Privacy policy

1. Who we are

Budgy (“Budgy”, “we”, “us”, or “our”) provides a personal budgeting app and the website at budgy.nz. We are based in Aotearoa New Zealand and handle personal information under the New Zealand Privacy Act 2020.

2. Information we collect

Depending on how you use Budgy, we may collect:

• Account information: your email address, name where provided by your sign-in provider, authentication identifiers, and account preferences.
• Financial information: connected account details, balances, transaction records, merchant descriptions, transaction categories, and bank-feed metadata obtained through Akahu when you connect a supported account.
• Budget information: envelopes, allocations, upcoming costs, goals, notes, corrections, rules, and other choices you make in Budgy.
• Connection credentials: credentials or tokens needed to maintain a bank connection. These are encrypted at rest and are not shown back to you after they are saved.
• Device and service information: app version, device type, operating system, notification token and preferences, sync status, request logs, and error or diagnostic information needed to operate and secure the service.
• Support information: messages and attachments you send when asking for help.
• Product-update information: your email address, confirmation status, subscription preferences, and email delivery events when you ask us to keep you posted about Budgy.

The Budgy marketing website does not currently use advertising cookies or third-party analytics. We may use Cloudflare Turnstile to distinguish genuine newsletter requests from automated abuse.

3. How we use information

We use personal information to:

• authenticate you and provide the Budgy app;
• import, normalise, classify, and display transactions;
• calculate envelopes, upcoming needs, goals, balances, and trends;
• sync your connected accounts and send notifications you have enabled;
• respond to support requests and service communications;
• send launch and product updates you have requested and confirmed;
• protect Budgy and its users, investigate errors, and prevent misuse; and
• comply with legal obligations and enforce our terms.

Budgy may use automated rules to suggest or apply a transaction classification. You can review and correct how transactions are assigned.

4. When we share information

We share information only where reasonably necessary to provide or protect Budgy, including with:

• Akahu, to connect supported New Zealand financial accounts and retrieve account and transaction information at your direction;
• Supabase and its infrastructure providers, for authentication, database, server functions, and secure service operation;
• Cloudflare, to host and protect the Budgy website and process website form submissions;
• Resend, to deliver requested emails, maintain the product-update contact list, and process subscription preferences and delivery events;
• Apple, when you use Apple sign-in, receive iOS push notifications, or obtain the app through the App Store;
• professional advisers or authorities where required by law, or where necessary to establish, exercise, or defend legal rights; and
• a successor organisation if Budgy is involved in a merger, acquisition, financing, reorganisation, or sale, subject to appropriate confidentiality protections.

These providers may process information outside New Zealand. We take reasonable steps to ensure overseas disclosures receive safeguards comparable to those required by New Zealand privacy law. We require service providers that process personal information for us to protect it consistently with this policy and applicable law.

5. Storage and security

We use reasonable administrative, technical, and organisational safeguards appropriate to the sensitivity of financial information. These include access controls, encrypted network connections, encrypted bank credentials, and separation between provider records and Budgy’s budgeting ledger.

No internet service can guarantee absolute security. Keep access to your email, Apple account, device, and Budgy account secure, and contact us promptly if you suspect unauthorised access.

6. Your choices and rights

You may disconnect a connected bank feed and disable Budgy notifications from the app or iOS settings. You can unsubscribe from product updates using the link in any update email. You may also ask us to access or correct personal information we hold about you, or request deletion of your Budgy account and associated information, subject to any information we must retain by law.

Send a request from the email address associated with your account to privacy@budgy.nz. We may need to verify your identity before completing a request. If you are not satisfied with our response, you may contact the New Zealand Office of the Privacy Commissioner at privacy.org.nz.

7. How long we keep information

We keep personal information only for as long as it is reasonably needed for the purposes described above, including to provide your account, maintain security and audit records, resolve disputes, and meet legal obligations. Backup copies may remain for a limited period after information is deleted from active systems.

We keep a confirmed product-update address while you remain subscribed. If you unsubscribe, we may retain a suppression record so we can continue to honour that choice.

8. Children

Budgy is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us so we can investigate and take appropriate action.

9. Changes to this policy

We may update this policy as Budgy changes. We will publish the updated version here and change the “Last updated” date. If a change materially affects how we use personal information, we will provide reasonable notice through the app, by email, or both.

10. Contact us

For privacy questions or requests, email privacy@budgy.nz. For general help, visit Budgy Support.