes your bank.
- We do not ask for a bank username, password or MFA code
- No aggregator, no screen-scraping, no read-only bank tokens
- You enter transactions yourself, or import a CSV you exported
- The trade is real: more typing, in exchange for no attack surface
Every envelope, every transactionAlways
Only if you turn it onOptional
Not asked for, not storedNone
Stays on device, 90 daysLocal
Where data lives
Three places, and you control two of them.
Your device
The whole budget lives in a local database in the app. This is the primary copy and the app reads and writes it directly — which is why it works with no network.
Our server, only if you sync
Cloud sync is a paid feature and is off until you switch it on. It stores the rows needed to reconcile your devices, and nothing else.
Wherever you export it
CSV export is yours on every tier including Free. There is no lock-in and no export fee.
Encryption
Encrypted in transit, encrypted at rest, and never the product.
Several different things get called “encryption”, and collapsing them into one claim is how security pages end up meaning nothing. Here they are separately.
The strongest protection is not holding the data in the first place. There is no bank login here to steal — no username, no password, no MFA code, no aggregator token — and the most the app stores about an account is the last four digits, if you choose to type them in.
Turning sync on changes where your budget lives. It does not change what the app asks you for.
- Transport encryption on everything, always
- Encrypted at rest, always
- No bank username, password or MFA code — the app has no route to your bank
- No full account or card numbers — the last four digits at most, and only if you enter them
- On-device encryption — lock the sensitive fields in the app behind a passphrase (Premium and above)
- Nothing reaches our servers at all until you turn sync on
TLS on every requestAlways
Encrypted storageAlways
Passphrase-locked fieldsPremium
Not asked for, not heldNone
Analytics
What we measure, and what we refuse to.
We do measure how the app is used, because otherwise we are guessing. Here is the whole of it.
What is collected
Counts and flags: how many envelopes exist, whether sync is on, which features get used, session length. Enough to know what to build next.
What never is
Amounts. Payee names. Transaction descriptions. Envelope names. The detailed behaviour log stays on the device and is deleted after 90 days — it is never uploaded.
There is an off switch, and it is in Settings, on every tier.
Security questions.
What if I lose my phone?
With sync on, sign in on a new device and your budget comes back. With sync off, the data was only ever on that device — which is the trade-off of local-only storage, and the reason the app takes rolling local backups and offers CSV export.
Can Minturn Money staff read my budget?
Access to production data is limited to what running the service requires, and we do not read customer budgets as part of normal operations. There is no bank login to find, and no full account or card number — at most the last four digits of an account, if you entered them. And if you never turn sync on, there is nothing of yours on our servers at all.
Do you use my data for anything else?
No. Your financial data is not sold, not shared with a data broker, not used for advertising and not fed to anyone else’s model. Usage analytics are deliberately coarse — which features get opened, not what you spent — and there is an off switch in Settings. The business model is subscriptions, which is why it can be this way.
Do you sell or share data?
No. There is no ad network, no data broker and no analytics partner receiving your financial data. The business model is subscriptions, which is precisely why it can be this way.
What happens if I delete my account?
Server-side data is deleted, and any active subscription is cancelled. The copy on your device is yours — export it first if you want to keep it, because we cannot recover it for you afterwards.
Is the app open source?
Not currently. The typeface is — Minturn Slab is released under the SIL Open Font Licence, and you are free to use it in your own work.
A budget nobody else has a copy of.
Start free, keep it local, and turn on sync only if you decide you want it.
Never Summer Mountains · mark byzewski, CC BY 2.0
