Privacy policy

Bread Jar is a household budgeting app. This page describes exactly what it collects, why, where it is kept, and how to get rid of it. It describes the software as it actually behaves, not as a general statement of intent.

The short version

• We never ask for your bank credentials and Bread Jar has no connection to any bank or financial institution. Every figure in the app is one you typed in.
• We do not sell your data, and we do not share it for advertising.
• There is no analytics, tracking or advertising code in the app.
• Your budget is visible to the members of your household. Our support staff can see how your household uses the app, but the amounts are hidden from them unless you have asked us for help and a named person unlocks them — briefly, and on the record. How that works.
• You can delete your data at any time, and deletion is real.

What we collect

Your account

Signing in uses Google. Google gives us your name, email address and profile picture URL, plus an identifier for the account. We do not receive and cannot see your Google password. We do not request access to your Gmail, Drive, Calendar or contacts.

What you enter

Everything the app is for: household and account names, opening balances, categories and goals, the transactions you record, recurring bills and income, and the homes, rentals and vehicles you add. This is financial information about your household, and we treat it as sensitive.

Technical data

Our hosting provider processes standard web-server information — IP address, browser user agent, requested URL, timestamps — in order to serve the site and protect it from abuse. We do not combine this with your budget data to build a profile.

Email you send us

If your household enables recording expenses by email, messages sent to that address are received on our behalf, and their sender, subject, body and delivery-authentication results are processed to create the transaction. A record of each message — including whether it was accepted or rejected and why — is stored so that the household can audit it. Do not send anything to that address that you would not want stored.

Cookies

Bread Jar sets two cookies. Both are strictly necessary for the app to function, and neither is used for tracking or advertising.

There are no third-party cookies, no advertising pixels and no cross-site trackers, which is why the app does not show a cookie banner.

Who else touches your data

We use a small number of service providers to run the app. They process data on our instructions and for no purpose of their own.

We do not sell personal information, and we do not share it with anyone for advertising or marketing. We would disclose data if legally compelled to, and would tell you unless prohibited from doing so.

Sharing inside a household

A household is a shared budget. Every member can see all of its accounts, balances, categories and transactions, including who recorded each one. Owners and admins can additionally invite and remove people. Inviting someone to your household gives them access to its complete financial history. Invitations are sent to a specific email address and can only be accepted by the Google account with that address.

When our staff can see your budget

Answering a support question sometimes means looking at the household it is about. We would rather tell you exactly how that works than leave you to assume it either never happens or happens freely.

What support staff can see without asking

Staff who handle support can see facts about how a household uses the app: its name, when it was created, how many members it has, how many categories, how many entries were recorded in the last month, and how long it has been since anyone recorded anything. This is what answers most questions — an import that did not arrive, an invitation that was not received — and it contains none of your figures.

What is hidden, and what it takes to see it

Amounts are hidden by default. Not blurred or collapsed — the figures are removed before the page is built, so they are not present in what the console receives.

To see them, a member of staff must record why they need to and which conversation with you it relates to. Doing so unlocks one household, for fifteen minutes, for that one person. It does not unlock any other household, it does not extend to their colleagues, and there is no way for anyone to unlock everything at once. When the fifteen minutes are up the figures are hidden again.

It is written down

Every unlock is recorded: who did it, which household, when, the reason they gave, and the conversation it referred to. The record is written in the same operation as the unlock itself, so access without a corresponding record is not something that can happen. You can ask us for the record of who has looked at your household, and we will give it to you.

What staff cannot do

Support staff cannot change your budget. They cannot add, edit or delete a transaction, move money between categories, or alter an amount — the console has no ability to write to a household’s figures at all. If something needs correcting, we will walk you through it or tell you exactly what to change.

Who counts as staff

The console is reachable only by accounts in Bread Jar’s own Google Workspace, and only those an administrator has added to a support list. Being an employee is not enough on its own. When someone leaves, suspending their Workspace account removes their access immediately.

Where it is stored and for how long

Your data lives in a Postgres database in the United States. If you are outside the United States, using Bread Jar means your information is transferred there.

We keep your data for as long as your account exists. Deleting a household deletes its accounts, transactions, categories, budget entries, recurring items and invitations. Deleting your user account deletes your sign-in record and sessions. Records of email we sent or received are kept so that delivery and inbound activity remain auditable.

Security

Traffic is encrypted in transit, and the database is encrypted at rest by our provider. Sessions are stored server-side and expire after 30 days. Every page and every action in the app resolves your household membership before returning or changing anything, so one household cannot read another’s data.

Access by our own staff is treated as an event to be controlled and recorded rather than a matter of trust: figures are hidden from the support console by default, unlocking is per-person and per-household for fifteen minutes, and every unlock is logged with a reason.

No system is perfectly secure. Because we never hold bank credentials, the worst case is exposure of the figures you entered rather than access to your money.

Your choices

• See your data. Everything we hold about your budget is visible in the app.
• Correct it. Every figure is editable.
• Delete it. Delete accounts and households in the app, or email us to remove your user account entirely.
• Leave. Remove yourself from a household at any time.
• Ask who has looked. Write to us and we will tell you every occasion on which a member of our staff unlocked your household’s figures, with the reason given each time.

Depending on where you live you may have further rights — for example under the GDPR or the CCPA — including access, portability, correction, erasure and objection. Write to us and we will honour them.

Children

Bread Jar is meant for adults managing a household. Do not create an account for a child under 13. A parent may of course invite an older child into a household; that child’s activity is then visible to the household in the ordinary way.

Changes

If this policy changes in a way that materially affects you, we will say so in the app or by email before it takes effect. The effective date at the top always reflects the current version.

Contact

Questions, requests or complaints: support@breadjar.app.