Privacy Policy

Latest Update: September 2026

Dollar Diary, Inc. (“Dollar Diary,” “we,” “us,” or “our”) operates a personal finance tracking web application. This Privacy Policy explains how we collect, use, disclose, retain, and protect your personal information when you use Dollar Diary at dollardiary.com and related services (collectively, the “Services”).

Please read this Privacy Policy carefully. It is a notice about our information practices, not a contract requiring you to consent to every practice described below.

Information We Collect

Information You Provide

Account and Profile Information. When you create or manage an account using Google sign-in, we collect your name, email address, profile picture, Google account identifier, linked or verified email addresses, and profile and display preferences. We do not receive your Google password.

User-Created Content. As you use Dollar Diary, you may create, upload, or import content including transactions, custom tags, tag groups, icons and reference images, transaction annotations (such as notes, discretion ratings, itemization, and splits), custom field values and files, budget configurations, saved SQL queries, and workspace profile images. If you create or join a workspace, this content is shared with all workspace members.

Workspace and Invite Information. When you create a workspace and invite others, we collect the invitee’s email address to send the invitation. When you join a workspace, your name and email are visible to other workspace members.

Payment Information. When you subscribe, payment details (card number, billing address) are collected and processed directly by Stripe. We receive only a Stripe customer ID, subscription status, plan details, and payment history. We do not store your full payment card information.

Communications and Feedback. If you contact us for support, report abuse, or submit feedback, we collect the information you provide, any attachments, and associated account and message metadata.

Information from Connected Services

Google Sign-In. Google provides the account and profile information described above when you sign in or link an email address, subject to your Google settings and permissions.

Banking Data via Stripe. When you connect a bank account, Stripe, Inc. handles all authentication directly. We never receive or store your bank login credentials. Through Stripe, we receive:

Bank account metadata (institution name, account name, account type, last four digits of account number)
Transaction data (date, amount, merchant name, merchant logo, category, payment method, transaction status)
A Stripe access token (encrypted at rest using AES-256-GCM) to enable ongoing transaction syncing

We use incremental syncing, meaning after the initial sync we only request new and updated transactions, not your full transaction history each time.

Information Collected Automatically

Usage Data. We may collect information about how you interact with the Services, such as pages visited, features used, and session duration.

Device and Connection Data. We may collect your IP address, browser type, operating system, and device information.

Log and Security Data. We collect request times and paths, diagnostic events, error reports, session and workspace identifiers, and security events to operate, troubleshoot, and protect the Services. Sensitive fields such as authentication tokens, bank access tokens, API keys, payment data, and verification codes are stripped from application logs.

Merchant Logo Requests. When a merchant logo is displayed from Logo.dev or Brandfetch, your browser requests the image from that provider. The provider receives your IP address, browser user agent, and the merchant domain being displayed, but we do not send it your transaction amount, account details, or other financial data.

Data About Others

You may provide another person’s email address when inviting them to a workspace or otherwise sharing the Services. Please provide another person’s information only when you have permission to do so. We use invitee information to deliver and manage the invitation.

Cookies and Similar Technologies

We use first-party cookies and similar browser storage as follows:

Category	Examples	Purpose and duration
Authentication and security	`session_token`, `session_intent`, `auth_intent`, `linked_sessions` or `linked_sessions_`, `oauth_state_`, and short-lived handoff cookies	Sign you in, protect authentication flows, switch between linked accounts, and safely complete redirects. Depending on the cookie, these last from 10 seconds to 399 days.
Preferences and application state	`dd_prefs` and local browser storage	Remember appearance, accessibility, and application preferences and cache application data. The preferences cookie lasts up to one year; browser-storage duration varies by setting and is cleared where appropriate on sign-out.
Demo operation	`demo_launch_intent`, `demo_user_id`, and `demo_refresh_stamp`	Start and maintain an isolated demo workspace. The launch cookie lasts up to two minutes; the workspace cookies last up to one hour.
Attribution	`dd_attribution`	Set only when a visit includes campaign parameters, an advertising click identifier, or an external referrer. It records that referral and landing page for up to 30 days so we can understand how a person found Dollar Diary if they create an account. It is not set for a direct visit with no attribution information.

We do not use third-party advertising cookies, cross-site tracking technologies, or personal information for interest-based advertising.

Most browsers let you block or delete cookies. Blocking authentication, security, preference, or demo cookies may prevent the corresponding parts of the Services from working. Some browsers transmit “Do Not Track” or Global Privacy Control signals. Because we do not sell personal information or use it for cross-context behavioral advertising, these signals do not change how the Services operate. Where applicable law requires otherwise, we treat a recognized opt-out preference signal as a valid request.

How We Use Your Information

We use the information we collect to:

Provide the Services: Process and display your transactions, tags, budgets, analytics, and other features
Sync banking data: Connect to your financial institutions via Stripe and retrieve transaction updates
Process payments: Manage your subscription, process charges, and provide billing history through Stripe
Power AI features: Identify merchants and generate tag keyword suggestions, SQL queries, and custom icon images via OpenAI (see “AI Features” below)
Improve the Services: Understand how the Services are used and identify areas for improvement
Personalize the Services: Remember your settings and tailor workspace and account experiences
Communicate with you: Send service-related notices, respond to support requests, and provide account updates
Ensure security and enforce our terms: Detect, investigate, and prevent fraud, abuse, prohibited conduct, and unauthorized access
Debug and monitor performance: Diagnose errors, maintain availability, and audit operational processes
Comply with legal obligations: Fulfill applicable legal and regulatory requirements

We may create aggregated or deidentified information that cannot reasonably be linked to you and use it to analyze, secure, and improve the Services. We do not attempt to reidentify deidentified information except to test whether our deidentification methods comply with applicable law. If we want to use your personal information for a materially different purpose that is incompatible with the purpose for which it was collected, we will provide any additional notice or obtain any consent required by law.

AI Features

Dollar Diary uses third-party AI APIs for limited purposes. OpenAI powers certain user-requested features:

Tag keyword generation: When you create or edit tags, we may send tag names and contextual labels to OpenAI to suggest related search keywords
Merchant enrichment: When we clean a bank’s raw transaction descriptor into a recognizable merchant name, we send that raw descriptor to OpenAI
SQL query generation: When you use the AI query assistant, your query prompt, table and column structure, tag names, custom field definitions, and budget definitions are sent to OpenAI
Icon image generation: When you use the custom icon generator, your text prompt, description, and any reference images you upload are sent to OpenAI to generate images

We may also use OpenAI to screen uploaded images for prohibited content. Separately, Anthropic may process redacted server error details and relevant source-code excerpts to help triage operational errors. Those triage payloads are designed not to include workspace data, bank credentials, or personally identifiable information.

We do not send OpenAI your transaction amounts, dates, annotations, bank account details, bank credentials, or full transaction dataset. The raw bank descriptor used for merchant enrichment is the only transaction-level field routinely sent to OpenAI. Raw descriptors may occasionally contain a person’s or business’s name as supplied by the financial institution. AI-generated results are suggestions only and may not be accurate.

Ownership of generated icons. All custom icon images produced by the icon generator are the property of Dollar Diary, Inc. and may be displayed publicly or used in landing pages, marketing materials, promotional content, and other Dollar Diary purposes without further notice or compensation. Generated icons may not be used in or in connection with any other commercial platform, product, or service. See Section 12(g) of the Terms of Service for full details.

How We Share Your Information

We do not sell your personal information. We share information only in the following limited circumstances:

Workspace Members. If you create or join a workspace, all workspace data (including transactions, tags, budgets, icons, bank connections, and saved queries) is accessible to every member of that workspace. You can leave a workspace at any time, and any member can duplicate a workspace into a new, independent copy they own (a duplicate includes only your own bank connections, not other members’). Workspace owners can remove members or delete the workspace.

Stripe. Bank connection and transaction data are exchanged with Stripe to enable account syncing. Payment and subscription data are also shared with Stripe for billing. Stripe’s handling of your data is governed by Stripe’s Privacy Policy.

Google. We exchange account authentication data with Google when you sign in or link a Google identity. Google’s handling of your data is governed by Google’s Privacy Policy.

OpenAI. Limited contextual data (such as raw bank descriptors, tag names, query prompts and workspace schema metadata, icon descriptions, and reference images) is sent to OpenAI for the AI-powered features described above. OpenAI’s handling of this data is governed by OpenAI’s Privacy Policy.

Infrastructure, Operations, and AI Triage Providers. We use service providers for database and application hosting, object storage, SQL execution, logging, email delivery, merchant logos, and server-side error triage. They process only the information needed to provide their services on our behalf. Our current providers and the data each receives are listed on our Subprocessors page.

Resend. We use Resend to send transactional emails such as workspace invitations and account verification messages. Your email address and name are shared with Resend for delivery. Resend’s handling of your data is governed by Resend’s Privacy Policy.

Airtable. If you submit feedback through the application, your feedback message, your account email address, and a user identifier are sent to Airtable for collection. Airtable’s handling of your data is governed by Airtable’s Privacy Policy.

Slack. In-app bug reports, feature requests, and support questions are also delivered to our private Slack support workspace so we can review and respond. The notification may include your feedback, account email address, user and workspace identifiers, workspace name and role, and the page from which you submitted it. Product milestone and demo entrance notifications may include your IP address, approximate location from our network provider, and device, operating system, and browser inferred from your user agent. Slack’s handling of this data is governed by Slack’s Privacy Policy.

At Your Direction. We may disclose information to a third party when you direct us to do so or consent to the disclosure, such as when you invite a person to a workspace or use an integration.

Professional Advisors. We may disclose information to lawyers, auditors, insurers, and other professional advisors when reasonably necessary for the services they provide to us.

Legal Requirements. We may disclose information if required by law, legal process, or government request, or to protect the rights, safety, or property of Dollar Diary, our users, or the public.

Business Transfers. We may disclose information to counterparties and their advisors while evaluating or completing a financing, merger, acquisition, reorganization, insolvency, or sale of all or part of our business or assets. Your information may be transferred to a successor as part of such a transaction. We will provide notice when required by law.

Public Display of Generated Icons. As described in the Terms of Service, custom icons generated through the Services may be displayed publicly in the Services, landing pages, marketing materials, product showcases, or other promotional content. Reference images you upload are not publicly displayed under this provision.

We do not share your transaction data, tagging data, budgets, or other User Content with any third party for their own purposes. Within a workspace, all members have equal access to shared data, and you control who is invited.

Data Security

We implement security measures to protect your information:

Encryption in transit: All data transmitted between your browser and our servers is encrypted via HTTPS/TLS
Encryption at rest: Bank access tokens are encrypted using AES-256-GCM before storage
Data isolation: Data is strictly isolated between workspaces. No one outside a workspace can access its data. Within a workspace, all members have access to shared data (transactions, tags, budgets, etc.)
API key security: API keys are generated with configurable scopes and optional expiration to limit access
No credential storage: Your bank login credentials are never transmitted to or stored by Dollar Diary

No system is perfectly secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.

Data Retention

We retain personal information for as long as reasonably necessary to provide the Services and for legitimate business and legal purposes. In deciding how long to retain information, we consider its amount, nature, and sensitivity; the purposes for which it is processed; the risk of harm from unauthorized use or disclosure; whether those purposes can be achieved another way; and applicable legal, accounting, reporting, fraud-prevention, and dispute-resolution requirements. Specifically:

Account and User Content: Retained until you delete your account
Transaction data: Retained until you delete your account or remove specific transactions
Bank connection tokens: Retained until you disconnect the bank account or delete your account
Billing records: Retained as required for tax, legal, and accounting purposes
Usage logs: Retained for a reasonable period to support security and service improvement

When you delete your account, we remove associated personal information from active systems, except information we must retain for legal, accounting, security, fraud-prevention, or dispute-resolution purposes. Residual copies may remain in encrypted backups for a limited backup cycle before automatic deletion. When information is no longer required, we delete it, deidentify it, or isolate it from further use until deletion is possible.

Your Rights and Choices

Export your data. You can export your transaction data at any time in JSON or CSV format with customizable filters (date range, transaction state, tag inclusion).

Access or update your information. You can review and update certain profile, account, and workspace information through the Services. You may contact us to request access to or correction of other personal information.

Delete your account. You can delete your account at any time. This permanently removes associated data from active systems, subject to the limited retention and backup exceptions described above. Account deletion is irreversible.

Disconnect bank accounts. You can disconnect any linked bank account at any time, which stops future transaction syncing for that account.

Manage API keys. You can create, revoke, or modify API keys and their scopes at any time.

Email communications. You can opt out of non-essential communications. Service-critical notices (such as billing confirmations or security alerts) cannot be opted out of.

Declining to provide information. You may choose not to provide personal information, but we may be unable to provide a feature when that information is necessary to operate it.

Depending on your jurisdiction, you may have additional rights under applicable data protection laws, including the right to access, correct, restrict processing, or request deletion of your personal information. To exercise these rights, contact us at info@dollardiary.com.

US State Privacy Rights

This section applies to residents of US states whose privacy laws apply to us and grant the rights described below. The rights available to you vary by state, are not absolute, and may be subject to legal exceptions.

Information Practices. During the preceding 12 months, we have collected the following categories of personal information: identifiers (such as name, email address, account identifiers, IP address, and user and workspace IDs); customer-record information (such as account and profile details); financial and sensitive personal information (such as connected-account metadata and transaction data); commercial information (such as subscription and billing history); internet or electronic network activity (such as request, usage, browser, device, and diagnostic data); user content; and inferences reflected in the spending classifications and patterns you create through the Services.

We collect this information directly from you, automatically from your browser or device, and from connected services such as Google and Stripe. We use it for the purposes described in “How We Use Your Information” and disclose it for business purposes to the categories of recipients described in “How We Share Your Information.” We retain it using the criteria described in “Data Retention.”

Sensitive Personal Information. We use and disclose sensitive personal information only as reasonably necessary to provide, secure, and maintain the Services, process transactions you request, and comply with law. We do not use sensitive personal information to infer characteristics about you.

Sale and Sharing of Personal Information. We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising purposes.

Targeted Advertising and Profiling. We do not process personal information for targeted advertising. We do not use personal information for profiling or automated decision-making that produces legal or similarly significant effects concerning you.

Children. We do not have actual knowledge that we sell or share the personal information of anyone under 16 years of age.

Your State Privacy Rights. Depending on your state and subject to applicable exceptions, you may have the right to:

Know and Access: Request information about our collection, use, and disclosure of your personal information and obtain a copy in a portable format
Delete: Request deletion of personal information we collected about you
Correct: Request correction of inaccurate personal information
Opt Out: Opt out of sale, targeted advertising, or certain profiling where a business engages in those practices; Dollar Diary does not engage in those practices
Limit: Limit certain uses or disclosures of sensitive personal information where applicable; Dollar Diary does not use sensitive personal information for purposes that trigger this right
Appeal: Appeal our denial of a privacy request where applicable
Non-Discrimination: Exercise your privacy rights without unlawful discrimination or retaliation

Exercising Your Rights. You can delete your account through the application. For any other request or appeal, contact us at info@dollardiary.com and describe the right you want to exercise. We may request information reasonably necessary to verify your identity, authority, and state of residence. We will respond within the period required by applicable law and explain any denial and available appeal process.

Authorized Agents. You may designate an authorized agent to submit a request where permitted by law. We may require proof of the agent’s authority and may ask you to verify your identity or confirm the request directly with us.

California Shine the Light. We do not disclose personal information to third parties for their own direct-marketing purposes. California residents may submit a request about these practices to info@dollardiary.com with “Shine the Light Request” in the subject line.

Nevada Residents. We do not sell covered information as “sale” is defined under Nevada law. Nevada residents may nevertheless submit a verified request to opt out of any future covered sale by emailing info@dollardiary.com.

Other Sites and Services

The Services may link to websites, applications, or online services operated by third parties. A link does not mean that we endorse or control the third party. Their privacy practices, not this Privacy Policy, govern information you provide directly to them, and we encourage you to review their privacy notices.

Children's Privacy

The Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you are a parent or guardian and believe a child provided personal information through the Services, contact us. If we learn that we collected a child’s information in a manner prohibited by law, we will take steps required by law to delete it.

Data Storage and International Considerations

Your information is processed and stored primarily in the United States. Our service providers may process information in the United States and other locations where they operate. The Services are designed for and marketed to users in the United States and are not directed at individuals in the European Economic Area (EEA), United Kingdom, or other jurisdictions that require compliance with the General Data Protection Regulation (GDPR) or similar data protection frameworks. We do not represent that the Services comply with GDPR, the UK Data Protection Act, or equivalent regulations.

If you access the Services from outside the United States, you do so at your own initiative and are responsible for compliance with applicable local laws. By using the Services, you consent to the transfer and processing of your information in the United States, which may have different data protection standards than your jurisdiction.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the revised policy and update the “Latest Update” date. If changes materially affect how we use or disclose personal information, we will provide additional notice through the Site, an in-app notification, email, or another appropriate method. The revised policy takes effect when posted unless it states a later effective date.

Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, contact us at:

Dollar Diary, Inc.

Email: info@dollardiary.com