Skip to content
Ralphy
← Back to home
Trust

What Ralphy does with your data

Connecting a bank to an app from someone you've never heard of is a reasonable thing to hesitate over. So this page is not a reassurance. It is the specifics: what leaves your bank, where it lands, what a model sees, and what happens when you delete.

The data path

From your bank to one number.

Each boundary has one job. The labels below say what crosses it and what stays behind.

01

Your bank

Your username and password stay here.

02

Plaid

Turns your bank login into a read-only connection.

03

Ralphy + Convex

Stores the feed and works out bills, cards, paydays, and the buffer.

04

Your iPhone

The daily number, its receipt, and local notification amounts.

No money rail

The Plaid token is read-only. It has no permission to transfer or hold funds.

One narrow model call

Peer-to-peer note + amount → categorization model. It returns a category. Your name, balances, accounts, and other transactions are left out.

When you delete

Settings → Delete account. Ralphy purges its rows and revokes the Plaid connection so the data path closes.

Four things Ralphy cannot do

Not "does not". Cannot. These are properties of how it is built, and the first matters most: the connection Ralphy holds is read-only, so there is no transfer permission to misuse, by us or by anyone who took it from us.

  • Move your money. Read-only end to end. Ralphy holds no payment or transfer permissions, and the spend limit is advice: it never sits between you and your card.
  • See your bank password. You sign in at your bank, inside Plaid. Credentials never touch our systems, so there is nothing on our side to leak.
  • Sell your data. The subscription is the only way Ralphy makes money. No ads, no data sale, no affiliate kickbacks.
  • Keep what you delete. Deleting your account purges your rows and revokes the bank connection at Plaid. More on that below.

How the bank connection actually works

Ralphy uses Plaid, the connection layer behind much of the US fintech industry. You type your bank credentials into Plaid, never into Ralphy. What comes back is a read-only token.

You sign in to Ralphy with Sign in with Apple, so Ralphy holds no password of yours either. There is no Ralphy password to steal, reuse, or leak, because one was never created.

What actually leaves your bank

The honest answer, stated plainly: Ralphy does receive your financial data. It has to. The number is made of it. Anyone saying their budgeting app doesn't see your transactions is wrong or not doing arithmetic. What it receives is narrow, and it's listed here:

  • Accounts and balances for the accounts you choose to link.
  • Transactions: date, amount, merchant and the category your bank's data provider assigned.
  • Card terms, if you link a credit card: APR, minimum payment, due date. This is the Plaid "Liabilities" product, and it's what lets Ralphy tell you what a card will actually cost rather than guess.

What never arrives at all: your bank username or password, your full card numbers, and any government identifier. Ralphy asks for nothing else.

What the AI sees, exactly

This is the question we get asked most, so here is the precise answer rather than a comfortable one.

Your categories come from your bank's data provider, not a model. A model is used in exactly one place: peer-to-peer payments, the Venmo-style rows where the merchant isn't a shop but a person's name and whatever note they typed. Plaid returns no useful category for those, so they file as "Other" and your spending picture has a hole in it.

What gets sent to the model is one line per payment, and this is the entire shape of it:

{ note: "🍜",  amount: -52.59 }

The note the payer typed, and an amount. Not your name, not the other person's name, not your account numbers, not your balances, not your other transactions. The model never sees the account any of it belongs to. The provider is Fireworks AI.

It isn't trusted with more than that on purpose: benchmarked in August 2026 over 2,795 real transactions, a model was no better than the bank at naming ordinary merchants, so it's confined to the rows the bank couldn't read.

This page used to say something different, and the change is worth recording. Until 2026-08-26 the payload was the whole merchant string, which for a peer-to-peer payment is the other person's display name followed by their note. A counterparty's first name was leaving with every categorised row. It was disclosed here, someone reasonably asked why it was happening at all, and the answer was that it shouldn't be: the model's instructions already say the note is the signal and to answer "none" for a bare name, so the name could never change an outcome. It is now stripped before anything leaves the server, along with the rows whose note is empty, which used to be sent for a guaranteed non-answer.

Where it is stored, and who can reach it

  • Encrypted in transit and at rest. All traffic is HTTPS/TLS 1.2+, and the iOS app enforces App Transport Security. Data lives in Convex, which is SOC 2 Type II and AWS-hosted.
  • Bank tokens never touch your phone. Plaid access tokens are stored server-side only.
  • One person can reach production, and that is me. No shared accounts, and multi-factor authentication on every system that can reach production or your data.
  • Production and development are separate deployments with separate credentials. Development only ever talks to Plaid's sandbox, and destructive developer tools are compiled out of release builds entirely.
  • Every query is scoped to you. Server-side authorization runs on every function; there is no path that returns another user's rows. The full backend test suite runs before anything deploys, and then again at every hour of the day and every day of the week.

What happens when you delete

In the app: Settings, then Delete account. It irreversibly purges your rows across every table and revokes the bank connection at Plaid, so the link stops existing rather than going unused. Unlinking a single bank does the same for that one. Nothing is archived, nothing kept in anonymised form.

If something goes wrong

Any suspected exposure of your data is treated as an incident: rotate credentials, revoke affected bank connections, and notify affected users, Plaid, and regulators as applicable within 72 hours of confirming it. Then a written review, and the fix folded into the policy.

What Ralphy does not have

Every page like this one lists strengths. Here is the other half, because a trust page that only flatters itself is not worth reading.

  • Ralphy is not SOC 2 certified. Convex, where the data lives, is SOC 2 Type II, and Plaid is SOC 2 Type II and ISO 27001. Ralphy itself has been through Plaid's production security review and signed their agreement, but it has not been independently audited as a company. Anyone implying otherwise with a badge is doing something you should be suspicious of.
  • It is one person. There is no security team. What there is instead is a small attack surface: three vendors, no advertising SDKs, no third-party trackers, no data sale, and no ability to move money.
  • It is early. Ralphy is in beta, and if that's too early to link a bank, that is a completely sensible call. The demo below needs no bank at all.
You shouldn't have to take my word for any of this. The strongest thing I can tell you is that you can watch Ralphy work without connecting anything: the demo runs a full morning on a sample household, in your browser, with no download, no account and no bank.

Stephen, building Ralphy 🦙

Try it with no bank →Read the Privacy Policy