Last updated 19 September 2026
Prowl handles the most private data you have. This page says plainly what it does with it, what it never does, and how your account is protected. Everything written in the present tense is true of the app today. Anything planned is described too, and always called planned.
Prowl gets your transactions in two ways, and neither brings your bank login here. You can upload statements, which are files you export yourself, with no bank connection at all. Or you can connect your bank through Plaid, a bank-connection service. You sign in to your bank inside Plaid's own window. Prowl never sees or stores your bank username or password. Either way, Prowl holds no bank logins. A linked bank leaves Prowl one encrypted access key. Switching the connection off deletes that key.
What a connection shares. It shares the same information a statement carries, which is transactions and balances. They go through the same rules as an uploaded file. You can switch the connection off at any time. Switching it off tells Plaid to end it too, not just Prowl. Uploading statements will always be there for anyone who would rather not link anything.
An uploaded PDF, CSV or spreadsheet is held in memory. It stays there only as long as it takes to read the transactions out. A file over 1 MB may pass through a temporary file while it uploads. That temporary file is gone as soon as the upload finishes. Prowl stores only the cleaned transactions, meaning their dates, descriptions, amounts, account names and currencies. Nothing else from the file is kept.
Both readings described here are part of how Prowl works. They are not features you switch on, so neither waits for you to decide. Each paragraph below states its limits, and they hold every time. These readings have a daily limit for each account, and one for Prowl as a whole. The import screen tells you when a limit is reached. Details that identify you are removed. The statement file itself never leaves. A reading is refused unless it adds up to the statement's own printed totals. A suggested category is never applied until you accept it.
Most statements are read entirely by Prowl itself. When a bank's layout is new, that statement's text is sent once to Anthropic's API to be read. Prowl learns the layout, so every later statement from that bank is read by Prowl itself, for free. Before the text leaves, details that identify the account holder are removed. Those are account and reference numbers, IBANs, email addresses, and the name and postal address printed at the top. The statement file itself is never sent. The reading is accepted only if the transactions add up to the totals the statement prints. The full detail is in the privacy policy, including the one thing that can't be removed.
After an import, Prowl suggests a readable name and a category for shops it hasn't met before. For example, "SQ *BLUE BOTTLE 0412" comes up as "Blue Bottle", with coffee as its category. To do that, Prowl sends the shop's description to Anthropic's API, with card numbers, account numbers and dates taken out. It also sends your own category names, so a guess can only land in a category you already made. It sends nothing else, and never an amount, a date, a balance, an account, or how often you shop somewhere. A description that names a person is not sent at all. Each shop is looked up about once ever, then remembered in your own account. A category suggestion is never applied on its own. It waits on screen, dimmed, until you accept it. The readable name is applied straight away. The bank's own wording is kept and shown beneath it, and one click brings it back.
There is no newsletter, no product email, no push notification and no digest. You cannot be subscribed to anything, because there is nothing to subscribe to. Every email Prowl sends is about your own account. One is your invitation, with the link that signs you up. One is the link you ask for when you have lost every device. One is a warning the moment a new device gains access. One tells you if your account is made free. One tells you before Prowl's terms or privacy policy change. One tells you before your free month ends. And once your free month or plan ends, one tells you before your data is deleted. The new-device warning has no links and no buttons on purpose. It tells you what to do, not where to click. So a fake copy of it has nothing to steal.
You open Prowl with a passkey. That's the same fingerprint, face or PIN that unlocks your own device. Nothing you could reuse or be tricked out of is stored here. Your device keeps the private half of the key and never hands it over. Prowl keeps only the public half, which can't sign in anywhere. This gives you two protections, and they are why Prowl chose passkeys. A break-in here leaks no way to sign in as anybody. And a convincing fake of this site can't collect a passkey. Your browser won't offer a passkey to a website it wasn't made for. So your browser checks the address for you, which no one can be expected to do by eye.
There is a cost, and it's worth saying. If you lose every device you have registered, the emailed link is the only way back in. That makes your email account the last key. Registering a second device, like a laptop as well as a phone, prevents that. Since that mailbox is the last key, protect it like one. Turn on the strongest sign-in protection your email provider offers. Prowl does its part by warning you the moment any new device is added.
The database can be wound back to any moment in the past three days. So a failure or a mistake costs minutes, not a day's work. A copy that is always kept up to date also goes to separate storage. It is encrypted before it leaves, so that storage holds only data it cannot read. That copy is kept for thirty days. For the first fourteen days, nothing can change or delete it, not even the keys Prowl uses to write it. So even someone who took control of Prowl could not destroy the backup. Deleted data is gone from the backups once those thirty days pass.
You can download every transaction as a spreadsheet, or take the full archive. The archive holds every transaction Prowl has, including the ones it keeps out of your totals. It also holds every preference you have set. It comes in files anything can open and nothing needs Prowl to read. The archive says in plain words what it leaves out and why. You can also delete your account and everything in it from inside Prowl, without asking anyone. Leaving should be as safe as joining.
If you find a security problem, email support@prowl.money and say what you found. You will get a reply, and credit if you want it.