Privacy Policy
We keep this simple and plain-English. Your data is yours — we protect it and never sell it.
Last updated: July 2026
This Privacy Policy explains how Thrifty Owl ("we", "us", "our") collects, uses, stores, and protects your personal information when you use our service at thriftyowl.money.
1. What information we collect
Account information
When you register, we collect your email address and a hashed password. If you sign in via GitHub, we receive your GitHub username and email address.
Financial data
You voluntarily enter your financial data — account names, balances, transactions, budgets, and categories. This data is stored securely in our database and is only accessible to you.
Usage data
We collect standard web server logs (IP address, browser type, pages visited, timestamps) for security monitoring and performance improvements. We do not use this data for advertising.
2. How we use your information
- To provide and operate the Thrifty Owl service
- To authenticate you and keep your account secure
- To send transactional emails (password resets, account confirmations)
- To investigate security incidents and abuse
- To improve the service based on aggregate, anonymised usage patterns
We do not use your financial data for advertising, profiling, or selling to third parties.
3. How we store and protect your data
All data is stored on servers in the United Kingdom and European Union. We use:
- TLS encryption for all data in transit
- Encryption at rest for sensitive database fields
- Hashed passwords using industry-standard bcrypt
- Role-based access controls — only you can access your data
- Regular automated backups retained for 30 days
4. Data retention
We retain your account data for as long as your account is active. If you delete your account, your personal data and financial records are permanently deleted within 30 days, except where we are required by law to retain records.
5. Sharing your data
We do not sell, rent, or trade your personal data. We share data only with:
- Hosting providers — for server infrastructure (bound by data processing agreements)
- Payment processors — Stripe, for Pro subscription billing (they handle card data; we never store it)
- Law enforcement — only when required by a valid legal order
6. Cookies
We use essential cookies required to keep you logged in and the site working. With your consent, given via the cookie banner, we also use a small number of site-monitoring cookies to help us find and fix errors. We do not use advertising cookies or third-party tracking pixels. See our Cookie Policy for full details and how to change your choice.
7. Your rights (UK GDPR)
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data ("right to be forgotten")
- Export your data in a portable format (contact us and we'll provide a copy — in-app CSV export is not yet available)
- Object to processing
- Withdraw consent at any time
To exercise any of these rights, please contact us at info [at] thriftyowl [dot] money.
8. Children's privacy
Thrifty Owl is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us personal data, please contact us immediately.
9. Changes to this policy
We may update this Privacy Policy periodically. We will notify you of significant changes by email and by posting the updated policy with a new "Last updated" date. Continued use of the service after changes constitutes acceptance.
10. Contact us
If you have any questions about this Privacy Policy or our data practices, please contact us at info [at] thriftyowl [dot] money.