Your account
Privacy and your data
Encryption, privacy mode, backups, export, and deletion.
Moola shows you your financial picture, which means it has to hold financial data. This page explains how it is protected, what you can take with you, and how to make it go away. The full privacy policy is the authoritative version.
Encryption
Sensitive fields, including bank access tokens, authenticator secrets, and backup codes, are sealed with a key that belongs to your account. Each person's key is itself wrapped by a master key that is held outside the database. Someone with a copy of the database alone cannot read those fields.
Bank credentials never reach Moola at all. You sign in to your bank inside Plaid; Moola receives a token that can only read.
Privacy mode
The eye icon in the header, or Settings → Privacy mode, blurs every balance and figure in the app. It is remembered per browser and is meant for sharing your screen or using Moola somewhere public. Blurred figures are still fetched; this is a display setting, not a permission.
Your device
The installable web app caches the shell of the app so navigation works offline, and retries saves and navigations after reconnecting. Financial data is never written to the device. The native apps add a biometric lock on the phone.
Taking your data
All of these are in Settings → Your data:
- Export account balances downloads a CSV of every account's balance history.
- Back up your portfolio downloads a validated JSON file of your workspace: accounts, history, events, goals.
- Restore a backup loads one of those files back in. Demo balances cannot be restored into a personal workspace.
- Download everything is a full personal data export: profile, sign-in methods, sessions, bank connections, subscription, and the complete portfolio history. Secrets and tokens are never included.
Deleting your account
Settings → Delete your account permanently deletes your workspace, history, sign-in methods, and passkeys; revokes Moola's access at Plaid for every linked institution; and cancels any subscription immediately. It cannot be undone.
Who else sees your data
| Party | What they receive | Why |
|---|---|---|
| Plaid | Your bank sign-in, on their side | To link accounts and fetch balances and transactions |
| Stripe | Your email and payment details | To bill Moola Plus |
| RentCast | An address you look up | To value a home |
| Finnhub | Ticker symbols | To price investment holdings |
| Anthropic | A de-identified health assessment | To write your Health plan, when you ask for one |
| Resend | Your email address | To send confirmation, reset, and invite mail |
Moola does not sell data and does not show ads. Connected assistants receive only what the tools you approved return; see Connect an assistant.