How Pocket Runway Protects Your Financial Information

    Pocket Runway holds a picture of your money: balances, bills, income and spending. This page says plainly what is stored, who it reaches, and what you can do about it. Where something is a limitation or not yet available, it says that too.

    For the formal version, see the Privacy Policy and the Terms of Service.

    What Pocket Runway stores

    • Your email address and, if you set one, a display name.
    • Your password, stored only as a bcrypt hash. The password itself is never stored, and nobody at Pocket Runway can read it.
    • The financial information you enter: accounts and balances, income and pay schedule, bills, transfers, savings goals and sinking funds, transactions, and net worth entries.
    • Anything you import, from a CSV or from another budgeting app.
    • Subscription status, including a Stripe customer reference and the last four digits of your card.
    • Support emails you send us, so we can reply.

    Your financial data is stored to run the product. It is not sold, not shared with data brokers, and not used for advertising. The business model is the subscription and nothing else.

    Signing in

    Two ways to sign in: an email address and password, or Google sign-in. With Google, Google confirms who you are and Pocket Runway never sees a Google password.

    Two-factor authentication is available. You can turn on an authenticator-app code from your account settings, with one-time backup codes issued when you enable it. The backup codes are stored hashed, the same way a password is, so they cannot be read back out either.

    Sessions are signed tokens held by your browser or app. Logging out invalidates every outstanding session for your account immediately, not just the one you are using, and so does a password reset. If you think somebody else has access, resetting your password ends their session as well as yours.

    Connections and hosting

    The site and app are served over HTTPS. In production the app sends HTTP Strict Transport Security, so a browser that has visited once will refuse to connect over plain HTTP afterwards, and a content security policy limits where the page may load code from.

    The service is hosted on Railway, in the United States, which means your data is stored and processed in the United States.

    Connected bank accounts

    Bank linking is built and is not switched on in production yet. Today every account in Pocket Runway is one you add and maintain yourself or import from a file, and the app is fully usable that way. That is deliberate: there has never been a point at which you had to hand over bank credentials to use it.

    Concretely, and for as long as this page says so:

    • No bank account can be connected. The linking screen is not available to any account, so no bank credentials are entered and no access token exists to store.
    • No transactions are synced from a bank, because there is no connection to sync from. Transactions arrive by manual entry, CSV import, or a migration from another budgeting app.
    • No deposit is examined to suggest a paycheck. The prompt that offers to confirm a detected paycheck runs on bank-synced deposits only, so it never appears. You set your pay schedule yourself, and a migration from another app may propose one from the file you uploaded for you to confirm.

    Everything below describes how bank linking works when it is turned on. It runs through Plaid:

    • Pocket Runway never receives your bank username or password. You enter those with Plaid, not with us. What comes back to us is an access token plus the account and transaction data you approved.
    • That access token is encrypted before it is stored, using AES-256-GCM with a key held in the server environment rather than in the database. It is never returned by any API route and never written to a log.
    • Disconnecting converts your accounts to manual ones; it does not delete them. Your history, your balances and your net worth stay intact, because deleting them would orphan every transaction that referenced them, including rows you typed yourself.
    • There is an off switch. Plaid can be switched off service-wide without unlinking anyone or deleting anything, which is what an outage or a credential rotation needs. Disconnecting your own bank keeps working even then, because trapping somebody in a live connection would be worse than the problem the switch was flipped for.

    Plaid's handling of your data is governed by Plaid's own privacy policy.

    Analytics, and what is kept out of it

    Pocket Runway counts page views two ways, and neither carries a financial figure.

    Our own counting stores the page path with any query string removed, the referring site's hostname rather than the full URL, whether the request came from a crawler, and a one-way hash of your IP address and browser. That hash is re-salted every day, so it counts distinct visitors within a day and cannot follow anyone from one day to the next. No IP address is stored, no account is recorded next to a page view, and the records are deleted automatically after 90 days.

    Google Analytics runs on the public pages and in the app, and receives page views, referrer, device and browser details, approximate location from your IP address, and a small number of events: sign-ups, logins, sign-up button clicks and checkout starts. It does not receive your balances, transactions, or the contents of your account. Query strings are stripped before a page view is recorded, because in-app links can carry sign-in and password-reset tokens.

    The Cookie Policy lists every cookie and how to opt out.

    The calculators on this site send nothing anywhere. The daily spending allowance, paycheck allocation, sinking fund, three-paycheck month and irregular income calculators run entirely in your browser. The figures you type are not transmitted, not stored, not logged, and not added to any Pocket Runway account.

    Other services that see some of your data

    • Stripe processes payments. Full card numbers never reach our servers.
    • Resend delivers transactional email such as verification and password resets.
    • Sentry collects error diagnostics, with personal information stripped before transmission.
    • Anthropic receives summary financial data to generate the AI spending insights, without personally identifying information attached.
    • OpenAI receives figures only if you connect the optional ChatGPT integration, only in response to a question you ask there. That connection is read-only: it can report your numbers and cannot log spending, move money, or change anything in your plan. You can disconnect it at any time, and signing out or changing your password ends it immediately.

    The Privacy Policy lists each of these with a link to its own policy.

    Logging

    Diagnostic logs are written when something goes wrong. Access tokens, passwords and card details are not included in them: bank access tokens in particular are never logged or returned, and errors from the bank provider are logged as their structured response rather than as whole error objects, specifically so a credential cannot ride along in a stack trace.

    This is a discipline enforced in the code, not a guarantee that no log line will ever be imperfect. If you find something that looks wrong, please report it.

    Exporting your data

    A complete JSON backup of your account data can be downloaded from your account settings on a paid plan. It contains your accounts, transactions, bills, income and goals, so treat the file as sensitive once it is on your device. You can also ask us for a copy by email, whatever plan you are on.

    Deleting your account

    You can delete your account from your account settings. It asks for your password to confirm, cancels any active subscription, and then removes your rows from every table in the database rather than flagging the account as inactive. Backups may retain data for up to 30 days afterwards, and Stripe keeps payment records independently, as financial regulations require.

    One current limitation: an account created with Google sign-in and no password cannot yet be deleted from the settings screen, because the confirmation step asks for a password. Email support@pocketrunway.com and it will be done for you. This is a gap in the self-service flow, not in the deletion itself.

    Reporting a problem

    Email support@pocketrunway.com. If you believe you have found a security issue, please include enough detail to reproduce it and give us a chance to fix it before publishing.

    Pocket Runway is a small, independently built product. What it can honestly claim is careful engineering, established providers for the sensitive parts, and a clear account of what it holds. No system is completely secure, and anyone telling you otherwise about theirs is worth being suspicious of.

    Related

    This page describes how Pocket Runway works at the time of writing and may change as the product does. The Privacy Policy is the governing document where the two differ.