Do budgeting apps sell your data? We read their privacy policies

A budgeting app holds an unusually complete picture of your life: where you shop, what you earn, what you owe and, if it reads receipts, exactly what you bought. So it is fair to ask what the company does with it. The honest place to look is the privacy policy, because that is the document a company can be held to.

We read the policies of YNAB, Monarch, Copilot and EveryDollar on 6 October 2026, and quote them below with the date each policy gives. We also tried Rocket Money and PocketGuard. Both pages refused automated access when we checked, so we couldn't read them, and we haven't guessed what they say. Policies change, so check the date at the top of any policy before relying on it.

01What each policy says

EveryDollar is covered by the Ramsey Solutions privacy policy, which applies to all of Ramsey's products. Mint no longer exists as an app: its website now says "Mint has been reimagined on Credit Karma," and Credit Karma's site states that it "may be compensated through third party advertisers." If you moved from Mint to Credit Karma, read Credit Karma's policy rather than Mint's old one.

02Why "we don't sell your data" isn't the whole answer

Every app above says it doesn't sell your financial data, and we have no reason to doubt it. But three things sit outside that promise, and the policies say so themselves.

1. Advertising on the website

US state privacy laws define "selling" and "sharing" broadly enough to include the cookies and tracking pixels a company uses to advertise itself. That is why YNAB, Monarch and Copilot all offer an opt-out while also saying they don't sell your financial data. YNAB explains: "certain laws categorize these activities as 'selling' personal information or 'sharing' or 'processing' personal information for targeted advertising purposes – even though we never provide information in exchange for money." In plain terms, the marketing site may track you for ads, while the data inside the app is handled separately.

2. De-identified and aggregated data

Most policies keep the right to strip your name off your data and use or share the result. Copilot's says it may use "Aggregate/De-Identified Information for any purpose, including without limitation for research and marketing purposes, and may also disclose such data with any third parties at our discretion." Monarch's says it may disclose such data "to third parties for our lawful business purposes", provided it won't do so "in a manner that could identify you." YNAB's allows de-identified data to be used "for any purposes" and disclosed to its service providers. This is legal and common. Whether it bothers you depends on how much you trust de-identification.

3. The bank connection in the middle

If an app links to your bank, a data aggregator such as Plaid usually makes the connection, and it has its own policy. Our guide to what a budgeting app sees when you link your bank quotes what Plaid collects and how to revoke it.

03Why receipt data is more personal than a bank line

A bank feed records a shop and an amount. A receipt records the products. Here is a small pharmacy run:

The bank sees $33.94 at a pharmacy. The receipt says someone in the household is sick. Item-level data is what makes a receipt tracker useful, and it is also why its privacy terms matter more, not less. Any app that reads receipts, Sorayli included, should be held to a clear answer on what happens to those lines.

Sorayli's answer is in its privacy policy: "We do not sell your data. We do not share it with advertisers or data brokers. We do not read your bank accounts. Sorayli only knows what you enter or scan." Receipt photos are read by OpenAI, which under the API terms Sorayli uses "does not use your data to train its models" and keeps it for at most 30 days for abuse monitoring.

04How to opt out, app by app

• Monarch: its policy points to a "Do Not Sell or Share My Personal Information" request, and gives support@monarch.com as a contact for some privacy requests.
• Copilot: its policy says to select "Your Privacy Choices" on its website to opt out of disclosures through cookie and pixel technology.
• YNAB: its policy describes the right to opt out of "sales" and "sharing/processing of your information for targeted advertising", with state-specific instructions in the policy.
• EveryDollar: the Ramsey policy has an opt-out link for third-party interest-based advertising, and a "Do Not Sell or Share" page in its footer.
• Anywhere: a browser's privacy controls, and Global Privacy Control where a site honours it, limit website tracking. These rights mostly come from state laws such as California's, so what you can demand depends on where you live.

05Five questions to ask any money app

1. 1Does it sell my data, as its policy defines selling, and does it share data for advertising?
2. 2Does it use what I enter or scan for advertising, inside or outside the app?
3. 3Can it share de-identified or aggregated data, and with whom?
4. 4Do its AI providers train on my data?
5. 5Does it connect to my bank, and through which aggregator?