Your money is your business. Every budget starts with one participant, and you decide who may join and which financial details they may see.
What we store
- Account · your email, a one-way Argon2id hash of your password (never the password itself), and—only if you add passkeys—the public credentials needed to verify them. Plot never receives your biometric data or passkey private keys.
- Financial data you enter or approve · accounts, transactions, budgets, targets, and loan details. Optional synced activity is held for your review before it becomes part of your plan.
- Optional profile details · if you provide them, Plot stores your full birth date and derived birth year, street address, city, postal code, region, household size, and income band. These details can be saved whether or not you join Benchmarks. You can edit or clear them in Settings.
How it's protected
- Passwords are hashed with Argon2id; sensitive secrets such as your 2FA seed use authenticated Fernet encryption before storage.
- Optional Plaid access tokens are encrypted. Plot does not store your bank username or password.
- Sessions use opaque, hashed tokens in
HttpOnly,SameSitecookies · a database leak can't be replayed. - Data is isolated by budget workspace. Inside a budget, the owner can keep everything open, protect personal account registers, or also limit categories to their assigned participants. A category shared with someone still shows that person the plan, responsibility, funding, and settle-up facts they need.
Optional bank connections
You never have to connect a financial institution. If you choose to use Plaid, Plot stores an encrypted connection token and the account and transaction data needed to provide synchronization. New and changed activity waits in your review Inbox. Disconnecting stops future sync; transactions you already approved remain in your Plot history unless you delete them.
Optional profile pictures
If you upload a profile picture, Plot decodes it, removes the original filename and metadata, crops it to a small square, and stores only a newly encoded copy. It is served privately to you and current members of the same active budget, and replacing or removing it invalidates the previous image address.
Optional AI features
AI features are under your personal control in Settings → AI & privacy. Turning them off hides or disables their controls and blocks your requests before any data reaches the configured provider, including inside a shared budget. AI is enabled by default for existing behavior, and you can turn it off or back on at any time without changing your financial records.
If you choose to scan a receipt, Plot sends bounded, metadata-free page images and your budget's category names to the configured AI provider to prepare an editable transaction. If you choose to import a statement, Plot sends a bounded representation of that file and the category names so the provider can extract a transaction proposal. Statements can contain sensitive details such as your name, address, balances, and account numbers, so Plot always asks you to choose the file explicitly and shows every extracted row for review before anything enters your ledger.
If you ask AI to investigate a reconciliation difference, Plot sends the statement date and balance plus a bounded, read-only snapshot of relevant account transactions and deterministic match candidates. The analysis cannot edit the ledger; you choose any resulting adjustment or register change yourself.
Plot does not keep uploaded receipt or statement files. Receipt proposals exist only in the response shown to you and are not stored. A normalized statement review proposal expires after two hours and scheduled cleanup removes it shortly afterward. Closing or canceling a completed review deletes it; if cancellation cannot reach Plot or races with in-flight analysis, that expiry and cleanup remain the backstop. Importing clears the proposal after the transactions are saved. AI usage metadata records cost, latency, and success or failure—not receipt images, statement contents, or reconciliation snapshots.
We use your data for nothing but serving you
By default, your financial data is used for one thing only: running your account. We don't sell or rent your information, we don't run ads, and we don't mine it for analytics.
Benchmarks are an optional addendum
Saving profile details does not opt you into Benchmarks. If you join, comparisons use an age band derived from your birth year, region, income band, and household size, not your exact birth date, street address, city, or postal code.
The single exception is opt-in: if you choose to join Benchmarks, you accept a separate Benchmark Data Addendum that permits limited use of your anonymized data, only in aggregate, to power comparisons for members. We only ever show aggregates of 5 or more people, and you can leave anytime · your contribution is then removed. Outside of that addendum, this policy's "we use nothing" promise holds.
Your control
You can change your data, disconnect linked institutions, opt out of Benchmarks, export account transactions as CSV, or delete your account at any time. Deletion removes your identity and personal workspaces. History in a workspace owned by someone else remains available to its remaining members after your membership is removed. Questions? Contact us.