Data retention
How long we keep your data — and how we get rid of it
Plain and specific: we keep the least amount of data for the shortest time that still lets the app work, and you can delete or export your data whenever you like.
Last updated · 23 July 2026
- Your bills are encrypted with a key only you hold, so our copy is a locked box we can't open. Once you delete it, it's gone for good.
- We keep your name and email only while your account is open.
- You can delete or export your data at any time, and close your account whenever you want.
- We review this policy at least once a year.
What we keep, and for how long
- Your bills (encrypted). Kept until you delete them or close your account. Because they're scrambled with a key we never have, our copy is unreadable to us the whole time — and unrecoverable once deleted.
- Your account details (name, email). Kept while your account is open, and removed when you close it.
- Payment details. Handled by Stripe. We keep only what we need to know your subscription is active — never your card number — and remove it when you close your account.
- Bank connection. Kept only while you stay connected. Disconnect and Shugo revokes the connection with Plaid — no more data is pulled, and the bank data on your device is removed. Plaid keeps its own records under its policy; use Plaid Portal to see or delete what they hold.
- Backups. Our database provider keeps short-lived backups for a rolling recovery window and then overwrites them. Any backup you turn on in your own Google Drive, or a file you export, is yours to delete whenever you like.
- Basic technical logs (like IP address and browser type). Kept for a short period for security and reliability, then automatically rotated out.
How we dispose of your data
When data is no longer needed, we delete it from our systems. For your bills, there's an extra layer: because they're encrypted with a key we never hold, our stored copy is unreadable to us at all times, and deleting it removes it for good. We run no data centres of our own — our hosting and database providers handle the physical destruction of storage media under their own audited controls.
Your choices
- Download your data — a readable copy (your bills, income, and savings goals), or an encrypted backup file, from Settings at any time.
- Delete your account whenever you want — from Settings → Delete my account. It erases your data on this device, removes the encrypted copy on our servers and the backup in your Google Drive, and cancels your subscription, right away. Prefer we do it for you? Email privacy@shugo.online.
- Disconnect a bank at any time to stop any further data being pulled.
Staying compliant
This approach is built to line up with data-protection rules including the GDPR, the CCPA/CPRA in California, and the GLBA. We review it at least once a year, and whenever something material changes about the data we hold or how long we keep it.
Questions
Email privacy@shugo.online and a person will answer, usually the same or next business day. See also our privacy policy and security page.