Privacy Policy

1. Introduction

MyPB ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and what choices you have. This policy applies to all users of the MyPB web application ("the Service").

2. Information We Collect

2.1 Information You Provide

When you use MyPB, you provide us with:

• Account information: Your name, email address, and password (stored as a one-way hash — we cannot read your password)
• Budget data: Budgets, accounts, categories, transactions, category goals, and notes you create within the Service
• Net worth data: Assets and liabilities you add for tracking purposes
• Support requests: Messages you send through the in-app support feature

2.2 Information We Do NOT Collect

MyPB is designed to minimise data collection. We do not collect:

• Bank account credentials or login details
• Data from financial aggregators (Plaid, Yodlee, etc.)
• Social security or government identification numbers
• Credit card or payment card numbers (during early access)
• Precise location data
• Device fingerprints or advertising identifiers
• Browsing history outside the Service

2.3 Automatically Collected Information

When you use the Service, our servers automatically log:

• Your IP address (for security and rate limiting)
• Browser type and version
• Pages visited within the Service and timestamps

This data is used solely for security, debugging, and maintaining the Service. It is not used for advertising or shared with third parties.

3. How We Use Your Information

We use the information we collect to:

• Provide the Service: Store and display your budgets, transactions, reports, and financial data
• Authenticate you: Verify your identity when you log in
• Enable sharing: Allow you to invite others to view or collaborate on budgets
• Send essential emails: Password resets, budget invitations, and important service announcements
• Respond to support: Address questions or issues you raise through the support feature
• Maintain security: Rate-limit login attempts, validate sessions, and protect against abuse

We do not use your information for advertising, profiling, or selling to third parties.

4. Data Sharing

We do not sell, rent, or share your personal information with third parties except in the following limited circumstances:

• Budget sharing: When you invite someone to a budget, they can see budget data (accounts, categories, transactions) based on the permission level you set
• Legal requirements: If required by law, regulation, or valid legal process
• Safety: If necessary to protect the rights, safety, or property of MyPB, our users, or the public

We do not use third-party analytics services, advertising networks, or data brokers.

5. Data Security

We implement appropriate technical and organisational measures to protect your data:

• Passwords are hashed using bcrypt (one-way, irreversible)
• All connections use TLS encryption (HTTPS)
• Sessions use HTTP-only, secure, same-site cookies
• Database queries use parameterized statements to prevent injection
• CSRF tokens protect all form submissions
• Login attempts are rate-limited to prevent brute-force attacks

While no system is 100% secure, we take reasonable steps to protect your data from unauthorized access, alteration, or destruction. For more details, visit our Privacy & Security page.

6. Data Retention

We retain your data for as long as your account is active. If you delete your account:

• All personal data (name, email, password hash) is permanently deleted
• All budget data (budgets, accounts, transactions, categories) is permanently deleted
• Shared budget access for other users is revoked
• Server logs containing your IP address are retained for up to 90 days for security purposes, then deleted

7. Cookies

MyPB uses only essential cookies required for the Service to function:

• Session cookie: Maintains your login session (expires when you close the browser or after inactivity)
• Theme preference: Stored in your browser's localStorage (not a cookie), remembers your light/dark mode choice

We do not use tracking cookies, advertising cookies, or third-party cookies.

8. Your Rights

You have the right to:

• Access your data — all your data is visible within the Service
• Correct your data — you can edit your name, email, and all budget data at any time
• Delete your data — you can request complete account deletion
• Withdraw consent — you can stop using the Service at any time

To exercise any of these rights, use the in-app support feature or contact us directly.

9. Children's Privacy

The Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly.

10. International Users

The Service is hosted and operated in the country where our servers are located. If you access the Service from another jurisdiction, your information may be transferred to and processed in our server's jurisdiction. By using the Service, you consent to this transfer.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email and update the "Last updated" date at the top of this page. Continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact

If you have questions about this Privacy Policy or how your data is handled, please contact us through the support feature within the application or by emailing the address listed on your account dashboard.