Your money is your business. Personal budgets stay private; people you invite can see only the budget workspace you choose to share.
What we store
- Account · your email, a one-way Argon2id hash of your password (never the password itself), and—only if you add passkeys—the public credentials needed to verify them. Plot never receives your biometric data or passkey private keys.
- Financial data you enter or approve · accounts, transactions, budgets, targets, and loan details. Optional synced activity is held for your review before it becomes part of your plan.
- Optional demographics · only if you opt into Benchmarks. We keep your birth year (not full date) and region (not exact address).
How it's protected
- Passwords are hashed with Argon2id; sensitive secrets such as your 2FA seed use authenticated Fernet encryption before storage.
- Optional Plaid access tokens are encrypted. Plot does not store your bank username or password.
- Sessions use opaque, hashed tokens in
HttpOnly,SameSitecookies · a database leak can't be replayed. - Data is isolated by budget workspace. Members can access only the personal or shared workspaces they belong to.
Optional bank connections
You never have to connect a financial institution. If you choose to use Plaid, Plot stores an encrypted connection token and the account and transaction data needed to provide synchronization. New and changed activity waits in your review Inbox. Disconnecting stops future sync; transactions you already approved remain in your Plot history unless you delete them.
We use your data for nothing but serving you
By default, your financial data is used for one thing only: running your account. We don't sell or rent your information, we don't run ads, and we don't mine it for analytics.
Benchmarks are an optional addendum
The single exception is opt-in: if you choose to join Benchmarks, you accept a separate Benchmark Data Addendum that permits limited use of your anonymized data, only in aggregate, to power comparisons for members. We only ever show aggregates of 5 or more people, and you can leave anytime · your contribution is then removed. Outside of that addendum, this policy's "we use nothing" promise holds.
Your control
You can change your data, disconnect linked institutions, opt out of Benchmarks, export account transactions as CSV, or delete your account at any time. Deletion removes your identity and personal workspaces. History in a workspace owned by someone else remains available to its remaining members after your membership is removed. Questions? Contact us.