What a budgeting app sees when you link your bank

Most budgeting apps that import your transactions don't talk to your bank themselves. A data company does it for them: Plaid, MX, Finicity (now part of Mastercard) or a bank-run network such as Akoya. You see a pop-up, pick your bank and approve. Behind it, that company collects data from your accounts and passes it to the app.

None of this is secret, but it is rarely spelled out on the screen where you tap Connect. Everything below about Plaid is quoted from Plaid's own pages, read on 6 October 2026. Other aggregators publish their own policies, and the same questions apply to them.

01Who is in the middle

Plaid describes its business plainly: "Plaid doesn't charge you for our services. When you connect your financial accounts to an app like Venmo or Oportun, the app pays us a fee to enable that connection." So there are three parties to every link: your bank, the aggregator and the app. Each has its own privacy policy, and the app's is only one of them.

• Plaid is the name most people see in the connection pop-up.
• Finicity runs Mastercard's open finance services in the US. Mastercard's developer documentation says its US open finance solutions "are provided by Finicity, a Mastercard company."
• Akoya calls itself "the only 100% API-connected, consumer permissioned data sharing network." When it launched in 2020, its announcement said it "eliminates the need for consumers to share account user ids and passwords."
• MX is another large aggregator that many banks and apps use.

02What the connection can read

Plaid's End User Privacy Policy (effective 8 December 2025) lists what it collects from the accounts you connect. Depending on the account type and what the app asks for, it includes:

An app usually asks only for what it needs, and a budgeting app mostly wants transactions and balances. But the transaction history is the part that says the most about you: where you shop, how often, and how much. Plaid's policy also says: "We only share your personal financial data with third parties to power the services you requested, when you consent, and/or to protect against actual or potential fraud."

03Password or token: two ways to connect

There are two ways a connection can be made, and which one you get depends on your bank.

• You type your bank username and password into the aggregator's window. Plaid's consumer page describes this: "you will be prompted to enter the username and password associated with those accounts," and adds that "we don't share the username and password for your financial institution with your apps."
• You are sent to your bank's own login page instead, and the bank hands the aggregator a token. Plaid's documentation for banks describes the result: "Credentials stay with you. Tokens are scoped, revocable, and expire."

The second kind is better for you. Your password never leaves your bank, and the bank can see and end the connection. If the pop-up opens your bank's real website or app to log in, you are on the token path. If you type your bank password into a window that isn't your bank's, you are on the first path.

04How long the data stays

Plaid's policy gives no fixed number of days. It says: "We retain your data only as long as it is needed," and lists exceptions such as legal requirements, connections that are still active, and fraud prevention. In practice, a connection you never removed is a connection that is still active. Deleting the budgeting app from your phone does not end it.

05How to see and cut off a connection

1. 1Unlink the bank inside the app first, usually under Settings or Accounts. Then delete your account in the app if you are done with it, because unlinking alone doesn't erase the history it already imported.
2. 2For anything that went through Plaid, open Plaid Portal at my.plaid.com. Plaid says you can use it to "terminate the connection between apps and your financial accounts and delete associated data stored in Plaid's systems."
3. 3Look in your bank's own security settings for a list of connected apps or third-party access, and remove anything you no longer use. Not every bank has one, and the names differ.
4. 4Change your bank password if you ever typed it into an aggregator's window and have stopped using the app.

06Where the US rules stand

In October 2024 the Consumer Financial Protection Bureau finalized a Personal Financial Data Rights rule under section 1033 of the Dodd-Frank Act. Among other things, it was meant to move the market away from sharing bank passwords. It is not in force. On the CFPB's own pages, read on 6 October 2026, the rule's compliance dates are stayed by a federal court in Forcht Bank, N.A., et al. v. Consumer Financial Protection Bureau, and the Bureau has been reconsidering the rule since an advance notice of proposed rulemaking on 22 August 2025. No replacement rule appears on those pages yet.

So for now, how your data is handled depends mostly on the policies of the app and the aggregator you agreed to, which is a good reason to read both.

07What a bank feed can't tell you anyway

Here is the trade, seen from the other side. This is one shopping trip.

A linked bank feed sees one line: Fairway Pharmacy, $43.83, on 1 October. It can't tell the allergy tablets from the birthday card, so a budgeting app guesses one category for all of it. The receipt splits the same $43.83 into $21.48 of health products, $10.79 of personal care, $5.99 of food, $4.50 of gifts and $1.07 of tax.

That is the case for tracking from receipts instead of a bank link: more detail, and nothing connected to your bank at all. Sorayli's receipt scanner reads each line and suggests a category before anything is saved, and Sorayli has no bank connection of any kind. The cost is that you capture each purchase yourself. The guide on tracking expenses without linking your bank shows a weekly routine that keeps it to a few minutes.

08A checklist before you tap Connect

1. 1Find out which aggregator the app uses. It is usually named in the pop-up or in the app's privacy policy.
2. 2Check whether you are sent to your bank's own login. If not, decide whether you are comfortable typing your bank password somewhere else.
3. 3Read what the app says about selling data and advertising. We read six policies in do budgeting apps sell your data?
4. 4Connect only the accounts the app needs. A budget rarely needs your retirement account.
5. 5Put a reminder in your calendar to review connections in Plaid Portal and your bank's settings once a year.