Privacy Policy

Last updated: October 2026

This Privacy Policy explains how Thrifty Owl ("we", "us", "our"), a trading name of IJPUK Solutions Limited, collects, uses, stores, and protects your personal information when you use our service at thriftyowl.money.

1. What information we collect

Account information

When you register, we collect your email address and a hashed password. If you sign in via Google, we receive your Google account's email address.

Financial data

You voluntarily enter your financial data — account names, balances, transactions, budgets, and categories. This data is stored securely in our database and is accessible only to you and to anyone you choose to share your profile with (see section 5).

AI assistant access (optional, Pro)

If you turn on AI access, we store a name you give each access token, when it was created and last used, and a one-way hash of the token (never the token itself, which is shown to you once). We don't store what your AI assistant asks or what it is sent.

We also keep a record, shown to you under Activity, of transactions added, changed or deleted by anyone you share your profile with or by your AI assistant: who, when, and a short description of the transaction. It is deleted with your account.

Usage data

We collect standard web server logs (IP address, browser type, pages visited, timestamps) for security monitoring and performance improvements. We do not use these logs for advertising. With your consent, we also collect analytics and advertising data through cookies, as described in section 6.

2. How we use your information

• To provide and operate the Thrifty Owl service
• To authenticate you and keep your account secure
• To send transactional emails (password resets, account confirmations)
• To investigate security incidents and abuse
• To improve the service based on aggregate, anonymised usage patterns

We do not use your financial data for advertising, profiling, or selling to third parties.

3. How we store and protect your data

All data is stored on servers in the United Kingdom and European Union. We use:

• TLS encryption for all data in transit
• Encryption at rest for sensitive database fields
• Hashed passwords using industry-standard bcrypt
• Role-based access controls — only you can access your data
• Regular automated backups retained for 30 days

4. Data retention

We retain your account data for as long as your account is active. If you delete your account, your personal data and financial records, including any AI access tokens, are permanently deleted from our live database straight away, except where we are required by law to retain records. Copies held in our routine backups are overwritten within 30 days.

5. Sharing your data

We do not sell, rent, or trade your personal data. We share data only with:

• Hosting providers — for server infrastructure (bound by data processing agreements)
• Payment processors — Stripe, for Pro subscription billing (they handle card data; we never store it)
• People you share your profile with — only if you invite them (a Pro feature). They get read-only (Viewer) or edit (Editor) access to all of your accounts, categories, payees and budgets, and you can remove their access at any time
• Analytics and advertising providers — only with your consent, via the cookie banner: Google (Google Tag Manager and Google Analytics) for visitor analytics, New Relic for error and performance monitoring, and Meta (Facebook) for measuring our advertising on our public pages. They receive browser details and the public pages you viewed. No financial data from your account is ever shared with them
• An AI assistant you connect — only if you turn on AI access and give an assistant your access token. It can then read your accounts, balances, spending, bills and budget and, only if you chose read-and-write access when creating that token, add transactions and change the category of existing ones; and whatever it reads is sent to that assistant's provider, whose own privacy policy applies. We never send your data to an AI provider ourselves, and you can revoke a token at any time from Settings, which stops that access immediately.
• Law enforcement — only when required by a valid legal order

6. Cookies

We use essential cookies required to keep you logged in and the site working. With your consent, given via the cookie banner, we also use:

• Site-monitoring cookies (New Relic Browser) to find and fix errors and slow pages
• Analytics cookies (Google Tag Manager and Google Analytics) to understand how visitors use the site
• Advertising cookies (the Meta pixel) on our public pages only, to measure how well our advertising on Facebook and Instagram works and to show our ads to people who may be interested

If you choose "Necessary only", none of these are set. See our Cookie Policy for full details and how to change your choice.

7. Your rights (UK GDPR)

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten") — you can do this yourself at any time by deleting your account from Settings → Personal data
• Export your data — you can download a copy of your account details and every account's transactions yourself from Settings → Personal data
• Object to processing
• Withdraw consent at any time

To exercise any of the other rights, or if you need help with the above, please contact us at info [at] thriftyowl [dot] money.

8. Children's privacy

Thrifty Owl is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us personal data, please contact us immediately.

9. Changes to this policy

We may update this Privacy Policy periodically. We will notify you of significant changes by email and by posting the updated policy with a new "Last updated" date. Continued use of the service after changes constitutes acceptance.

10. Contact us

If you have any questions about this Privacy Policy or our data practices, please contact us at info [at] thriftyowl [dot] money.

IJPUK Solutions Limited is the data controller for the personal information described in this policy. It is registered in England and Wales (company number 11517521), and its registered office is 6 Chatham Court, Belper, Derbyshire DE56 0DX.