Budy Privacy Policy

Effective date: October 17, 2026

This Privacy Policy describes how Budy Tech, Inc. ("Budy," "we," "us," or "our") collects, uses, discloses, and retains personal information through the Budy mobile application and related services (collectively, the "Services"). The Services are offered only in the United States.

1. Information We Collect

Information you provide

We collect information you provide when you create or use an account, including:

• your name, email address, password, and date of birth;
• your telephone number, if you enroll in SMS authentication;
• budgets, goals, categories, notes, and receipt images;
• your preferences for community insights, notifications, and sharing; and
• information you include in communications with us.

We use a telephone number collected for authentication only to provide and secure the Services. We do not use it for advertising.

Information from connected financial institutions

When you direct us to connect a financial institution through Plaid, we may receive account names and types, masked account numbers, balances, transactions, merchant and category information, and supported investment holdings. Budy does not receive or store your online-banking credentials. Plaid handles those credentials directly. Budy stores an encrypted access token for the connection and destroys it when you disconnect the institution or delete your account.

Information generated through the Services

We create records needed to operate and secure the Services, including session information, device identifiers, sign-in times, and records of security-sensitive account changes. Application logging is designed to redact credentials, access tokens, account numbers, and similar secret values before a record is written.

The Services do not request access to your precise location, contacts, or advertising identifier. A receipt image is processed only when you choose to scan or select it.

2. How We Use Information

We use personal information to:

• provide connected accounts, balances, transactions, budgets, goals, and

receipt features;

• authenticate users, maintain sessions, prevent fraud, and secure the Services;
• provide sharing features at the direction of participating users;
• provide community insights when a user has opted in;
• administer subscriptions and connected-institution limits;
• respond to support, security, and privacy requests; and
• comply with law and enforce our agreements.

Receipt scanning and transaction-category suggestions are performed on the user's device. Budy does not upload receipt images for those functions.

3. Community Insights

Community insights are disabled by default. A user must opt in before receiving comparisons or contributing information to them. When enabled:

• an aggregate must include at least 25 eligible users;
• at least 20 eligible users must have spending in a category before that

category is shown;

• medians, percentages, and cohort sizes are rounded;
• results may include any spending category, including categories that may be

considered sensitive;

• results contain category-level amounts, not another user's transactions,

merchants, payees, or identity; and

• information from users under 18 is excluded from the aggregate.

A user may withdraw consent in Settings > Privacy. Withdrawal stops future contributions and access to community comparisons.

4. How We Disclose Information

Budy does not sell personal information and does not disclose personal information for targeted or cross-context behavioral advertising.

We disclose information to service providers only as needed to operate the Services:

We may also disclose information when required by law or valid legal process, or when reasonably necessary to protect Budy, our users, or others. When the law permits, we will notify the affected user before making a compelled disclosure.

5. Storage and Security

Personal information is stored and processed in the United States. We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit using TLS 1.2 or later, encryption at rest, multi-factor authentication for production access, restricted database roles, security monitoring, and automated control tests. Plaid access tokens are also encrypted at the application layer. No security measure can guarantee absolute security.

6. Retention and Deletion

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, subject to a legal hold or a longer period required by law.

• Active accounts. We retain account and financial information while the

account remains active.

• Account deletion. When deletion is confirmed, we revoke sessions, remove

authentication credentials and push tokens, close financial connections, and stop sharing. Remaining account and financial records are permanently deleted after a 30-day recovery period.

• Backups. Encrypted backups expire on a fixed schedule no later than 35

days after permanent deletion. Backups are not edited in place.

• Audit records. Limited security and deletion records, containing account

identifiers and relevant timestamps but no financial data, are retained for 12 months.

• Community aggregates. We may retain aggregate information that does not

contain individual-level figures and cannot reasonably identify a person.

7. Your Choices and Rights

The Services allow you to:

• request a CSV export in Settings > Your data; the file is delivered by a

private, time-limited email link;

• initiate account deletion in Settings > Your data;
• review and terminate active sessions in Settings > Security;
• withdraw consent to community insights in Settings > Privacy; and
• end sharing with another person.

Depending on where you live, applicable law may also give you rights to access, correct, delete, or obtain a copy of personal information, or to appeal our response to a request. Submit a request to privacy@budyget.com. We may take reasonable steps to verify your identity and will respond within the period required by applicable law.

8. Children and Teenagers

The Services are not directed to children under 13, and we do not knowingly collect personal information from a child under 13. Registration requires a date of birth, and an account cannot be created for a person who states that they are under 13.

A person from 13 through 17 may use the Services only with the consent and involvement of a parent or legal guardian as required by law. Information from a user under 18 is excluded from community-insight aggregates. If we learn that we collected personal information from a child under 13, we will disable the account and delete the information as required by law.

9. Changes to This Policy

We may update this Policy to reflect changes to the Services, our practices, or applicable law. The revised Policy will state its effective date. We will provide notice through the Services before a material change affecting how we use or disclose personal information takes effect.

10. Contact Us

Budy Tech, Inc., 350 E 400 S STE 54989, Salt Lake City, UT 84111

• Privacy requests: privacy@budyget.com
• Security reports: security@budyget.com
• General support: support@budyget.com