Privacy Policy

Last updated 27 July 2026

Prowl is a personal budgeting tool that helps you import bank and card statements and see where your money goes. This policy explains what we collect, how we use it, and the choices you have. It covers the hosted app at prowl.money.

What we collect

• Your account: your email address, and the public half of the passkey each of your devices registered. There is no password — nothing we store can be used to sign in as you.
• Financial data you import: the transactions extracted from statements you upload — dates, descriptions, amounts, account names and currencies — plus the categories, tags, budgets and renames you create on top of them.
• Technical basics: one essential cookie that keeps you signed in, and standard server logs (timestamps, the page requested, IP address) used only to keep the service secure and to fix problems.

What we do not do

• We never store your raw statement files. Uploaded PDFs, CSVs and spreadsheets are read in memory to pull out the transactions, then discarded — the original files are never written to our disk.
• We never ask for or store your bank login details — you provide statements yourself.
• We do not sell or share your data, and there is no advertising or third-party tracking/analytics.
• We never send marketing email. No newsletter, no product updates, no "we miss you". You cannot be subscribed to anything, because there is nothing to subscribe to. The only email Prowl will ever send you is your invite, a link you asked for to set up a new device, or a warning that a new device was added to your account.

Reading a statement from a bank we've never seen

Prowl reads most statements entirely on its own. When a statement comes from a bank in a format Prowl doesn't recognise yet, it sends that statement's text to Anthropic's API to be read once, and learns the layout so every future statement from that bank is read by Prowl itself — offline and free. This happens roughly once per bank, not once per statement.

• We remove what identifies you before sending. Account and reference numbers, IBANs, email addresses, and the name and postal address printed at the top of the statement are all stripped out of the text first.
• What is sent: the bank's own name, and the dates, amounts and merchant descriptions as printed — the things that describe the layout being learned. If a person's name appears inside a transaction's own description (for example "Transfer from J Smith"), it travels with that description, because it cannot be told apart from an ordinary merchant name.
• What is not sent: the statement file itself, anything from your other statements, and anything from your Prowl account.
• Anthropic processes the text to return the reading; under their commercial API terms this content is not used to train their models.

Suggesting a shop's real name

After an import, Prowl suggests a readable name and a category for the shops it hasn't met — "SQ *BLUE BOTTLE 0412" comes up as "Blue Bottle", already filed under coffee. To do this it sends the shop's description as printed, and nothing else, to Anthropic's API: never an amount, a date, a balance, an account, or how often you shop somewhere. Each shop is looked up roughly once ever and the answer is remembered in your own account, so it isn't asked about again. Suggestions are shown to you, dimmed, and applied only when you accept them. We disclose this deliberately: a list of the shops a person uses is personal even with no amounts attached.

How we use your data

Only to provide the app to you: importing and cleaning statements, categorizing spending, and showing you reports. That's it.

Where it's stored and who processes it

• Hosting & storage: the app and your data run on Render's infrastructure (United States). Each account's data is kept in its own isolated area.
• Email: we use Resend to send transactional email (only your invite, the link that sets up a new device, and security alerts). Only your email address and that message are shared with Resend.
• Reading unknown statement formats and suggesting shop names: Anthropic, both as described above.
• Currency conversion: to convert amounts into your home currency, the app queries public exchange-rate services with currency codes only — never your personal or transaction data.

Security

Prowl is opened with a passkey rather than a password: your device keeps the private key and Prowl stores only the public one, so there is no shared secret here to leak and nothing a fake site could collect from you. The site is served over HTTPS, session cookies are HttpOnly, and each account's data is isolated from others. No system is perfectly secure, but we take reasonable measures to protect your information. More detail is on the security page.

Keeping and deleting your data

We keep your data until you delete it. You can export it (Excel), edit or remove individual items, or delete your entire account and everything in it — at any time, from inside Prowl, without asking us. Server backups are retained for up to 7 days, after which deleted data is also gone from backups.

What's planned — nothing here is live yet

Prowl is honest about the future as well as the present. These features are being built and will touch data when they arrive. None is live today, and this policy will be updated — with the date at the top changed — before any of them handles anyone's data.

• Bank linking through Plaid. An optional way to import transactions without uploading statements. You would sign in at your bank inside Plaid's own window — Prowl never sees or stores your bank username or password. Prowl would receive the same information a statement carries (transactions, balances, account names), and the connection would be yours to switch off at any time. Statement upload stays for anyone who prefers not to link a bank.
• Payments through Stripe. Prowl will become a paid subscription when it opens publicly. Your card details would go directly to Stripe, the payment processor, and would never be seen or stored by Prowl.
• Visit counting. Prowl may add privacy-respecting analytics that count visits in aggregate — no cookies, no profiles, no following you across the web. It will never add advertising trackers.

Children

Prowl isn't intended for anyone under 16, and we don't knowingly collect their data.

Changes

We may update this policy; when we do, we'll change the date at the top.

Contact

Questions about your privacy? Email support@prowl.money.