Privacy Policy

Last updated: September 25, 2026

This policy says what Money on Rails collects, why, who else handles it, how long we keep it, and how to get it deleted. We never sell your data, and we don't show ads.

Money on Rails is run by Gerardo Sanchez Lopez, an individual developer based in Nuevo León, Mexico. It is not a company. In this policy, "we" and "us" mean him. Money on Rails is an analytics tool that reads your YNAB plan through YNAB's own API, with your permission. Money on Rails is not affiliated, associated, or in any way officially connected with YNAB or any of its subsidiaries or affiliates.

The short version

• We read your YNAB plan with read-only access. We never change anything in YNAB.
• We keep your Categories, their monthly numbers and your income transactions. We don't keep your spending transactions.
• To sort your Categories, we send their names, and nothing else, to OpenAI. OpenAI keeps them for up to 30 days and does not train on them.
• You can delete your account at any time. It is usually gone within a day. A few things are not part of your account and follow their own schedule, as explained in "Deleting your account," below.

What we collect and why

What	Why
Your YNAB user ID, a random code YNAB gives us. YNAB does not give us your name or your email address.	To recognize you when you sign in again.
Your YNAB access token and refresh token.	To read your plan on your behalf while you stay connected.
The name of the plan you connected, its currency format and the range of months it covers.	To show your plan and format its amounts.
Your Category Groups and Categories: their names, their order, whether they are hidden or deleted in YNAB, and whether a Category has a target, with the target's type and amount.	To build every view in the app, and to check whether your true expenses have a target.
Each Category's monthly numbers: what you assigned, what you spent or received (activity), and what was available.	To compute your Adherence Rating, Category Adherence and Plan Quality Rating.
Income transactions only. For each one: date, amount, payee name, Category, whether it was deleted in YNAB, and, if it was a transfer from another of your accounts, that account's YNAB ID. We don't keep spending transactions or memos.	To group your payees into Income Sources for the cash-flow view.
Your Income Sources, which payees belong to each, and any changes you make to them.	To show where your income comes from, the way you want it grouped.
How each Category is sorted into Needs, Wants or Savings, which Categories fund each of eight common true expenses, your corrections, your emergency fund choice, and a history of these suggestions and corrections. The history includes Category names and which AI model made each suggestion.	To compute your Plan Quality Rating and to show you what was suggested and what you changed.
The ratings and summaries we compute from all of the above.	So pages load quickly without recomputing everything.
A sign-in session.	To keep you signed in.
If you were invited: a short note of who the invite was for, which may be your email address.	So we know who each invite went to and don't issue more than YNAB allows.
If you ask for an invite: your email address, your note if you wrote one, and a scrambled form of your network address. See "Asking for an invite," below.	To answer your request and to slow down spam.
Emails you send us.	To answer you.

We ask YNAB for read-only access, the narrowest access YNAB offers. When the app reads your plan, YNAB sends more than we keep, for example your spending transactions and your accounts. The app uses that data only to pick out what is listed above and stores nothing else.

How we use AI to sort your Categories

When you first connect your plan, and later when YNAB shows us Categories that haven't been sorted yet, we ask an AI model to suggest two things: whether each Category is a Need, a Want or Savings, and which of your Categories, if any, pays for each of eight common true expenses, such as car insurance or gifts. You can change any suggestion.

• The model is OpenAI's GPT-5.6 Luna, reached through OpenAI's API.
• We send only Category names. For Needs, Wants and Savings we send the names of the unsorted Categories, eight at a time. For true expenses we send your full list of Category names, once for each of the eight expenses.
• We don't send amounts, payees, transactions, account names, any ID, or anything that says who you are or which YNAB account the names came from.
• A Category name is text you typed, and we send it exactly as you typed it. If a name contains something personal, such as a person's name, OpenAI receives that too.
• OpenAI does not use data sent through its API to train its models unless we opt in, and we have not.
• OpenAI keeps what we send, and what it sends back, for up to 30 days to watch for abuse of its service, and longer only if the law requires it. Deleting your Money on Rails account does not shorten this.
• We never use one person's Category names to sort another person's Categories.

Who else handles your data

These are all the outside services that handle personal data for Money on Rails. We don't sell or rent your data to anyone.

• YNAB is where your plan data comes from. We read only what your read-only permission allows.
• OpenAI receives Category names, as described above.
• Google Cloud runs the app, holds the master encryption key that protects your YNAB tokens, stores the app's secrets, and keeps the app's logs. It runs in the United States.
• Neon hosts our database, which holds everything in the table above. Neon runs it on Amazon Web Services in the United States.
• Cloudflare forwards email sent to privacy@moneyonrails.app to the operator's inbox.
• GitHub hosts this public website: the home page, the Terms and this policy. The app itself does not run on GitHub.

The operator is the only person with access to the database. He looks at your data only to fix a problem you reported, to look into abuse, or when the law requires it. We hand data to a government or court only when the law compels us to.

Asking for an invite

Money on Rails is invite-only for now. Anyone can ask for an invite with the form at dash.moneyonrails.app/request-invite. Here is what that form collects and what happens to it.

• We keep your email address and, if you write one, your note. We ask for nothing else: no name, and no question about how you found us.
• Only the operator reads requests, one by one. We store them in the same database as everything else and share them with no one.
• If you're invited and join, we delete your request 30 days after you join. If no invite follows, we delete it after 12 months. For now the operator deletes requests by hand on this schedule, until an automatic job takes over.
• If we invite you from your request, your email address becomes the note on your invite. Once you join, that note belongs to your account, and we delete it with your account.
• You have no account to sign in to, so no button deletes a request. To have yours deleted sooner, email privacy@moneyonrails.app from the address you used.
• To slow down spam, the form limits how many requests one network can send in an hour. For that it keeps a scrambled form of your network (IP) address and the time of each request. A secret key does the scrambling, so nobody can turn it back into your address without that key. We never store your actual IP address. Each time anyone uses the form, it deletes entries older than an hour.

How we protect your data

• Your browser talks to the app over HTTPS, and so does the app when it talks to YNAB and OpenAI.
• We encrypt your YNAB tokens before we store them. Each token gets its own key. A master key in Google Cloud Key Management Service locks that key, and the master key never leaves Google's service. We never store or log your tokens in readable form.
• We store your sign-in session and any invite link only as a keyed hash. Someone with a copy of the database could not use it to sign in as you or to use your invite.
• Our application logs use a fixed list of what may be recorded: IDs, status codes, times and counts. Amounts, payee names, Category names, email addresses and IP addresses are not on the list, and the logging code drops anything that isn't. Google Cloud also keeps its own standard record of each request to the app, such as the time, the page and the IP address the request came from.
• When YNAB tells us your access has been revoked or has expired, we delete our copy of your tokens right away. Your history stays until you delete your account.

Deleting your account

• You can delete your account from Settings, or by emailing us.
• When you ask, we sign you out everywhere. A deletion job runs once a day and removes your account the next time it runs, so it is usually gone within a day. We will always finish within 30 days.
• It deletes everything: your YNAB connection and tokens, your plan's synced data, Categories and their names, income transactions, Income Sources, ratings, every suggestion and correction, and your sessions.
• A few things are not part of your account, so deleting it does not remove them. An invite request you sent before joining follows its own schedule, described in "Asking for an invite." Our app logs identify you only by a random account ID, never by name, email address or IP address, and Google Cloud deletes them, along with its own request records, when its log retention period ends.
• A request can't be cancelled. Until the job runs, you can't sign in again. After it runs, signing in with YNAB would start a new account, which needs a new invite.
• Our database host, Neon, keeps a short restore history of the database, never more than 7 days. Deleted data can remain in our database host's restore history for up to 7 more days after the deletion job runs.
• OpenAI deletes its copy of any Category names we sent on its own schedule, up to 30 days after we sent them.
• We can't remove Money on Rails' access at YNAB for you. We delete our copy of your tokens, but YNAB does not let apps revoke their own access. To remove it completely, remove Money on Rails in your YNAB account settings.

How long we keep data

Data	How long
Your account, synced plan data, income transactions, Income Sources, ratings, Category sorting and its history	While you have an account. Deleted when you delete your account, as described above.
Your YNAB tokens	While your connection works. Deleted as soon as YNAB reports the access revoked or expired, and always when you delete your account.
Your sign-in session	Ends 30 days after you last used the app, when you sign out, or when you delete your account.
Invite note (if you were invited)	Once you join, while you have an account. An unused invite has no expiry date; email us and we will delete it.
Invite request (email address and note)	30 days after you join, or 12 months if no invite follows. For now the operator deletes them by hand on this schedule, until an automatic job takes over. Sooner if you email privacy@moneyonrails.app.
Scrambled network address from the request form	One hour, then deleted the next time anyone uses the form.
Category names held by OpenAI	Up to 30 days from when we sent them, then deleted by OpenAI.
Our database host's restore history (Neon)	Up to 7 days. Deleted data can remain there for up to 7 more days.
App logs and Google Cloud's request records	Deleted automatically by Google Cloud when its log retention period ends.
Emails you send us	In the operator's mailbox until he deletes them. Ask and he will delete yours.

Your choices and rights

• The app shows you almost everything we keep about your plan. To see anything else we hold, email us.
• You can change any Category's Needs, Wants or Savings choice, any true-expense match and your Income Sources in the app. Your plan data itself comes from YNAB, so fix it there.
• You can delete your account in Settings, or by emailing us.
• To object to something we do with your data, or to ask us to do less with it, email us and we will reply.
• The original of your plan data is always in YNAB. For a copy of what we hold, email us.

Cookies and tracking

The app sets three cookies, all for signing in:

• mor_session holds your sign-in session. It ends 30 days after you last used the app.
• mor_signin_nonce lasts about 10 minutes while you sign in with YNAB.
• mor_known_browser lasts up to 400 days. It holds only a signed record of when this browser last signed in. It names no account and holds no personal data. It stays after you sign out, so you can sign in again when you come back.

If you pick a light or dark theme, your browser remembers it on your own device. We use no analytics, no advertising and no tracking cookies. This website loads its fonts from Google Fonts and the "Works with YNAB" badge from YNAB, so those services see your visit.

Who can use Money on Rails

Money on Rails is invite-only and offered only to people in the United States. It is not meant for anyone under 13, and we don't knowingly collect data from them.

If you approve Money on Rails at YNAB without an invite, the app turns you away before it asks YNAB for a token, and it creates no account. You did still give Money on Rails permission at YNAB, so remove it in your YNAB account settings.

California residents

If you live in California, this page is our privacy notice under the California Online Privacy Protection Act. Money on Rails is small and invite-only, and we don't believe the California Consumer Privacy Act applies to it today. Every right on this page is open to every user anyway.

Where your data is

The operator runs Money on Rails from Mexico. The servers that store and process your data are in the United States. If we start serving people outside the United States, we will update this policy first.

Changes to this policy

If we start collecting a new kind of data, or using your data for something new, we will update this policy first and, where YNAB's rules require it, ask for your consent again. We review this policy at least every 6 to 12 months against YNAB's API Terms of Service and current law. The date at the top shows the last change.

Contact us

Questions, data requests, or a request to delete your account or your invite request: privacy@moneyonrails.app