Privacy policy

Last updated November 14, 2026.

Household Finance is a private budgeting app used only by the two adults of one household. This policy explains what the app does with information from Google accounts and with other household data.

Google information the app accesses

• Your email address (Google's openid and email permissions), to confirm which Gmail account was connected.
• Read-only access to Gmail (gmail.readonly). Google grants this permission across the whole mailbox. When a mailbox is first connected, the app searches messages from roughly the last 13 months; after that, about every 20 minutes, it searches recent mail (about the last two days). Both searches look for messages that mention receipts, invoices, order or purchase confirmations, order totals or refunds, and the app reads the messages they return. Some of those messages may not be receipts; they are read the same way and set aside if unclear.
• When a household member asks for it, the app can also count (without opening) messages from amazon.com in the mailbox, including Spam and Trash, to check how many Amazon emails exist.

The app never sends, deletes, moves, labels or changes email, and it does not read contacts, calendar or any other Google service.

How receipt information is used

For each message, the app removes formatting and control characters and replaces links and email addresses with placeholders. Messages that are too long, or that contain phrases resembling instructions to an AI, are not sent and are set aside for review. From the rest it extracts the store name, purchase date, items and their prices, tax, shipping, total, order number and whether it is a refund. It then looks for the transaction in the household's Actual Budget that matches the receipt. When exactly one transaction matches, and that transaction has no category, no note and no split, the app automatically writes a note listing the store, date and item names, and a category. It does not change amounts, dates, accounts or payees, does not change a category or note someone set by hand, and does not delete anything. Every automatic change is logged and can be undone from the app unless the transaction has been changed since. Receipts that do not match clearly, or that would need a split, are set aside for a person to review.

The two adults of the household share one budget, so receipt details (store, date, total, items) from either person's Gmail are visible to both of them in the app.

Receipt information is used only to provide these features to the household. It is not used for advertising and is not sold.

Who receives the information

• Cloudflare hosts the app, runs its processing and stores its data.
• OpenAI reads the cleaned receipt text, together with the household's list of budget categories, and returns the extracted details and a suggested category. Email addresses, Gmail message IDs, the sender and other email headers are not sent; the receipt text itself can still include names, addresses and the items purchased. Requests are marked not to be stored by OpenAI, but OpenAI may keep API data for a limited time under its own policies. Under OpenAI's API terms, this data is not used to train its models.
• The household's own Actual Budget server receives the note and category written to a matching transaction.
• Google Public DNS receives the sender's email-signing domain name and key selector (not any message content), so the app can check that a receipt really came from that sender.

No other person or company receives Google information from this app, except where required by law.

What is stored, and for how long

• The full email messages are not stored. The app keeps the details it extracted from each receipt, Gmail message identifiers and fingerprints so the same message is not processed twice, and a log of the changes it made to the budget, including the transaction's state before and after each change.
• Google sign-in tokens are stored encrypted and are used only to read receipts for the person who connected them.
• Receipt records tied to a budget change or an attempted change, including changes that were later undone, are kept with the household's budget records. Review entries for receipts that never matched a transaction are removed after about 90 days. A short-lived processing cache of extracted details is removed after 7 days.
• Hosting backups may keep deleted information for about 30 days.

Your choices

Connecting Gmail is optional, and each person connects only their own account. You can disconnect at any time in the app's Settings. Disconnecting deletes the stored sign-in token and stops all further mailbox reading, and the app asks Google to revoke its access; if Google does not confirm that, remove the access yourself in your Google account connections. Disconnecting does not delete receipt details already saved with the household's budget records, review entries, or the hashed markers that stop a message from being processed twice, and notes and categories already written to the budget stay there unless you undo or change them. To ask for receipt information to be deleted, use the contact below.

Google API Services User Data Policy

Household Finance's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. People do not read Gmail data through this app except with the account owner's agreement, or when needed for security, to fix a problem, or to comply with the law.

Contact

Questions about this policy can be sent to the support email address shown on the app's Google sign-in screen.