Privacy policy

What Owl stores

Your account: name, email address, and either a password (stored only as a one-way hash) or your Google sign-in identity (name, email, profile picture).

What you enter or import: transactions, accounts, categories, merchants, budgets, recurring items, groups and the people in them.

Messages you send with “Send feedback”, with the page you sent them from.

What Owl doesn't do

Owl never connects to your bank or asks for bank logins.

Owl doesn't sell your data, show ads, or use analytics or advertising trackers.

Who can see your data

People you share with: members of a workspace, ledger or group you belong to see what that space shares with them. A private ledger stays private.

Service providers that run Owl for us: Vercel (hosting), Neon (database), Google (sign-in, if you use it, and storage for encrypted backups) and Sentry (error reports, which are stripped of personal and financial details before they leave the app).

Cookies

Only what the app needs: your sign-in session, your language and the ledger you last opened. Your theme and some layout choices are kept in your browser.

Keeping and deleting your data

Your data is kept while your account exists. You can export it as CSV at any time (Import / Export).

Delete your account from Profile → Delete account. Everything only you used is erased. Records in spaces you share stay with the people you shared them with, and in groups you appear as “Former member” so their balances don't change.

Deleted data can remain in backups until they expire: the database's own history after 6 hours, encrypted backups after at most 6 months.

Security

Connections use HTTPS, passwords are hashed with bcrypt, repeated failed sign-ins are slowed down, and backups are encrypted.

Children

Owl isn't meant for children under 13 on their own; a parent can add them to a family workspace.

Changes and contact

If this policy changes, this page is updated and its date changes. Questions or requests: use “Send feedback” in the app.