Privacy
How Nya handles your data, in plain language.
Note: This page is a plain-language summary, not a legal privacy policy.
Nya’s commitments
Nya never sells or shares your financial data.
- True today
- Nya shows no ads, uses no analytics or tracking tools, and sends your data only to the services listed under Who processes your data, each for the one job named there. Sharing with people you choose is up to you.
- Not written yet
- A formal privacy policy that puts this in writing.
You can download everything stored about you, in open formats, whenever you like.
- True today
- Download my data, in Settings under Your data and privacy, gives you everything stored about you, decrypted: one JSON file, CSV files of your transactions and of your balance history, or a bank account’s or card’s transactions as an OFX file for other money apps. You can protect any of them with a passphrase of your own, which Nya never keeps. If something stored can’t be read, the file names it, apart from a few sharing and bank-account records the app itself passes over. A fresh sign-in comes first, and each account can download 5 times an hour. This copy of Nya sends no email, so a download isn’t emailed to you. Where whoever runs this copy of Nya has turned it on, Bring back a download, beside it, brings a JSON download into an empty account, in this copy of Nya or another: the file is read in your browser and never stored. Your receipts and documents come as ZIP files of their own, under Receipts and documents beside it.
You can delete everything, and it reaches backups and connected services.
- True today
- Delete my account disconnects your banks at Plaid, deletes everything stored for you, ends all sharing and deletes your sign-in, then gives you a receipt of what was deleted, what expires when, and what stays and why. Nightly backups taken before a deletion keep a copy until they are deleted, within 32 days while the nightly backup keeps running; if it stops, nothing is deleted until it runs again. Each account made on this version of Nya normally has a data key of its own from the start, and an account made before it (or one made while a key couldn’t be) has one once whoever runs this copy has moved it; until then, its data is under a key shared by everyone on this copy. Deleting an account destroys its own key, so nothing encrypted under it can be decrypted from any copy Nya keeps, normally within minutes of the deletion and at the latest after the next nightly backup that succeeds. The encrypted copies stay in backups, unreadable, until they are deleted, and the plain text in them stays readable until then. Copies under a shared key stay readable with it until they are deleted. The receipt says which applies to the account. Plaid keeps what it collected under its own policy; the receipt links to the Plaid Portal, where you can delete it.
- Not built yet
- Encrypting the details stored as plain text (dates, ids, bank names and the like), which stay readable in backups until they are deleted.
You decide what anyone else sees, and you can see what they see about you.
- True today
- Nothing is shared until you choose, person by person and account by account, and hidden accounts are never shared. Beyond accounts, you can choose to share your net worth, as an amount, and your spending by category, your holdings, your budgets or goals you pick, each as percentages or amounts, never the transactions behind them; a net worth lists no account whose balance you don’t share. Once you choose a home currency, what you share is shown in it, converted at the European Central Bank’s daily rates alone, never at your own rates, and they see that it is converted at those rates, never a rate itself; what only a rate of your own would convert is left out of what is converted, and named by its currency. If the European Central Bank doesn’t publish your home currency, what you share isn’t converted at all. Before you save, Sharing says what Nya knows they could work out from it all together (what your other accounts add up to beside your net worth, your income from your net worth and spending, what goes into a goal each month, and amounts from percentages beside an amount of the same money), and that this isn’t every way. For each person, Sharing shows a preview of exactly what they see of yours, and a record of each time it was shown to them. They see that same record, and you see theirs of each time what they share was shown to you; both records are in both of your downloads. A share can end on a date you set, which they see too. Remove or Block ends everything shared both ways at once and deletes both records, as does either of you deleting your account. The people you split costs with under Shared expenses are never shown to anyone you share with, nor named in an email: their names and usernames are encrypted in your account, and seen only by you, in your download, and by a program you give an API token to, through its shared expenses answer. Forget someone and their name and usernames are deleted, and the amounts stay. Nya never sends, receives or holds money, and keeps no payment app’s login, card or account number: asking someone to pay you opens Venmo with the request filled in, or gives you a message to send yourself.
You can see who can read what, including whoever runs Nya.
- True today
- The Security page lists everyone who can read your data, what each can read, and what is stored without encryption. Your data, in Settings under Your data and privacy, lists each kind of thing Nya keeps about you: how much of it there is, whether it is encrypted and with which key, whether it is in your download, how long it is kept and who else can see it. It shows numbers only, never what is stored.
- Not built yet
- A managed key service that records every use of the master key, so access by whoever runs Nya leaves a trace.
Receipts and documents are never shared.
- True today
- A receipt can show what you bought, at a pharmacy say, so Nya treats what you attach as more private than the transaction it is on: it is never shared, even where the transaction is, never sent to a program with an API token, never in an email, and never kept on your device by Nya. You can delete one at any time: once it is gone from the file store (at once, or by a later nightly run if the store can’t be reached), no backup can bring it back. This copy of Nya keeps one copy of each file, so download them to keep your own.
- Not turned on here
- Adding new receipts and documents is off on this copy of Nya; any already attached stay as described.
AI features are opt-in and act only on what you point them at.
- True today
- Nya has no AI features of its own, and sends nothing to an AI provider unless you connect one. If you connect an AI assistant to Nya’s MCP server, with a token you make for it, it can read what that token reads (the Developers page lists it) until you revoke the token, and its provider keeps what it reads under its own terms. Where whoever runs this copy of Nya lets tokens make changes, with a token you make to make changes it can also add, change and delete the transactions entered on your manual accounts, and add and change your manual accounts, categories and tags; it can be tricked into a change by something it reads, so each change is listed for you under API tokens for 30 days, where most can be undone.
- Planned
- Reading receipts: off unless you turn it on, and only for the receipt you choose.
You can leave.
- True today
- You can download everything stored about you, and delete your account and everything stored for you, at any time. An API lets programs you choose, each with a token you can revoke, read your data whenever you like and, where whoever runs this copy of Nya lets tokens make changes, with a token made for it, add, change and delete the transactions entered on your manual accounts, and add and change your manual accounts, categories and tags (see the Developers page).
- Not built yet
- Writing your bank’s transactions through the API, and a license that lets anyone run their own copy of Nya. The code is public but has no license yet.
Who processes your data
| Vercel | Hosts the app and stores the nightly backups. Stores the receipts and documents you attach, encrypted; each file’s key is locked in the database, apart from the files. Handles every request and response, and keeps the app’s logs. |
|---|---|
| Upstash | The database. Holds your data: the values that hold money encrypted, and the details listed on the Security page in plain text. Its own internal copies follow its own policy. |
| Plaid | Connects your banks. Sees your bank login (in Plaid’s window, never shown to Nya), then your accounts, balances and transactions, under Plaid’s own privacy policy. |
| SimpleFIN, if you connect it | Only if you connect your own SimpleFIN account, which you pay SimpleFIN for (or another paid service that speaks its protocol, such as Redbark). It holds your bank connections, made through the provider it uses to reach banks, under its own terms, and sees when Nya asks. Nya keeps the read-only access it gives Nya, encrypted. About once a day Nya reads your accounts there, and keeps the balances and transactions of the ones you choose to track, and only the names of the others. |
| Lunch Flow, if you connect it | Only if you connect your own Lunch Flow account, which you pay Lunch Flow for. It holds your bank connections, made through the providers it uses to reach banks (such as GoCardless, Akahu and MX), under its own terms, and sees when Nya asks and which of your accounts it asks about. Nya keeps the API key you give it, encrypted, and never shows it again. About once a day Nya reads your accounts there, and keeps the balances and transactions of the ones you choose to track, and only the names of the others. |
| Clerk | Signs you in, when this copy of Nya uses accounts rather than a shared password. Holds your email address and sign-in activity, and your name and picture if you sign in with Google or another account, and may email you sign-in codes and invitations. Its bot check runs on Cloudflare (Turnstile), which sees your IP address and browser when it runs. |
Not used yet: no billing provider, since Nya charges nothing yet, and no email provider, since this copy of Nya sends no email of its own.
Public data Nya uses: the exchange rates a home currency converts with are the European Central Bank’s euro reference rates, which Nya’s server downloads once a day, the same for everyone. The ECB is sent nothing about you, and can’t tell who uses them.
How long things are kept
| What | How long |
|---|---|
| Your data | Until you delete it, or delete your account. |
| How each bank connection is doing | When it last answered, Plaid’s warnings that it is going to end, and the record of a problem with it (when it began, what it was, and when you were emailed about it): until the connection is removed. The warnings and the problem records go sooner, once the connection works again. Encrypted, and in your download. |
| A bank you disconnect | Its transactions are deleted at once, except that for each one you recategorized, its date, amount and bank description are kept, encrypted, so the category carries across a reconnection. What you told your plan about its accounts for tax is deleted at once too. Its accounts’ balance history, names, the categories you set and the months you imported stay, until you Forget them (Settings, Connections, Earlier accounts) or delete your account. |
| A download you brought back | What it held is your data, kept as the rest is. A bank in it that was connected through Plaid keeps its transactions, encrypted, until you Forget it: they count once you connect it again and link its accounts (then as its own), or once you say the bank is gone (then as an ended account’s, up to the day you give). What you answer about it (that it is gone, which connections made since it isn’t at, which account carries it on) is kept with it, encrypted and in your download, until you Forget it, undo the restore, empty the account or delete it. An account from SimpleFIN or Lunch Flow you carry on with the one you track in its place keeps what it was, so undoing that puts it back. The record of the restore (when the file was made, its size, and how much came back) stays until you undo the restore, empty the account or delete it; the file itself is never stored. |
| Receipts and documents you attach | Until you delete them, or delete your account. When a transaction goes (your bank removes it, you delete it, you forget its account, you empty your account to bring back a download), its receipts stay, under Receipts and documents, for you to attach again or delete. Once a file you delete is gone from the file store (at once, or by a later nightly run if the store can’t be reached), no backup can bring it back; the nightly backups keep only its record, for up to 32 days while they run. This copy of Nya keeps one copy of each file: download them to keep your own. Adding new ones is off on this copy of Nya. |
| Months you import from Vanguard’s Performance page | The PDF is read on your device and never sent to Nya: only its months are, each month’s deposits and withdrawals, returns and ending balance, with the balance the first began at, the file’s name and when you imported it. Each import is kept until you undo it, Forget the account or delete your account. Encrypted, and in your download. Never shown to anyone you share with. |
| A SimpleFIN connection | The access SimpleFIN gave Nya, encrypted, never in your download and never in backups: until you disconnect it, or delete your account. Restoring a backup ends it: you connect again with a new Setup Token, and the accounts carry on. Its accounts and their transactions are kept like any account’s. Disconnecting deletes the access; you choose to keep the accounts as manual accounts, or to remove them and their transactions (their past balances stay in your net-worth history). A note of each account you stop tracking (its name, its bank and when) stays, so a report on a period it was tracked in can say what may be missing, until you forget it on the Reports page, or delete your account. SimpleFIN keeps what it holds under its own terms: remove Nya in your SimpleFIN account too. |
| A Lunch Flow connection | The API key you gave Nya, encrypted, never in your download and never in backups: until you disconnect it, or delete your account. Restoring a backup ends it: you connect again with an API key, and the accounts carry on. Its accounts and their transactions are kept like any account’s. Disconnecting deletes the key; you choose to keep the accounts as manual accounts, or to remove them and their transactions (their past balances stay in your net-worth history). A note of each account you stop tracking stays as for SimpleFIN, until you forget it on the Reports page, or delete your account. Lunch Flow keeps what it holds under its own terms, and the key works there until you delete its API destination in Lunch Flow. |
| Nightly backups | 30 days. The newest 7 are always kept, so if backups stop, the last ones remain. |
| A deleted account | Out of reach at once, and deleted from the database, apart from invite links you made that nobody used (your sign-in id and the name you gave), which expire within 72 hours. Its random id leaves the feature switches at once, and stays in their record of changes until those changes drop out of the last 500. Nightly backups taken before a deletion keep a copy until they are deleted, within 32 days while the nightly backup keeps running; if it stops, nothing is deleted until it runs again. Deleting an account destroys its own key, so nothing encrypted under it can be decrypted from any copy Nya keeps, normally within minutes of the deletion and at the latest after the next nightly backup that succeeds. The encrypted copies stay in backups, unreadable, until they are deleted, and the plain text in them stays readable until then. Copies under a shared key stay readable with it until they are deleted. The receipt says which applies to the account. Plaid keeps what it collected under its own policy. |
| A record that a deleted account existed | Its random id and the day its key was destroyed: kept for good, so that a restored backup never brings the account back. |
| Invite links | 72 hours, or until used. |
| Records of when shared accounts were shown | Each entry is deleted after 90 days, by a pass that runs every night, and both people’s records go at once when either of you removes or blocks the other, or deletes their account. Nightly backups keep a copy up to 32 days more, while the nightly backup keeps running. |
| Copies of what the dashboard shows | Short-lived: used for 15 minutes, or up to 6 hours where Plaid is set up to say when new data arrives, and cleared whenever your data changes. Encrypted. |
| The app’s own records about your data | Locks, notes that a bank’s transactions grew too large to save or failed to save, the daily snapshot’s record of how each recent day went, when each day’s balances were taken and its checks on your connections, summaries and indexes kept beside your data, and how far longer jobs have got: until what they are about goes, or you delete your account. Your data, in Settings, says which of them are plain text. |
| Counts that limit how often you can do something | Downloads of your data, looks at Your data, file imports and reads of the list of them, restores and the steps of one, and connecting to SimpleFIN or Lunch Flow and the requests made to them: each counted for its own window, an hour or a day from its first count, and then gone. Nightly backups keep a copy of all but those of SimpleFIN and Lunch Flow up to 32 days more, while the nightly backup keeps running. |
| API tokens | Until you revoke them, or delete your account. Each is kept as its name, what it can do, the sign-in account that made it (with sign-in accounts), when it was made and last used, and a hash of its secret, all encrypted; the token itself is shown once and never stored. Signing out everywhere, or a change of the shared password, doesn’t end them. They are never in backups, so restoring one ends them all. |
| Requests counted for each API token | Its count for the current 60-second window, deleted when the token is revoked, or 2 minutes after the last request made with any of your tokens. Where tokens may make changes, for a token that can update balances or make changes, also its writes in the current minute and its changes in the current 24 hours (each counted from the first), and all your tokens’ changes in the current 24 hours, whether a token set each manual account’s balance in the current 24 hours, and a fingerprint of each key a program sent so that making something twice makes it once, kept 24 hours: deleted when the token is revoked, or once their window is over. Never in backups. |
| Changes made with API tokens | Where tokens may make changes: 30 days, or until you delete your account: each change a token made, and each undo, when, which token, through the API or an AI assistant, and what it changed, before and after, encrypted, so a transaction a change deleted is kept with it for those 30 days. Forgetting a change under API tokens removes what it changed, before and after, at once (and what its undo kept); its line, saying when, which token, what kind of change and the id of what it changed, stays for the 30 days. A token that can make changes can read its own; tokens that only read can’t. In your download and in backups; never brought back with a download. |
| The weekly summary | Whether it is on, its day and your time zone: until you change them, or delete your account. Encrypted, and in your download. Beside them, encrypted too and kept until you delete your account, but not in your download: the key its links to turn it off are signed with, made anew each time you turn it on; the last week a summary went for, and one that got no answer from the email service; and which of your goals, by their ids, it last said had reached their target. Each link works for 90 days. |
| The people you split costs with, and what is owed | Until you remove it, or delete your account: Forget someone, and their name, usernames and requests are deleted at once, and the amounts stay, so no total changes. Encrypted, and in your download. Of payment apps, Nya keeps only the usernames you give, which app you use, and, for each of the last 20 times you asked someone to pay or paid them through one (or sent the message), when, how much, which way, how you sent it and what it was for: never what happened there. |
| Your home currency and your own exchange rates | Until you change them, or delete your account. Encrypted, and in your download. Nothing converted is kept by Nya’s server: each figure is worked out again when it is shown (your device keeps the last ones it showed, with the rest of what the app last showed). The European Central Bank’s rates are public, kept once for everyone in plain text, and left out of Nya’s nightly backups. |
| What you tell your plan about tax | Whose each account is, a cost basis you typed, what each of you put into a Roth and which accounts for a child you count; and if you have Nya work tax out from your accounts, how you file, your birth years, how long each dependent counts, which category or tag already pays for coverage and, for each plan, your state and its rate, your health coverage and what it costs, how your savings split and the inflation and yield it uses: until you change them, or delete your account. What you said about an account goes once you Forget it or remove it, or disconnect a bank connected through Plaid. An account you keep as a manual account when you disconnect SimpleFIN or Lunch Flow keeps it. Encrypted, and in your download. None of these are shown to anyone you share with, sent to a program with an API token, or put in an email. The buckets you choose for your accounts are a separate setting, and what you share of your holdings is split by them. |
| Feature switches and their changes | Settings of this copy of Nya, not of your account: who each feature is turned on for, which can name your account by its random id, and who may sign in, which can name your sign-in by its id or its email. Kept until whoever runs this copy changes them, beside a record of the last 500 changes (when, which switch, what it was and became, and who changed it), which keeps what it names, a deleted account’s id among them, until the change drops out of it. Plain text, in backups, and never in your download. |
| Weekly summaries you asked for now, and uses of a link to turn one off | Counted for a day, and for an hour. |
| Reads of what is shared with you, and of what someone sees of yours | Counted for 10 minutes. |
| Nightly jobs the admin ran by hand | Counted for 6 minutes, in the admin’s own account, so one runs at a time. |
| Sessions with the shared password | 30 days, or until you sign out everywhere. |
| Sessions with Clerk accounts | As long as Clerk’s session settings for this copy of Nya allow. |
| Failed password attempts, counted by IP address | 15 minutes. |
| Requests with API tokens, or links to turn off a weekly summary, that didn’t work, counted by IP address | 10 minutes. |
| What your device keeps | Your accounts, their balances and your net-worth history, as the app last showed them, until you sign out on that device, or it next finds you were signed out elsewhere. If you choose a light or dark theme, that choice, in a cookie your browser sends with each page so it opens in that theme, for a year or until you choose System. |
Download your data
Open Settings (the account menu, or the gear), then Your data and privacy, then Download my data. Choose everything, as one JSON file, or your transactions or your balance history, each as a CSV file for a spreadsheet, or one bank account’s or card’s transactions as an OFX file, which other money apps import. The values come decrypted.
A fresh sign-in comes first: with Clerk accounts, one from the last ten minutes, or Clerk asks you to confirm it is you; with the shared password, the password again. Each account can download 5 times an hour. This copy of Nya sends no email, so a download isn’t emailed to you.
Unless you protect it with a passphrase, the file itself is not encrypted, so keep it somewhere safe. Protected, it is saved encrypted in the age format: open it on the Open a protected download page, in your browser, without signing in and without the file leaving your device, or with the age app. Nya never keeps the passphrase, so a lost one can’t be recovered.
The file leaves out the tokens that reach your banks, the access a SimpleFIN account gives Nya and the Lunch Flow API key you give it, which are credentials rather than your data, your API tokens themselves (each one’s name and dates are in), your sign-in, and other people’s data; the JSON file lists what it leaves out.
Your receipts and documents come as a download of their own: in Settings, Your data and privacy, Receipts and documents, as ZIP files of about 50 MB each, decrypted, behind the same fresh sign-in and counted as one download. Protect them with a passphrase, since they show what you bought. The JSON file lists them, without the files themselves.
Where whoever runs this copy of Nya has turned it on, Bring back a download, beside it, brings a JSON download into an account with nothing in it yet, in this copy of Nya or another. The file is read in your browser and never stored: only what it holds is written, into your account, encrypted as the rest of your data is. A fresh sign-in comes first, and this copy of Nya sends no email, so starting one isn’t emailed to you. Your banks’ access, your API tokens and sharing never come back: you connect, make and share them again. Nor, yet, do your receipts and documents: keep your ZIP download of them. Undo, offered while a restore is unfinished and for 7 days after it finishes, empties the account again.
Delete your account
If you sign in with your own account, open your account menu (your picture or initial, at the top right), choose Manage account, then Data & privacy, and use Delete my account. It disconnects your banks at Plaid, deletes everything stored for you, ends all sharing both ways, and deletes your sign-in. It cannot be undone. It ends with a receipt, to copy or save: what was deleted, when the last backup holding your data is gone, and what stays and why.
- Nightly backups taken before a deletion keep a copy until they are deleted, within 32 days while the nightly backup keeps running; if it stops, nothing is deleted until it runs again. The receipt gives the date.
- Each account made on this version of Nya normally has a data key of its own from the start, and an account made before it (or one made while a key couldn’t be) has one once whoever runs this copy has moved it; until then, its data is under a key shared by everyone on this copy. Deleting an account destroys its own key, so nothing encrypted under it can be decrypted from any copy Nya keeps, normally within minutes of the deletion and at the latest after the next nightly backup that succeeds. The encrypted copies stay in backups, unreadable, until they are deleted, and the plain text in them stays readable until then. Copies under a shared key stay readable with it until they are deleted. The receipt says which applies to the account.
- Your receipts and documents are deleted from the file store (part of them by a later nightly run if the store can’t be reached), and the key that would open them is destroyed.
- What deleting your key doesn’t reach: a backup of the keys that whoever runs this copy of Nya downloaded by hand, for as long as they keep it; a backup taken while an older version of Nya ran, which holds every key; a record that the account existed: its random id and the day its key was destroyed, kept for good, so that a restored backup never brings the account back.
- Invite links you made that nobody has used hold your sign-in id and the name you gave, and expire on their own within 72 hours.
- Plaid keeps its own record of the connections you made through it. To see what Plaid holds about you, or delete it, use the Plaid Portal (my.plaid.com).
- SimpleFIN keeps your bank connections under its own terms. Deleting your account deletes the access it gave Nya; to end it on SimpleFIN’s side too, remove Nya in your SimpleFIN account.
- Lunch Flow keeps your bank connections under its own terms. Deleting your account deletes the API key you gave Nya; to end it on Lunch Flow’s side too, delete its API destination in Lunch Flow.
- The first account on a copy of Nya, the operator’s own, cannot be deleted from the app.
- With the shared password there is no delete button: ask the operator.