Skip to main content
Sunny Budget

Privacy Policy

The legal details of how we handle your data. For a more accessible explanation, see our Data Transparency page.

Effective:January 1, 2025
Updated:January 21, 2026
Table of contents
  1. 1. Overview
  2. 2. Our Zero-Knowledge Design
  3. 3. What We Collect
  4. 4. How We Use Information
  5. 5. Cookies
  6. 6. Third-Party Services
  7. 7. Data Sharing
  8. 8. Data Security
  9. 9. Data Retention and Deletion
  10. 10. Children
  11. 11. United States Only
  12. 12. Changes
  13. 13. Contact

1. Overview

This Privacy Policy describes how Sunny Budget (“we,” “us,” or “our”) handles information when you use our service.

By using the Service, you agree to this Privacy Policy, which is part of our Terms of Service.

2. Our Zero-Knowledge Design

Your financial data is encrypted on your device before it reaches our servers.

We do not hold the keys to decrypt this data. This means we cannot read your financial data, and we cannot recover it if you lose your password.

Sunny Budget uses a zero-knowledge encryption design. Your financial data (transactions, budgets, attachments, and notes) is encrypted before it leaves your device. We do not hold the keys to decrypt this data.

3. What We Collect

Information We Knowingly Collect

  • Email address — to create and identify your account, send verification and security alert emails, and important announcements
  • Password (hashed) — stored in a non-recoverable form for authentication
  • Encrypted financial data — stored on our servers but unreadable to us

Information That May Be Collected Automatically

Like most modern web applications, Sunny Budget relies on hosting providers, infrastructure services, and limited third-party tools that automatically collect certain technical information to operate, secure, and improve the Service.

  • IP addresses
  • Browser type and version
  • Device information
  • Pages visited and timestamps
  • Performance telemetry (page path, load timing, device/browser details)
  • Cookies or similar identifiers

We use this information to support core functionality, maintain reliability, detect abuse, and understand how the Service performs.

While we do not control the independent data collection practices of our service providers, we select providers carefully and aim to limit data collection to what is reasonably necessary. For additional details, we encourage you to review the privacy policies of the relevant providers.

4. How We Use Information

We use information we collect to:

  • Operate and maintain the Service
  • Authenticate your account
  • Respond to support requests
  • Send important service-related notices
  • Comply with legal obligations

We do not sell your personal information. We do not use your information for advertising.

5. Cookies

We use cookies to keep you logged in after authentication and maintain your session. Our hosting providers or third-party services may set additional cookies.

You can configure your browser to refuse cookies, but this may prevent you from using the Service.

6. Third-Party Services

We use the following third-party services to operate the Service. These services have their own privacy policies and may collect information independently.

Specific Third-Party Services

Cloudflare Turnstile (Bot Protection)

Used on the login, signup, and contact forms to block automated attacks. To tell humans from bots, Cloudflare receives your IP address along with browser and interaction signals; it never receives your email, password, or financial data. Brute-force protection (rate limiting and account lockout) runs on our own servers—no third party is involved.

OpenAI (AI Categorization)

Opt-in only

If you enable AI categorization during CSV import, we send transaction descriptions and amounts to OpenAI to suggest categories. Your on-device rules run first to minimize what gets sent. This feature is off by default.

Resend (Email Delivery)

Required for account

Used to send account verification emails (required at signup), security alerts (email change notifications), and feedback delivery (when you submit feedback). We send only essential account-related emails—never marketing or promotional content.

Vercel Speed Insights (Performance Monitoring)

On for all users

Collects page paths, load timings, and basic device/browser information to monitor web app reliability and improve speed. Does not collect vault contents, budgets, or form text. Not used for advertising or tracking.

Vercel Analytics (Usage Analytics)

On for all users

Collects anonymous, aggregate page-view counts and country-level visitor geography to understand feature usage. Does not collect personal identifiers, IP addresses, or any financial data. This is privacy-friendly analytics—not user tracking.

7. Data Sharing

We may share information in these circumstances:

  • Service providers — third parties that help us operate the Service
  • Legal requirements — if required by law, court order, or government request
  • Business transfers — if Sunny Budget is acquired or merges with another entity

Because your financial data is encrypted and we cannot decrypt it, we cannot share the contents of your financial data with anyone—including law enforcement—even if requested.

8. Data Security

We design Sunny Budget with security and privacy as core principles, including the use of encryption and secure credential handling. We take reasonable administrative, technical, and organizational measures to protect your information. However, no system can guarantee absolute security. As with any online service, there is a risk that information could be accessed, disclosed, or lost due to a security incident.

9. Data Retention and Deletion

We retain your account information while your account is active. If you delete your account, we will delete your data from production systems.

Encrypted Backup Retention

For disaster recovery purposes, we maintain encrypted database backups that are retained for up to 90 days. These backups are stored with AES-256 encryption on a secure, separate storage service.

When you delete your account, your encrypted data may persist in these backups during this 90-day window. However, this data remains unreadable without your password, which we do not store.

Important: Backups are only accessed in critical disaster recovery scenarios (e.g., database corruption or catastrophic failure) or if required by valid court order or legal process—never for routine operations, data analysis, or individual account recovery. Note that even if compelled to produce backup data, we cannot decrypt your financial information without your password.

To delete your account, go to Settings in the app or contact us at [email protected].

10. Children

The Service is not intended for anyone under 18. We do not knowingly collect information from children. If you believe we have collected information from a child, please contact us.

11. United States Only

The Service is intended for users in the United States. Data is stored and processed in the United States.

12. Changes

We may update this Privacy Policy from time to time. If changes are material, we will make reasonable efforts to provide notice. Continued use of the Service after changes constitutes acceptance.

13. Contact

Questions? Contact us at [email protected]