Legal

Privacy Policy for Liberty Budget

Last Updated: August 21, 2026

1. Introduction

Liberty, LLC ("we," "our," or "us") operates libertybudget.app. This policy explains what information we collect, why we use it, how we protect it, and the choices available to you.

Our privacy commitment means we do not sell personal data, do not share financial data with advertisers, do not require a bank connection, and aim to collect only what is needed to provide and secure the service. The free trial is manual/CSV only; eligible paid or lifetime accounts may optionally connect supported accounts through Plaid when production connections are enabled.

2. Information We Collect

  • Your email address and account preferences
  • Budget categories, goals, and transaction data you choose to enter or upload
  • Your money-plan answers, such as goals, pay rhythm, budgeting friction, preferred pace, and categories you want to protect
  • Recovery Scan answers and results, including review recency, payment-source count, debt, income, expense, and plan-preference information you provide
  • If you choose Liberty Gold, institution and account identifiers, account type, balances, and transactions Plaid makes available for selected accounts
  • If enabled and available for a selected credit-card account, liability details such as payment dates, minimum payment, and interest-rate information
  • Basic technical and usage data, such as browser information and security or server logs
  • Subscription status and billing identifiers supplied by Stripe; we do not store your card number
  • On eligible anonymous public pages only, product analytics and campaign-attribution data collected through HeyCatch, including page and public-site click activity, referring channel, IP address, browser and device details, and session information. HeyCatch is not loaded on authentication, account, Recovery assessment, Plaid, or authenticated budgeting pages
  • First- and last-touch managed link IDs stored in a signed first-party cookie for up to 30 days
  • A validated registration campaign code stored in the signed, HttpOnly lb_campaign_attr first-party cookie for up to 30 days
  • A signed first-party random browser token stored for up to 30 days after the latest eligible experiment interaction. The service uses its derived cohort key to keep that browser in one code-owned variant for an eligible marketing experiment; the browser cookie contains no page copy, account identifier, or financial data
  • For home-hero and money-plan result experiments, the code-owned experiment and variant, the first visible tested-block exposure, and fixed primary- or secondary-CTA categories. Exposure is recorded only after at least 25% of the tested block is visible in a foreground tab. A result-page setup-sprint test also derives coarse before- or after-ten-minute CTA timing from server-recorded timestamps
  • Coarse assessment, signup, account, activation, checkout, Plaid Link, and Stripe-confirmed payment, refund, and dispute milestones. Assessment answers, Recovery results, Plaid identifiers, balances, and other financial values are excluded; signed Stripe records may include invoice and provider identifiers, amount, currency, plan interval, and adjustment status while the account exists
  • First-party product activity limited to the UTC date and an allowlisted action label: successful CSV import, budget save, fund use, nonempty Sankey view, authenticated report result, or completed transaction review
  • Email-delivery records limited to an account and managed-link association, email category, Resend message identifier, safe result code, internal-account marker, and send or delivery-status timestamps. These records do not contain the recipient address, subject, message body, or raw webhook payload.
  • One fixed cancellation-feedback category, such as price, missing features, complexity, CSV difficulty, not using the service, or other. We do not collect free-text cancellation feedback.

We do not ask you to type online-banking credentials into Liberty Budget. If a paid subscriber chooses Auto, authorization is handled through Plaid Link and the institution's supported flow. Plaid supplies connected data until the account is disconnected, access ends, or the connection otherwise stops.

3. How We Use Information

  • Provide, maintain, and secure Liberty Budget
  • Process subscriptions and display billing status
  • Build and save your Recovery Scan, confirmed Recovery Number, personalized budgeting method, and next steps
  • Import, categorize, reconcile, and refresh connected transactions and account information when you choose Liberty Gold
  • Send required account, security, billing, and retention notices
  • Respond to support requests and diagnose service problems
  • Improve site usability and service reliability
  • Measure whether a tagged advertising message results in account registrations and subscriptions
  • Compare visible marketing-experiment cohorts using fixed CTA, coarse timing, and downstream milestone categories
  • Compare exact-day D1, D7, and D30 retention and first-week feature adoption for activated campaign cohorts
  • Measure Resend API acceptance, recipient mail-server acceptance, and delivery problems by email category and attributed advertising link
  • Measure cancellation-feedback response rates and aggregate fixed reason categories by attributed advertising link

4. Data Security and Encryption

  • Connections to the production site use HTTPS/TLS
  • Supported transaction descriptions, merchant names, and amounts are encrypted at rest
  • Passwords are stored as password hashes, not readable passwords
  • Transaction data is displayed through authenticated application requests

Data entered manually, uploaded through CSV, or reconciled from an eligible Plaid connection reaches the Liberty Budget service over protected provider or HTTPS connections. In the main budget ledger, supported transaction fields are encrypted with a per-account Fernet data key before database storage. That data key is stored in wrapped form using password-derived protection and a server-controlled recovery wrapper. Plaid access tokens and provider-synchronization records are encrypted separately with an independent, service-managed key so authorized background sync, update, and disconnect operations can run.

The application decrypts fields at runtime for authorized views, reports, password recovery, and support operations. This is encryption at rest, not browser-side or end-to-end encryption. Dates, categories, account identifiers, and other operational metadata may be stored separately to power the service.

5. Service Providers and Data Sharing

We do not sell personal data or provide transaction data to advertisers or data brokers.

We use service providers for limited operational purposes:

  • Railway for hosting and infrastructure
  • Stripe for payment processing and subscription management
  • Plaid for optional paid connections to supported bank and credit-card accounts and the selected financial-data products
  • Resend for account and lifecycle email delivery, including the recipient address and message content needed to send the email, and signed delivery-status reporting
  • HeyCatch for product analytics and campaign attribution, with PostHog acting as its analytics subprocessor

Providers receive information needed for their function. Plaid and the selected institution process the connection and financial data needed for Liberty Gold; their own privacy terms also apply. Application protections exclude Recovery assessment inputs and results, Plaid identifiers, balances, imported or connected transaction descriptions, merchant names, budget values, and transaction amounts from interaction analytics. We do not send those fields to advertising or analytics providers. With your Google Analytics consent, a completed subscription event may include the subscription price, currency, and a pseudonymous order reference for campaign measurement.

Plaid connection tokens are stored encrypted and are used only to maintain the connection you request. We do not sell connected financial data or provide it to advertisers or data brokers.

6. Access Controls and Logs

Administrative and operational access is restricted to people who need it to operate, secure, or support the service. Relevant application and infrastructure events may be logged for security and troubleshooting.

7. Your Choices and Rights

Depending on where you live, you may have rights to:

  • Access, correct, or export your personal data
  • Delete your account and associated active-service records
  • Object to or restrict certain processing
  • Opt out of optional marketing email
  • Disconnect an optional Plaid account connection

If Resend reports an email complaint, we mark the account as opted out of optional product and lifecycle email. Required account, security, billing, and retention notices may still be sent.

Use the controls in your Profile or email support@libertybudget.app for assistance.

You can cancel a paid subscription online from your Profile without contacting support. Cancellation normally takes effect at the end of the current paid period.

8. Data Retention

We retain active-account data while needed to provide the service.

Before you create an account, Recovery assessment inputs and results are encrypted and linked using the digest of a random browser-session token. An unclaimed assessment expires two days after it is saved and is scheduled for deletion with its opportunity records. If you create an account in that browser, the assessment is claimed by the account and follows the account retention and deletion rules below.

If a trial expires without upgrading or a paid subscription ends, account records are retained for a 90-day grace period. This allows you to reactivate without immediately losing history. We schedule a notification seven days before the account's deletion date.

We retain detailed email-delivery linkage for 90 days. Account deletion removes the account ID and Resend message identifier from existing linked delivery attempts, reduces their timestamps to UTC dates, and deletes cancellation feedback. A privacy-limited signed-event receipt may keep its Resend event ID for up to 90 days to reject retries, but its message identifier is removed when the linked attempt is deidentified. The deletion-confirmation email is recorded without an account ID; its Resend message identifier may remain for up to 90 days so delivery can be diagnosed. New signed status events that arrive after deletion are not associated with an account and expire under the same receipt schedule.

After 90 days, scheduled maintenance removes remaining account and Resend message linkage from delivery attempts and reduces exact timestamps to UTC dates. We retain only the email category, attributed advertising link, coarse status or safe error category, and internal-account marker for aggregate reporting. Verified Resend webhook receipts are deleted after 90 days.

After the grace period, account and associated records are scheduled for deletion from the active service database. Limited infrastructure backups and security logs may persist temporarily under our providers' retention schedules. You can delete your account sooner from your Profile.

When a linked account is disconnected or paid connection access ends, we stop requesting new data and request that Plaid remove the connection. If Plaid is temporarily unavailable, the removal may remain queued for retry. Transactions already imported remain subject to Liberty's normal account controls and retention schedule unless you delete them or your account sooner.

When an account is deleted, we delete its first-party daily product-activity rows. We also remove its link from a landing-experiment assignment and replace that assignment's cohort key with the same new random value used for deidentified marketing milestones. Experiment exposure and fixed CTA timestamps are reduced to UTC dates; the experiment and code-owned variant categories may remain for aggregate comparison. The frozen managed-link category may also remain for aggregate campaign comparison. The retained experiment records do not include the account ID, email, page copy, raw IP address, browser user agent, full referrer URL, device fingerprint, or financial data. We also remove its link to first-party marketing milestones and replace the internal cohort key with a new random value. We may retain coarse milestone counts by campaign, but we remove the exact payment, refund, and dispute amounts; currency; plan interval; Stripe event, invoice, charge, refund, and dispute IDs; adjustment status; and time of day. Revenue totals can therefore decrease after a deletion. Retained records do not include email, IP address, device fingerprint, full referrer URL, or personal budgeting and transaction data.

9. Raw CSV Files

CSV files are used to process an import and are not retained as raw upload files after processing. Parsed transaction records and import-history metadata are stored as needed to provide the service.

10. AI and Advertising

We do not use your transactions to train AI models, sell insights derived from personal transaction data, or serve ads inside Liberty Budget based on your spending.

11. Cookies and Analytics

Essential cookies keep you signed in and remember preferences.

On eligible anonymous public pages, HeyCatch uses browser storage and cookies to measure page views, public-site clicks, referring campaigns, and technical and session information. We use this information to understand which channels bring people to the service and where the public experience needs improvement. We do not enable session recording or load HeyCatch for signed-in activity.

Interaction tracking is excluded from authentication, account, Recovery assessment, Plaid, and authenticated budgeting pages, and sensitive account-action URLs are sanitized before any later eligible tracking. These protections keep Recovery inputs and results, Plaid identifiers, balances, imported transaction descriptions, merchant names, budget values, transaction amounts, and security tokens out of HeyCatch interaction analytics.

Each managed advertising link identifies a campaign, message angle, and creative. When an eligible link is opened, we count the request after filtering common bots and previews and store signed first- and last-touch link IDs in a first-party cookie for up to 30 days. Direct return visits do not replace a recent tagged touch. If you create an account, we freeze the attributed link on the account and record coarse funnel milestones such as assessment started, result viewed, signup started, verification, first successful CSV import, first Sankey view, activation, checkout, Plaid Link progress, and Stripe-confirmed payment. These milestones exclude assessment answers, results, and financial values. Signed Stripe payment records include the amount, currency, plan interval, invoice ID, and provider event ID while the account exists. Stripe-confirmed refund and dispute records include the affected invoice, provider object and event IDs, amount, currency, and current adjustment status. The acquisition dashboard uses only the first successful payment through day 37 after signup for conversion and gross revenue comparisons, then subtracts adjustments tied to that first invoice to report net revenue. For managed-link accounts activated after the product-measurement start marker, the server may also store one row per allowlisted product action and UTC date. Exact-day D1, D7, and D30 retention counts only successful actions on that calendar day after activation, and a target day must close before the account enters its denominator. First-week feature rates use the same date-grain rows. Login, onboarding, generic page loads, failed actions, deletes, and empty visualizations do not count. Link-open counts are not guaranteed unique people. This first-party system does not store raw IP addresses, browser user agents, full referrer URLs, email addresses, device fingerprints, CSV contents, Recovery inputs or results, Plaid identifiers, balances, transaction details, category or fund names, filenames, report contents, or budget values in marketing records.

Creator and other validated registration links may set the signed, first-party lb_campaign_attr cookie so campaign credit can survive a browser restart for up to 30 days. It contains only the validated campaign code, is HttpOnly, uses SameSite=Lax, and uses Secure in production. It does not contain an account identifier or financial data and does not identify activity on other sites. We delete it after successful account creation and may store the validated campaign code on the new account. If you type a creator code at signup, we match it only to an active, issued partner campaign; invalid codes are ignored.

When an approved marketing experiment is running for an eligible managed link, the server assigns one of two code-owned variants. A signed first-party cookie keeps the random browser cohort stable for up to 30 days after the latest eligible experiment interaction. The cookie is HttpOnly, uses SameSite=Lax, and cannot be read by page scripts. The page records an exposure only after at least 25% of the tested block is visible while the tab is in the foreground. CTA events are limited to the fixed categories "primary" and "secondary"; we do not collect arbitrary click text or page copy. For the 10-minute setup-sprint variant, the server fixes the deadline from the first visible exposure. The CTA, plan, and price remain available after the displayed timer reaches zero.

The acquisition dashboard compares exposed experiment cohorts with coarse assessment, signup, activation, and payment milestones that occur after exposure. An internal account association may be used after signup to measure those outcomes, but experiment events do not contain names, email addresses, raw IP addresses, browser user agents, full referrer URLs, Recovery inputs or results, Plaid identifiers, balances, transaction details, or other financial values. Internal accounts are excluded from the comparison. Liberty Budget does not automatically declare a winner; an administrator reviews sample size, uncertainty, and the business context before deciding what to keep.

For application email, we accept signed Resend events for sent, delayed, recipient-mail-server accepted, bounced, complained, failed, and suppressed messages. Messages carry fixed application and deployment tags so Liberty Budget production, staging, and other products in the same Resend account remain separate. We deliberately ignore open and click events. A reported delivery does not prove inbox placement or that the message was read.

Google Analytics 4 is not currently enabled.

You can disable cookies in your browser, but essential service features may stop working.

12. Children's Privacy

Liberty Budget is not intended for people under 18, and we do not knowingly collect their data.

13. International Processing

Information may be processed in the United States. Where required, we apply safeguards for international data transfers.

14. Policy Changes

We may update this policy. We will provide notice of material changes as required by law.

15. Contact Us