Security at Frugal
A personal finance app sees a lot. Where you eat, what you watch, who you owe. We take that responsibility seriously. Here's exactly what we do with your data.
We never touch your money
Frugal is read-only by design. We see transaction notifications (via your bank's email forwarding or Mono Connect) but we have no ability to move funds. Your bank still holds your money. We just listen and organize.
Where your data lives
Your transactions, budgets, and categories sit in a Postgres database managed by Supabase, hosted in the EU (Frankfurt). All connections are TLS 1.2+ only. Backups are encrypted at rest. Database access is restricted to our application service using row-level security — even our admin tools can't see your data without going through the same RLS rules.
Who can see what
Only you. Every database query is scoped to your workspace, and the row-level security policies enforce that at the database level — meaning even a bug in our application code can't leak another user's data. If you invite a partner to share an account, only that specific person is granted access, and only to your shared workspace.
What we never do
We don't sell your data. We don't share it with advertisers. We don't feed it into models we resell. We don't store your bank credentials — Mono Connect handles that on your bank's end. We don't see your card numbers, account numbers, or PINs.
If you want to leave
Open Settings → Delete my account, type DELETE to confirm. Every transaction, budget, category, bank link, and workspace you own is hard-deleted from our database. There's no soft-delete grace period and no "archive" — gone is gone. (Workspaces you only joined as a member stay intact for the others; you just stop being a member.)
Security disclosure
Found a vulnerability? Email us at hotakaraandakamu@gmail.com with the subject line "Security disclosure". Please give us 30 days before public disclosure. We don't have a formal bug bounty yet, but we're grateful and will publicly credit researchers who report responsibly.