Privacy
OWL Privacy Policy
Own What’s Left LLC · Effective 08/27/2026 · Version 1.8 · Contact: privacy@ownwhatsleft.com
OWL is a household budgeting application. This policy describes what the software and its sync service do with information. It describes current behavior, not intentions.
The short version: your budget is yours. It lives on your own devices. When you turn on sync, it is encrypted on your device before it leaves, with a passphrase we never receive, so we cannot read it. Your information is never sold or given to third parties. Nothing is gathered without your consent. What you give us is kept secure. No account is required to download or use the software.
Information we do not collect
- No account is required. You can download, install and use OWL without giving us a name, an email address or anything else.
- No banking credentials. If you connect a bank, you sign in at your bank’s own site through our aggregator. We never see or store a banking password.
- No account numbers or card numbers.
- No advertising identifiers, no tracking pixels, no analytics service. The application does not report what you do inside it.
- No receipt photographs. Receipt scanning reads the picture on your phone. The photograph never leaves the device and is not kept.
Information that stays on your device
Your budget: accounts, transactions, categories, goals, settings and anything else you enter. It is stored in a database in the application’s own folder on your device. This is the original, and the software works entirely offline.
Information we hold, and why
Budget and device names, only if you set them. If you name your budget or your devices, those names are stored in plain text so your account page can show them. Choose names accordingly.
Encrypted budget data, if you turn on sync. Files are encrypted on your device with AES-256-GCM under a key derived from a passphrase you choose. We hold the resulting ciphertext so your other devices can collect it. We do not have the passphrase and cannot decrypt it. If you forget the passphrase, nobody can recover the data, including us. That is a deliberate design choice and the printed Recovery Kit exists so you do not have to rely on memory.
A household identifier. A random identifier with nothing personal in it, so your devices can find the same budget.
An email address and a password, only if you buy. Buying happens on our website and creates an account that owns your license, so a lost receipt is never a lost license. The account holds your email address and a password and nothing about any budget. The email is encrypted at rest and used only to sign you in and send your receipts. Passwords are stored only as a modern one-way hash we cannot reverse. Two-step verification protects sign-in. No account is ever required to download or use OWL.
License records, if you buy a subscription. A license identifier, which features it covers, when it expires, which household it is bound to, and the account that owns it.
Crash reports. The error, a stack trace and the application version. Never budget content, account details or transactions. During the beta testing, crash reports are sent automatically and this is stated in the terms that testers accept. Upon public release, you will be asked permission before crash reports are transmitted.
Server records. Our web server keeps a record of the requests it receives: the address the request came from, the time, what was asked for, whether it worked, and what kind of browser or app made it. This is how we notice and trace abuse, and it is kept deliberately narrow. The links we email you for confirming your address or resetting your password carry a one-time code in the web address, and that code is removed before the record is written. Passwords and sign-in cookies are never recorded.
Bank connections
If you choose to connect a bank, we use Plaid to fetch your transactions. This is the one part of OWL where readable financial information passes through our server, and we would rather say it than bury it.
- You sign in at your bank, never in OWL.
- We keep the connection key Plaid issues, encrypted, on our server, so unused connections can be disconnected. Nothing on our server reads bank data, and no route exists that returns bank data to anyone but your own signed-in device.
- Access is read-only: transactions and balances. OWL cannot move money, and never will.
- Your transactions pass through our proxy in memory on the way to your device. They are not written to disk on our servers and not logged.
- Once on your device they become ordinary transactions, so any copy that syncs is encrypted like everything else.
- Disconnecting releases the connection at Plaid, which revokes it at your bank. Transactions already imported stay in your budget, because they are your records.
Receipt reading
Scanning happens on your phone. If you subscribe to AI Assist, the text of one receipt is sent to be read more accurately when you scan it. Card numbers are removed before it is sent, and it is capped in length. We never send the photograph, your budget, your accounts, your balances, or even the names of your categories. Nothing is stored by us, and the provider’s commercial terms do not use it for training.
Assisted features. Some optional features work by sending a small, purpose-limited piece of information to our AI provider and returning an answer: for example, the text of a receipt you chose to scan, or the descriptions, amounts, and dates of imported transactions you asked to have sorted. Each of these sends only what that feature needs. New features that work this way follow these same rules.
Who else receives information
Cloud backup is free and optional. If you connect a service, OWL writes an encrypted copy of your budget into your own storage account there, once a day. The copy is sealed with your passphrase before it leaves your computer, so the provider cannot read it any more than we can. Your sign-in for that service stays on your device and is never sent to us. We never receive the copy, and we cannot see what is in your storage. Disconnecting stops future copies. Ones already written stay where they are, because they are in your account, and you can delete them yourself.
That is the complete list. We do not sell information, we do not share it for advertising, and we do not give it to data brokers.
Your choices and your control
- Use OWL without us. Never turn on sync, and we hold nothing.
- Delete what we hold. One action in the application erases your household from our servers: every encrypted file. You can also write to the address above and we will do it.
- Delete your account. You can delete it yourself from the account page. Deleting cancels its subscriptions, disconnects its banks, and disables the account immediately, and your information is removed permanently within ninety days. Purchase records are kept, because they are records of payment.
- Export everything. Backups and CSV exports are built in. Your data is not held hostage by our file format.
- Turn things off. Bank connections are opt-in and can be disconnected at any time. Receipt reading happens only when you choose to scan a receipt.
How long we keep things
Encrypted sync files stay until your devices replace them, and compaction removes what is superseded. Erasing a household removes them immediately. License records are kept while a license exists, because they are a record of a purchase. Crash reports are trimmed and capped. Server request records are deleted after ninety days at the latest.
Children
OWL is not directed at children and we do not knowingly collect information from anyone under 13.
Where information is held
On your own devices, and on servers in the United States.
Changes
If this policy changes in a way that affects what we collect or who receives it, the change will be published here with a new effective date, and stated in the application’s release notes rather than made quietly.