Effective 2026-10-17. Applies to the Moola web app, the Moola desktop app, and the Moola mobile app (together, “Moola”), operated by Milbo LLC (“we”, “us”).
Moola shows you your financial picture: your accounts, balances, transactions, and net worth over time. To do that it needs some personal and financial information. This policy explains what we collect, why, who we share it with, how long we keep it, and how you can see or delete it. We don’t sell your data and we don’t show ads.
What we collect
Account information. Your name, email address, and a password hash if you sign up with a password. If you sign in with Google we receive your name, email, and Google account ID. If you turn on two-factor authentication we store an encrypted authenticator secret and encrypted backup codes; passkeys store only a public key.
Financial data you enter. Manual accounts, balances, goals, notes, and categories you add yourself.
Homes you add by address. When you look up a home, we send the address you typed to RentCast, a property-data provider, and receive public-record details (property type, size, year built, last sale, tax assessment, and the owner on record) and an automated value estimate. We store the address, the details, and the estimate with your portfolio; the owner name is shown once so you can confirm the match and is not stored with your account.
Financial data from your bank, through Plaid. When you link an institution, Plaid Inc. (“Plaid”) connects to it on your behalf and sends us account names and types, the last four digits of account numbers, balances, holdings and liabilities where available, and up to 24 months of transactions (merchant, amount, date, and Plaid’s category). Moola never sees or stores your bank username or password; you enter those inside Plaid Link. We store Plaid access tokens encrypted and use them only to refresh your data.
Billing. If you subscribe to Moola Plus, Stripe processes your payment. We store your Stripe customer and subscription IDs and plan status, never your card number.
Family workspaces. If you create or join a family, the other members can see the accounts, balances, and transactions you bring into the family workspace, tagged with your name.
Technical data. Server logs with request paths, timestamps, IP addresses, and error details for security and debugging. Logs never contain balances, transactions, or credentials. We use essential cookies for sign-in and workspace selection only; there are no advertising or analytics cookies.
How we use it
To show you your accounts, history, net worth, and spending.
To keep linked balances and transactions up to date (every few minutes while Moola is open, daily in the background, and when your bank notifies Plaid of changes).
To send transactional email: email confirmation, password reset, and family invitations. We don’t send marketing email.
To bill Moola Plus subscriptions.
To secure the service: detecting abuse, rate limiting, and investigating errors.
Plaid
Moola uses Plaid to connect to your financial institutions. By linking an account you grant Moola and Plaid the right to access and transmit your personal and financial information from the institution. Plaid’s handling of that information is described in the Plaid End User Privacy Policy. You can review and revoke Plaid connections at my.plaid.com or by disconnecting the institution in Moola’s Settings, which revokes Moola’s access at Plaid immediately.
Assistants you connect
You can connect an AI assistant you use, such as Claude or ChatGPT, to your workspace through Moola’s connector. Nothing is shared with an assistant until you sign in to Moola from it and approve it on Moola’s consent page. You choose whether it may only read, or also make changes.
What it can read: your account names, account types, and institution names; current balances and balance history; transactions (date, amount, name, merchant, category, and your notes); spending summaries; your Health score, findings, and saved plan; your net-worth milestone; and planned actions you recorded. It never receives bank credentials, account or routing numbers, account masks, Plaid identifiers, your password, or another family member’s data.
What it can change, if you allow writes: account types, manual accounts and their balances, transaction categories and notes, merchant rules, your milestone, your saved plan and its recommendations, and planned actions. It cannot move money, pay bills, trade, or change anything at your bank.
Where the data goes: what the assistant reads is sent to that assistant’s provider (for example Anthropic for Claude or OpenAI for ChatGPT) under your own account with them, and is handled under their terms and privacy policy, including how long they keep your conversations. Moola does not sell this data or receive anything from the provider in return.
Turning it off: disconnect any assistant in Settings → Connected apps. New access stops at once; an access token already issued expires within 15 minutes. Moola keeps the assistant’s name, the permissions you granted, and when it was last used, until you disconnect it or delete your account.
Who we share it with
We share data only with service providers that we need to run Moola, each bound by its own terms and privacy policy, and only the minimum each needs:
Plaid (bank connectivity): your identifier and the institution connections you create.
Stripe (payments): your email and subscription status.
Vercel (hosting and logs) and Neon (database): everything above is processed and stored on their infrastructure in the United States, encrypted in transit and at rest.
Resend (email delivery): your email address and the contents of transactional messages.
Google Analytics and PostHog (product analytics): which pages are visited and which features are used, with a random visitor id or, when you are signed in, your Moola user id. Never balances, transactions, account names, your name, or your email. Session recording and automatic form capture are turned off.
Anthropic (AI coaching, when the Health coach is enabled): a de-identified summary of your finances: category balances in whole dollars, institution names, spending by category, and the findings text. Never account names, masks, transactions, or your name or email.
RentCast (property records and value estimates): the address of a home you add, without your name or any other account information. Estimates are refreshed about once a week.
Google (optional sign-in): only if you choose to sign in with Google.
We may also disclose information when required by law or to protect the rights, safety, or security of Moola and its users. If Moola is acquired or merged, your data would transfer with it under this policy.
How long we keep it
Your account, portfolio, balances, history, and transactions: for as long as your account exists.
Linked institutions: until you disconnect them or delete your account. Disconnecting removes the connection at Plaid and deletes its access token; the balances and transactions it already imported stay in your workspace until you delete them.
Sign-in sessions: 7 days of inactivity. Verification and password-reset links: 24 hours and 30 minutes.
Connected assistants: the approval until you disconnect it; access tokens for 15 minutes and refresh tokens for 30 days, deleted a month after they expire.
Webhook and rate-limit records: 30 days.
Server logs: at most 30 days.
Database backups: point-in-time recovery history is kept for at most 30 days, after which deleted data is gone from backups as well.
Deleting your data
Settings → Your data → Delete account deletes your account immediately. Deletion revokes every Plaid connection, deletes your Stripe customer (ending any subscription), and removes your profile, sign-in methods, passkeys, portfolio, history, and transactions from our database. Copies age out of backups within 30 days. Plaid and Stripe keep their own records under their policies. You can also download everything we hold about you first with Export my data.
Security
All traffic uses HTTPS. The personal fields in your data are encrypted in the database with a key created for your account alone: transaction names, merchants, and notes; account, institution, and home details in your portfolio; category rules; and Plaid access tokens. Your key is itself encrypted by a master key that is held outside the database, so a copy of the database is not readable on its own. Amounts, dates, and balances are stored unencrypted so the app can total and chart them, and are protected by the database provider’s encryption at rest. When you delete your account your key is destroyed, which makes every remaining copy of your data in backups unreadable.
Passwords are hashed. You can protect your account with two-factor authentication or passkeys, and a second factor is required before linking a bank. Access to production systems is limited to Milbo staff with multi-factor authentication. Our Information Security Policy describes these controls in more detail; email us for a copy.
Your choices and rights
Export or delete your data at any time from Settings.
Disconnect any institution at any time from Settings.
Leave or delete a family workspace at any time from Settings.
Depending on where you live you may have additional rights to access, correct, port, or restrict processing of your data. Email us and we’ll help.
Children
Moola is not directed to people under 18 and we don’t knowingly collect data from them. If you believe a minor has an account, email us and we’ll delete it.
Changes
When this policy changes we update the effective date above. For material changes we’ll also email account holders before the change takes effect.