Home › Comparisons and alternatives
A budget app that doesn't sell your data
Ask three questions instead of chasing the phrase: what leaves the device, who receives it, and how you delete it. In Envelope Budget there is no bank connection, so no credentials, account numbers or balances are ever collected, and your envelopes, transactions, goals and receipt photos stay on the phone unless you turn backup on. What does leave: a Google AdMob banner on the free tier (device advertising ID and general device info, never your money data), anonymous usage events to PostHog, and crash reports to Sentry.
The phrase is narrow; the questions are not
Selling data is a narrow term, and plenty of apps can truthfully say they do not sell it while still sending a great deal of it somewhere. So do not chase the phrase. Ask three concrete questions instead. What leaves the device, and at what moment? Who receives it, and what are they allowed to do with it? How do you delete it, and does deleting the app delete anything on a server? A policy that answers all three in plain sentences is worth more than a banner insisting your privacy matters. If a policy is vague about the first question, assume the answer is larger than you would like. We make one of these apps, so treat what follows as an interested party's account and check it against /privacy.
What stays on the phone in our app
Envelope Budget does not connect to your bank. We do not ask for or receive bank credentials, account numbers, card numbers or balances from any institution, because there is no import feature that could receive them. Your envelopes and budgets, transactions and notes, income records, goals and vision boards, receipt photos and your theme all live in a database on the device, and you do not need an account to use the app at all. That data leaves the phone only when you choose: when you export or share a file yourself, or when you sign in and turn backup on, which uploads everything in that list except the receipt photos. We do not sell or rent personal information. That is the whole of the money side.
What does leave, and who gets it
Three things go out regardless of backup, and pretending otherwise would make this page worthless. The free tier shows a banner supplied by Google AdMob, so Google receives your device advertising identifier plus general information such as device type, approximate location, and whether the ad was seen or tapped. It never receives envelopes, transactions, amounts, notes, goals or photos, and trial and Plus users see no ads at all. Second, the app sends anonymous product usage events to PostHog and crash reports to Sentry; these are not linked to your identity and never contain amounts, notes, category names or photos. Third, the optional Vision Board Contest, which requires an account, sends your handle, the board image you share, and goal progress as a whole percentage. Never a dollar figure.
Free syncing apps are a business model, not a scandal
Aggregation-based budget apps connect to your accounts and read the transaction feed. Maintaining that connection costs money every month, so a free one has to earn it somewhere, and usually that somewhere is offers, referrals and partner placements informed by what the feed shows. That is a legitimate business, and it is generally disclosed. It is also a structurally different relationship from one where the app never sees the feed at all. We charge for Plus and run a banner on the free tier, which is its own trade and not automatically nobler. The point is not that one model is virtuous. The point is that you should know which one you are in before you hand read access to every account you own to anybody.
The change to make this week
None of this matters if the budget never happens. Pick the two or three categories where money actually disappears, create an envelope for each, fund them from your take-home pay, and log by hand for one month. Nothing has to leave the phone for that to work, and you can decline app tracking under Settings, Privacy and Security, Tracking without losing a single feature. If you later want it gone, deleting your money data in the app or deleting the app removes it from the device, and Settings, Profile, Delete account erases your backup, shared boards, comments, cheers and votes from our server immediately. The full policy, including the parts we would rather not advertise, is at /privacy.
Common questions
Does the app need my bank login?
No. There is no bank connection anywhere in the app, so there is nothing to log into. You enter your take-home pay, split it across envelopes, and record each purchase yourself. The obvious cost is that nothing is imported for you, and the system fails the moment you stop logging. The obvious benefit is that no institution credential, account number or balance ever exists inside the app to be leaked, sold or breached, because it was never collected in the first place.
Is anonymous analytics the same as selling my data?
No, but it is not nothing either, so here is the exact shape of it. The app sends usage events, for example that a spend was recorded, to PostHog, and crash and error reports to Sentry. Those tell us which screens people use and which ones break. They are not linked to your identity, and they never contain transaction amounts, notes, category names or receipt photos. It is still a genuine transfer to a third-party processor, which is why it is written into the privacy policy rather than buried.
If I use the free version, what does the advertiser learn about my budget?
Nothing about your budget. The AdMob banner receives your device advertising identifier and general device information such as device type, approximate location, and whether the ad was seen or tapped. Envelopes, transactions, amounts, notes, goals and photos stay on the device and are not part of that request. iOS asks you once whether the app may track you across other companies' apps and websites; if you decline or never answer, ads still appear but are not personalized. Trial and Plus users see no ads at all.
How do I delete everything?
Two separate deletions, because there are two places. Money data on the phone goes when you delete it in the app or delete the app itself. If you signed in and turned on backup, open Settings, then Profile, then Delete account, which erases the account and its backup from our server immediately, along with any boards you shared and their images, plus your comments, cheers and votes. Deleting the account does not touch the budget still sitting on your phone; that is a separate step you take on the device.
Run this budget on your phone
Envelope Budget puts these envelopes in your pocket. Assign every amount, log spending as it happens, and see what is actually left.
Get Envelope BudgetiPhone · manual entry, no bank connection · 7-day free trial