Mortban Privacy Policy
Effective November 3, 2026
This policy covers the Mortban website and the Mortban app. Mortban is run by Bit Byte Labs LLC (“we” or “us”).
The short version
- We will never sell your data, and Mortban doesn’t show ads. Plus pays for what costs money to run.
- We use your data to run Mortban for you. We don’t use it to train AI models or to market anything from another company.
- Banks are optional. Bank connections come with Plus. Mortban reads balances and transactions and has no way to pay, transfer or withdraw anything.
- Your bank login stays yours. You sign in on Plaid’s screen, and we never see your bank password.
- The website doesn’t track you. It has no analytics, no ads and no cookies.
- You can leave. Export your data to CSV whenever you like, and delete your account from Settings.
What we collect
We collect what Mortban needs to work, and most of it is what you type in. Rows marked Plus apply once Plus opens and only if you use those features.
| What | Examples | Where it comes from | Why we need it |
|---|---|---|---|
| Account details | Email address, time zone, Day or Night, your plan, how far you got through setup | You and your browser | To sign you in, show the right dates and remember your settings |
| What you enter | Purchases (date, item, amount, jar, account), jars and budgets, income, bills, due days and paydays, accounts and balances, which account holds your emergency savings | You | To work out what’s left, your pace, your savings and your nest jar |
| Bank data (Plus) | Bank name; account name, type and current balance; transactions with amount, date, bank description, merchant name, pending status and category | Your bank, through Plaid | To show balances and offer transactions for you to review |
| CSV imports (Plus) | The rows in a file you upload | You | The same as bank data |
| What Mortban works out | Jar guesses, keyword rules learned from your entries, carried leftovers, monthly budget and balance records, including estimated earlier balances | Calculated from the rows above | To fill in your jars, plan, net worth and history |
| Billing details (Plus) | Stripe customer and subscription IDs, plan, status, renewal date | Stripe | To know which plan you’re on. Stripe holds your card, and we never receive the full number |
| Notification settings | The push address for each device, the hour of your daily note, whether the review note is on | You and your browser | To send the notes you asked for |
| Technical details | IP address and browser type stored with your sign-in; IP address, page or API path and time in server logs | Your browser | To keep accounts secure, limit abuse and fix problems |
| Plus waitlist | Email address, the form you used and when | You | To tell you when Plus opens |
| Messages to us | Your email address and whatever you write | You | To reply |
What we don’t collect. We don’t ask for your Social Security number, bank password, full card number, or your bank account and routing numbers. Mortban doesn’t ask for your device’s location, contacts or photos.
A note on what you type. Item names and bill names are free text, and they can say a lot (a clinic, a donation). They get the same protection as the rest of your data. Please don’t enter passwords or account numbers. If you add someone else’s income or details to a plan, make sure they’re fine with that.
How we use it
We use your data to give you Mortban and to keep it working and safe:
- Run your account: sign you in, save your entries, and show your jars, plan, history and notes.
- Bring in bank data you asked for, guess the jar, and offer matches for you to confirm or merge.
- Handle Plus: start a trial, take payment, send renewal notices, and move an account to Free.
- Send account email: sign-in links, security and billing notices, and changes to these documents.
- Send the notes you turned on.
- Answer you when you write to us.
- Protect the service: enforce limits, detect abuse, investigate problems, and fix bugs.
- Meet legal duties, and enforce or defend our rights.
If we ever add product news by email, every message will have an unsubscribe link.
What we never do with your data:
- Sell it or rent it to anyone, for money or anything else.
- Show ads, or share your data so others can target ads at you.
- Use your financial data to make credit, lending or insurance decisions about you, or give it to anyone who would.
- Use your entries or bank data to train AI models.
- Build anonymized or aggregated datasets from your bank data. If that ever changes, we’ll first describe the use clearly in this policy, as Plaid’s rules require.
Who can look at it. Access to your data is limited to people working on Mortban who need it for a task. That means a problem you asked us to help with, a security issue, or a legal duty. We don’t browse accounts.
Who else handles it
A few companies help run Mortban. They get only what their job needs, and we don’t let them use your data for their own marketing.
| Company | What it does | What it handles |
|---|---|---|
| Amazon Web Services | Hosts the app, database and backups, and sends our email | What Mortban stores, plus your email address and the messages we send you |
| Plaid (Plus) | Connects your bank | See Bank connections below |
| Stripe (Plus) | Takes payment and manages subscriptions | Your email address, plan, and the card details you enter on Stripe’s page |
| Apple, Google, Mozilla and other browser makers | Deliver notes to your device, if you turned them on | An encrypted note and your device’s push address |
We also disclose data in these limited cases:
- The law. When a law, court order or valid legal request requires it. We’ll tell you first unless we’re barred from doing so.
- Safety and rights. When it’s reasonably needed to stop fraud or a security threat, protect someone’s safety, or enforce our terms.
- Your say. When you ask us to, such as connecting a bank.
- A change of owner. If Mortban is merged, sold or reorganized, your data can move to the new owner to keep running Mortban. That isn’t a sale of your data for its own sake. The new owner has to keep the promises in this policy for data it receives, or get your consent to change them. We’ll tell you before it happens, so you can export and delete first.
Bank connections
Bank connections are coming with Plus and aren’t open yet. This section applies once they are. They stay optional: you can type every purchase in and never connect anything.
How it works. You pick your bank on Plaid’s screen and sign in there. Plaid gives us an access token, which we store encrypted. You choose which accounts to add. Imports don’t count in your jars until you confirm them.
What we ask Plaid for. Accounts, balances and transactions. We don’t ask Plaid for your account or routing numbers, your identity details, your income or your investment holdings. Mortban has no way to pay, transfer or withdraw anything.
Plaid is its own company. It may collect more than it passes to us, including your bank login, and it uses and shares data under its own rules. Read the Plaid End User Privacy Policy before you connect. You can see and cut off your connections in Plaid Portal, or ask Plaid to delete its copy with its request form.
Disconnecting. You can disconnect a bank from Accounts at any time. We tell Plaid to remove the connection and delete our access token, and no new data comes in. If Plaid can’t be reached, we keep trying until it goes through. Your accounts stay as accounts you update by hand, and imported transactions stay so your history holds up. To remove them too, delete them or delete your account.
Moving to Free. We remove your bank connections at Plaid and delete our access tokens, the same as disconnecting. Imported history stays until you delete it. If you come back to Plus, you connect your banks again.
Unfinished connections. If you start connecting a bank and don’t finish, we remove that connection after about a day.
The website, cookies, the waitlist and notes
The website. It has no analytics, no ads and no cookies, and its fonts are served from our own site. The demos on the site run in your browser, and nothing you type into them is sent anywhere. Our hosting provider may keep basic server logs, covered under How long we keep it.
The app’s cookie. The app sets one cookie that keeps you signed in, for up to 7 days at a time. It can’t be read by scripts, and it isn’t used for tracking.
What stays on your device. The app saves a few settings in your browser, like your last-used account, List or Shelf, dismissed notes and CSV column choices. To work offline, it also keeps a copy of what you last viewed on that device. That copy is cleared when you sign out or when someone else signs in there. On a shared device, sign out when you’re done.
Do Not Track and Global Privacy Control. We don’t track you across other sites or sell your data, so these signals don’t change anything: Mortban already behaves that way for everyone.
The Plus waitlist. We use your email only to tell you when Plus opens. We don’t send a confirmation, add you to other lists, or share your address with anyone except the provider that delivers the email. Each email will have an unsubscribe link, or you can write to us to come off the list. We delete the list within 30 days of announcing Plus.
Mort’s notes. Notes are off until you turn them on. The daily note can include how much you have left, so it may show on your lock screen. Turn notes off in Settings or in your browser or phone settings.
How long we keep it
We keep your account data until you delete it. Everything else has a shorter clock.
| Data | How long |
|---|---|
| Your account and everything in it | Until you delete it. We don’t delete idle accounts today. If that changes, we’ll email you at least 30 days first |
| Backups | Up to 14 days, then they age out |
| Bank access tokens | Until you disconnect the bank, move to Free or delete your account. A queued removal can hold the encrypted token until it finishes, plus about a day |
| Sign-in links | About a day after they expire |
| Sign-in records (IP address, browser type) | Up to 30 days after that sign-in ends |
| Server logs | Up to 30 days |
| Plus waitlist | Until 30 days after we announce Plus, or until you ask to come off |
| Billing records at Stripe and in our accounts | As long as tax and accounting rules require, usually up to 7 years. These hold payment details, never your purchases or jars |
| Messages to us | Up to 2 years, unless a legal matter needs them longer |
We may keep specific data longer if the law requires it or it’s needed for a dispute.
When you delete your account
Delete your account from Settings by typing your email address to confirm. It can’t be undone, so export first if you want a copy. Deleting does this:
- Removes your account, purchases, jars, plans, rules, accounts, balances, notification settings and pending sign-in links from Mortban right away.
- Tells Plaid to remove your bank connections, and keeps trying if Plaid can’t be reached.
- Cancels any Plus subscription, so you aren’t charged again.
- Removes your email from the Plus waitlist, if it’s there.
Copies in backups remain until they age out, within 14 days, and we don’t use them except to recover from a failure. If we ever restore a backup, we’ll delete your account from it again. Plaid and Stripe keep their own records under their own policies.
Your rights and choices
These apply to everyone who uses Mortban, whichever state you live in. Some state laws give you these rights directly, and we offer them regardless.
| You can | How |
|---|---|
| See what we hold | Most of it is on your screens, and you can export it to CSV from Settings. Email us for anything else we hold, like server logs |
| Correct it | Edit it in the app, or email us about your email address |
| Delete it | Delete single entries in the app, or your whole account from Settings |
| Take it with you | Export your transactions, jars, plans, accounts, balances and rules to CSV from Settings, on every plan |
| Stop notes and email | Turn off notes in Settings. Use the unsubscribe link in any waitlist or product email. Account and security email continues while you have an account |
| Disconnect a bank | From Accounts, or in Plaid Portal |
You can’t opt out of sale or targeted advertising because neither happens here. We won’t treat you differently for using any of these rights.
Asking us. Email [email protected], ideally from your account’s address. We’ll confirm it’s you, and we’ll answer within 45 days. If we need more time, we’ll say so, and take up to 45 more. Someone can act for you if they show your written permission. If we say no, reply and ask us to look again, and we’ll answer within 60 days. If you still disagree, you can contact your state attorney general.
California residents. We don’t sell or share personal information as California law defines those words, and we use sensitive information only to provide Mortban. We don’t disclose personal information to third parties for their direct marketing.
Security
Connections to Mortban use HTTPS, and bank access tokens are stored encrypted. There’s no password to leak: sign-in links expire, work once and are rate limited. Every request is checked so one account can’t reach another’s data, and we test that.
No system is perfectly secure. Your email inbox is the key to your account, so protect it, and lock your phone. If a breach affects your data, we’ll tell you as the law requires. Report a security problem to [email protected].
Age
Mortban is for people 18 and older. It isn’t directed at children, and we don’t knowingly collect data from anyone under 18. If you believe a child has signed up, tell us and we’ll delete the account.
Where this applies
Mortban is for people in the United States. It uses US dollars and connects to US banks, and your data is stored and handled in the United States.
Changes to this policy
We’ll post any change here and update the date at the top. If a change matters to how we use your data, we’ll email you at least 30 days before it takes effect. We won’t weaken the promise never to sell your data, or any other promise here, for data we already hold unless you agree.
Contact
Bit Byte Labs LLC 2465 Arnold Mill Rd NW, Lawrenceville, GA 30044, USA [email protected]
Don’t send your bank login or account numbers. Nobody at Mortban will ever ask for them.