Security posture
Short version. You choose what to share. Your plan, your linked data, and your account can all be deleted, any time; the records we must keep are that you accepted the terms and, if you paid, the billing record. We don’t sell or rent your data, ever. We don’t want control of your money, we just want to tell you where to put it.
The free calculators and Nurse schedules. Overtime, active-duty pay, retirement, and Nurse schedule math run in your browser before you choose to save. When you confirm a Nurse schedule while signed in, we save the normalized month to your account so it can reopen on another signed-in device and keep the pay settings used for its historical projection. That account record contains the month, schedule dates, shift types, hours, overtime and charge flags, source and edit times, plus the frozen pay settings and integer-cent row estimates. It does not contain a screenshot, raw OCR response, employer or facility, name, address, free text, goals, or analytics content. If you snap your posted month, the screenshot is uploaded and read by our AI provider, Anthropic, then the transient read is deleted after your browser picks it up; only the normalized facts you confirm enter the account record. Deleting the schedule removes its account and browser copies, and account deletion removes the schedule through the same purge. We do count page visits with cookieless analytics that carry no names and no dollar amounts, and if you accept the ads consent banner, advertising pixels also load on some marketing pages; the full posture, including the Do Not Share control, lives on the privacy page.
Your paystub. You draw the crop box before anything leaves your phone, and we ask you to keep your member name, SSN, and street address outside it. The reading itself is done by our AI provider, Anthropic. The extraction schema has no field for a member name, SSN, or street address; state and ZIP are intentional fields. Before extracted text continues through our server, an automatic filter redacts SSN-shaped text and runs of six or more digits. It does not detect names or addresses, and it does not alter the uploaded image. The uploaded image is stored transiently while it is read, then deleted when the read completes, in all cases within approximately one hour. A paystub read can retain extracted pay figures and pay-code lines whether or not you save a plan. When a paystub read becomes accepted evidence in your account, account deletion deletes its pay-code lines and clears its corpus dollar and pay-period-date fields, member code, and account link; only anonymized operational PaystubReadEvent metadata remains for that linked read. Account deletion cannot reach a read that was never linked to the account. We also keep a record that you accepted the terms before snapping, tied to your device and the network address we saw, not to your name.
What we store when you save. Your email, the numbers of your plan, and how you found us: the campaign and page that brought you, which we keep as channel labels, plus an advertising click identifier we clear after 90 days. If you give us a first name, we store it, and only that: our member records carry no last names, no SSNs, and no addresses by design. The name is optional, you can change or clear it any time on your account, and nothing you do depends on giving it. Plans and account data live in our database on Railway, behind our API; your password is held by our authentication provider (Supabase), never in MoneyBadger’s own database.
Bank linking is optional and read-only. Linking runs through Plaid; your bank credentials go to Plaid, not to MoneyBadger. The access tokens we hold are stored encrypted. You can disconnect at any time, which stops the sync, and “Remove + delete data” deletes what we already read along with the connection.
Billing. Payments run through Stripe. Your card details never touch our servers.
Transport and hosting. HTTPS everywhere with modern TLS. The web app is served by Netlify; the API and database run on Railway.
Monitoring. We monitor errors so we can fix them. Error reports are scrubbed of identifying data, and we do not use session replay.
Deletion. You can delete your account from your account page at any time. Deletion is honored within 30 days, and it covers your plan, your linked data, and your member record.
Security concern? Please email feedback@moneybadger.us with subject line “Security”. We respond within 48 hours.