Privacy Policy

Last updated: 1 September 2026

Small Wallet is a personal budgeting service. It reads your bank balances and transactions so it can tell you how much you can spend today and still meet the bills you have coming. This page describes exactly what it collects, why, how long it keeps it, and how to make it stop.

Who runs Small Wallet

Small Wallet is operated from Canada by its developer. For any question about your data, or to exercise any right described below, write to privacy@smallwallet.net.

What is collected

Account information you give us

• Your email address and password (stored only as an Argon2 hash — it is never recoverable, by us or anyone else).
• Your country, time zone and language, which decide which banks are offered, when your daily email is sent, and in which language.
• Your budget: the categories you set up, the amounts you allow yourself, and the recurring bills you are tracking.
• Your display and email preferences.

Bank information, via Plaid

When you connect a bank account, you do so inside Plaid's own secure window. Your banking username and password are entered there and are never seen by, sent to, or stored by Small Wallet. Plaid returns an access token, which is encrypted before it is written to our database.

Through that connection Small Wallet reads:

• The name, type and current and available balance of each account you choose to connect.
• Your transactions: date, amount, merchant name, description, currency, and the spending category Plaid assigns.

Small Wallet requests only Plaid's Transactions product. It does not request, receive or store your account or routing numbers, and it has no ability to move money in or out of any connected bank account.

Plaid handles your information according to its own privacy policy, available at plaid.com/legal. You can review and revoke the connections you have granted Plaid at my.plaid.com.

Wise, if you connect it

Connecting a Wise account is optional and separate. It uses an API token you create yourself and paste in; the token is encrypted at rest exactly as Plaid's is. Small Wallet reads your Wise balances and activity, and — only when you ask it to, or under a rule you have configured yourself — moves money between your own Wise balances. It cannot send money to anyone else.

What it is used for

Your financial data is used for one purpose: running the budgeting features you signed up for. Specifically:

• Working out what you have spent against each budget category this pay period.
• Projecting your end-of-period balance and possible savings.
• Sending the daily and periodic summary emails you have enabled.
• Warning you when a bill you are tracking looks at risk.

Your financial data is never sold, rented, or shared for advertising, marketing, credit decisions, or any other purpose. It is not used to train machine-learning models. Transaction categorization is done by fixed rules and by the merchant mappings you confirm yourself — no artificial-intelligence service is involved and no transaction data is sent to one.

Who it is shared with

Small Wallet uses a small number of processors, each for one job, and shares with each only what that job needs:

• Plaid — the bank connection itself.
• Wise — only if you connect it.
• Stripe — subscription payments. Stripe handles your card details directly; Small Wallet never sees or stores a card number.
• Postmark — delivery of your email summaries. These contain budget figures and category totals.
• Alwaysdata — the hosting provider running the application and database.

Beyond these, your data is disclosed only where the law requires it.

How it is protected

• All traffic to the site is encrypted with HTTPS.
• Plaid access tokens and Wise API tokens are encrypted with Fernet (AES-128-CBC with an HMAC-SHA256 signature) before being stored, using a key held outside the source code.
• Passwords are hashed with Argon2.
• Repeated failed sign-ins lock the account temporarily.
• Every query is scoped to the signed-in user, so no account can read another's data.

No system is perfectly secure, and nothing here is a guarantee against every possible breach.

How long it is kept

Transactions and balances are retained while your account is open, so that period-over-period comparisons and yearly reports remain meaningful. When you disconnect a bank account, Small Wallet tells Plaid to close the connection and deletes that account's stored transactions and balances immediately.

To close your account entirely and have the remaining data deleted, write to privacy@smallwallet.net and it will be done within 30 days.

Your rights

You may at any time:

• Disconnect any bank account, from the Accounts page. This revokes the connection at Plaid and deletes the data it provided.
• Turn off any or all emails, from Email Preferences.
• Ask for a copy of the data held about you.
• Ask for it to be corrected or erased.

If you are in Quebec or elsewhere in Canada, these rights sit alongside those given to you by PIPEDA and provincial privacy law; if you are in the European Economic Area or the United Kingdom, alongside those given by the GDPR.

Children

Small Wallet is not intended for anyone under 18 and does not knowingly collect their information.

Changes

If this policy changes in a way that materially affects how your financial data is handled, you will be told by email before the change takes effect.

Terms of Service