A budgeting app promises to show where your money goes without the spreadsheet. Most of them do that by connecting to your bank and card accounts and pulling in every transaction automatically. That convenience is the reason to use one, and it is also the part worth understanding before you sign up: who is in the middle of that connection, what they can see, and how to switch it off. This guide explains how the connection works, what to check on security and privacy, and the two broad approaches to budgeting the apps are built around. It is a guide to the tools, not financial advice; for decisions about debt, savings or investments, speak to a qualified professional.

How a budgeting app connects to your bank

Very few budgeting apps connect to thousands of banks themselves. Most use a data aggregator: a company that sits between banks and apps, maintains the connections, and passes your transaction data to the app you chose. Plaid is one of the best known. When you tap "link account" in an app, the login screen that appears often belongs to the aggregator, not the app.

Plaid describes the process in its own words. When you connect an account, "you will be prompted to enter the username and password associated with those accounts," and Plaid then links the account to the app. It says it does not share your bank username and password with the app, and that once you give permission it transfers your data "from your financial institution to the app through our application programming interface (API)."

There are two broad ways the data can travel from the bank:

You do not always get to choose which method is used, since it depends on the bank and the aggregator. But it is worth knowing which one you are dealing with. If the app asks you to type your bank password into a screen that is not your bank's own, a third party is holding it.

What the app can and cannot do

Budgeting apps generally ask for read-only access: they can see balances and transactions but cannot move money. Monarch Money, for example, states on its security page that "we have read-only permissions and can't access your money, ever." Read-only access limits what can go wrong, but it is still a detailed record of where you shop, what you earn and who you pay, so privacy matters as much as security.

Apps that also offer bill negotiation, savings transfers or cancellation services need wider permissions. If an app wants more than read-only access, make sure you understand why.

Security and privacy: what to check

Before linking an account, look for clear answers to these questions on the app's own security and privacy pages:

  • Two-factor authentication. Your budgeting app now holds a map of your financial life. It should support two-factor sign-in, and you should turn it on. Monarch lists two-factor authentication, one-time passcodes on unrecognised devices and password breach warnings among its protections.
  • Encryption. Data should be encrypted in transit and at rest. Plaid says it uses AES-256 encryption and TLS, plus security audits by researchers and financial institutions.
  • Independent audits. A SOC 2 report means an outside auditor has checked the company's security controls. Several apps publish that they hold one.
  • How the business makes money. An app funded by subscriptions has less reason to monetise your data than one that is free and ad-supported. Read the privacy policy for whether data is sold, shared with advertisers or used to target offers.
  • How to leave. You should be able to disconnect accounts and delete your data. Plaid says it provides tools to "delete your data from our systems as well as connect, manage and disconnect your fintech apps."

When you stop using an app, do three things: delete the account in the app, revoke the connection in your bank's settings if it appears there, and remove the connection on the aggregator's own consumer portal if it offers one. Deleting the app from your phone does none of these.

The rules on financial data sharing

In the United States, the rules governing this kind of data sharing are unsettled. The CFPB finalised a Personal Financial Data Rights rule requiring banks, credit unions and other providers to make consumers' data available on request to consumers and authorised third parties "in a secure and reliable manner." The CFPB said the rule would limit third parties to using data for the purpose the consumer asked for, end access immediately when a consumer revokes it, make deletion the default, require reauthorisation at least once a year, and keep the process to revoke access "simple and straightforward" to prevent "dark patterns". It also said the rule would help move the industry away from screen scraping.

That rule is not being enforced. According to the law firm Ballard Spahr's Consumer Finance Monitor, a federal court in Kentucky enjoined the CFPB from enforcing it, an appeal is on hold while the bureau revises the rule, and the bureau has asked for comment on questions including whether banks may charge fees for data access. Until that is resolved, protections depend largely on each app's and aggregator's own policies and on general privacy and consumer protection law, which is one more reason to read them.

Two ways to budget: planning ahead or tracking

Once the data is flowing, apps differ most in what they ask you to do with it. There are two broad approaches, and most apps lean towards one.

Zero-based budgeting

In a zero-based budget, every dollar of income is assigned to a purpose before you spend it, until there is nothing left unassigned. Bills, groceries, savings goals and fun money all get a share in advance. When you overspend in one category, you move money from another, so the plan always adds up.

YNAB is the best-known app built this way. Its method asks you to "decide what you need your money to do before you get paid again," to anticipate irregular costs such as car repairs and holidays by setting aside "manageable monthly amounts," and eventually to get a month ahead on bills. The approach is hands-on: it works best for people who will open the app several times a week and adjust as they go. People who like it tend to say it changes how they think about money; people who drop it usually say it takes more time than they expected.

Tracking-first budgeting

Tracking apps start from the other end. They pull in your transactions, sort them into categories automatically, and show you where the money went, often against limits you set for each category. You spend first and review afterwards. This needs less effort day to day and suits people who mainly want visibility, or who want a picture of their whole financial position including investments and net worth.

The trade-off is that seeing a problem after the fact is not the same as planning around it. Automatic categorisation also makes mistakes, so expect to correct some transactions, especially transfers between your own accounts and payments to people.

Hybrids and simpler options

Many apps now offer both: automatic tracking with an optional plan-ahead mode, or a simple "safe to spend" figure that subtracts upcoming bills and savings from your balance. If you share finances, check whether the app supports a shared household and how it handles accounts only one partner owns.

When a free option is enough

A paid app is not the only way to budget. A spreadsheet or a notebook, updated weekly from your bank statements, does the same job for free and shares your data with no one. Many banks now show spending categories in their own apps. Some budgeting apps let you enter transactions by hand without linking any accounts at all, which avoids the aggregator entirely at the cost of more typing.

A paid app earns its subscription when the automation saves you real time, when you have many accounts to pull together, or when its method helps you stick to a plan you would otherwise abandon. Most offer a free trial; use it to test whether all your banks connect reliably before you pay.

A short checklist before you link an account

  1. Find out which aggregator the app uses and whether you sign in on your bank's own page.
  2. Confirm the access is read-only, unless you want features that move money.
  3. Turn on two-factor authentication in the app.
  4. Read how the app makes money and whether it shares or sells data.
  5. Know how to disconnect and delete your data, at the app, the aggregator and the bank.
  6. Pick the approach that matches how much time you will really spend: planning ahead, tracking, or a mix.