Privacy policy

Last updated 2026-09-15

What WhyNABB is

WhyNABB draws charts (net worth, cash flow, spending by category) from the data in your YNAB plan. It is an independent project and is not affiliated with, endorsed by, or supported by YNAB.

What we collect

  • Your YNAB user id, used only to recognise you when you sign in.
  • The OAuth access and refresh tokens YNAB issues when you authorise WhyNABB. We request read-only access; WhyNABB never changes anything in your plan.
  • A copy of your plan data — accounts, categories, payees, transactions and monthly summaries — so the charts can be computed without hitting the YNAB API on every page view.

We never ask for, see, or store your YNAB password or any bank credentials.

How your data is protected

This is exactly what WhyNABB does with your data, in the order it flows through the system.

Access to YNAB

  • You sign in through YNAB's own OAuth page. WhyNABB never sees your YNAB password; it receives a token from YNAB instead.
  • The token is requested with YNAB's read-only scope. YNAB itself refuses any write with that scope, so WhyNABB is technically unable to modify your plan.
  • The sign-in handshake uses PKCE and a one-time state value so a forged or replayed callback is rejected, and the app's client secret is only ever used on the server.
  • You can revoke the token at any time from YNAB → Account Settings → Authorized Apps. Revocation takes effect on the next sync.

In transit

  • All traffic between your browser and WhyNABB, and between WhyNABB and the YNAB API, is HTTPS (TLS 1.2/1.3). Plain HTTP is redirected and HSTS is enabled.
  • The site sets a strict Content-Security-Policy, blocks framing by other sites, and loads no third-party scripts, fonts, analytics or ads.

At rest

  • Your synced plan data lives in a single SQLite database file that is encrypted as a whole (SQLCipher, AES-256). Without the key the file is unreadable — a stolen disk or backup yields ciphertext only.
  • Your YNAB access and refresh tokens are encrypted a second time inside that database (AES-256-GCM) with a separate key, and each ciphertext is bound to your user record so it cannot be copied into another account.
  • Both keys are held only in the server's environment configuration, never in the database, never in the code repository, and never in logs.
  • Application logs automatically redact anything that looks like a token, secret or authorization code.

Isolation between users

  • Every request is tied to your session, and every database query is scoped to plans that belong to your user record. There is no page, API endpoint or admin screen that lists or searches across users.
  • If two people connect the same shared YNAB plan, each gets an independent copy; neither can see the other's.
  • Sessions use a random 256-bit identifier stored in an HttpOnly, Secure, SameSite cookie; only a hash of it is kept on the server, so a copy of the database cannot be used to hijack a session. Sessions expire after 30 days of inactivity and are deleted when you sign out.

Who can see your data

  • You, while signed in.
  • No other user, and no third party. Nothing is shared, sold, or sent anywhere except to the YNAB API to fetch your own plan.
  • The operator of this server could technically read the database, because the server needs the encryption keys to compute your charts. This is the same position any hosted finance app is in; there is no operator-proof mode today. The operator commits to accessing user data only for debugging with the user's consent or to comply with the law.

What is never collected

  • Your YNAB password, bank logins, account numbers, or card numbers — YNAB's API does not expose them and WhyNABB never asks for them.
  • Your email address or name — YNAB's API only provides an opaque user id.
  • Browsing analytics, device fingerprints, or location.

How long we keep it

Until you delete it. Your plan is re-synced while you are connected (when you open the app and once nightly) so the charts stay current.

Deleting your data

Open Settings and choose Disconnect & delete my data. This removes your tokens and every synced record immediately. You can also revoke WhyNABB's access at any time from YNAB → Account Settings → Authorized Apps; the next sync will then fail and you can delete the copy here.

Cookies

One session cookie keeps you signed in, and a short-lived cookie protects the sign-in handshake. There are no analytics or advertising cookies.