Privacy policy

Mitten is a household-finance service that helps the members of a household track shared spending, budgets, and debt. In this policy, "Mitten," "we," and "us" refer to the operator of the Mitten service, who is the data controller for the personal data described here.

Mitten is operated from within the European Union and is subject to EU data protection law. The operator's full legal identification is provided, in writing and free of charge, in response to any lawful request, including from any authority or court entitled to it.

For anything about your data or this policy, contact us at support@mitten.money. That is the right first point of contact for access, correction, and deletion requests, and you can raise a complaint with your local data protection authority at any time.

Payments are handled by Paddle.com Market Ltd, which acts as our merchant of record. Paddle is the seller for every Mitten subscription: your purchase contract is with Paddle, its name and address appear on your receipt, and it is a separate data controller for the billing data it processes. See the section on billing below.

Your financial records are the most sensitive thing you trust us with, so we are specific about how they are handled.

• Automated processing only. Transactions, budgets, and debt records are processed by Mitten's backend services solely to provide the features you use: categorization, monthly aggregation, statement import, payoff planning. Processing is performed by software; results are shown only to signed-in members of your household, with one exception: a merchant category proven online, stored under a code only Mitten's servers can match to your household, as described under AI features below.
• No human review. Mitten personnel do not access household financial records in the ordinary course of business. Support and operations use a minimal data layer: your account email, a pseudonymous household identifier, and subscription status. To run the service, we can also see basic account and usage facts, such as plan and subscription price, signup date, how many people share the household, its country if the platform supplied one, the last day the app was opened, which setup steps were completed and when core features were first used, how many files were uploaded, and how you found us. This view never shows your name, email address or anything from your ledger. We can write to you from it without seeing your address: Mitten fills it in as the email is sent.
• No financial data in logs. Application logs, error reports, and analytics are engineered to exclude transaction descriptions, merchant names, amounts, and other personal financial details.
• AI features. Penny's features use two AI providers, Anthropic (Claude) and Google (Gemini). One of them handles a request, and if it does not return a usable answer (it is slow or busy, declines, or returns something we cannot use), the other takes over with the same request, so either provider, or both, may receive it. What is sent: transaction descriptions and amounts for categorization; statement text for statement import, with account, card and IBAN numbers masked first (when a statement's text cannot be read, the PDF file itself is sent instead, unmasked); and the figures behind Penny's insights, debt summary, weekly brief and month letter, such as monthly and category totals, budgets, top merchants and the largest purchase, debt account names and payoff months, and household members' display names with what each spent. A photo or a one-page PDF you hand Penny (a receipt, an invoice or a screenshot) is sent to the same providers, Anthropic first and Google if needed, so she can read it (an iPhone HEIC photo your browser cannot open goes to Google only). Before a photo leaves your device, the details your phone keeps inside it, such as where and when it was taken and which phone took it, are removed: Mitten saves a fresh copy of the picture, or, for an HEIC photo your browser cannot open, blanks those details out of the file, and Mitten's server checks and blanks that HEIC file again. A PDF leaves your device as it is: Mitten removes nothing from it. Mitten never stores the photo or the PDF, and only the transactions you confirm are kept. For a payment Penny is not sure about, its description, as your bank printed it, may be sent as a web search query, with the country of its currency and nothing else: never its amount, its date, or anything about you or your household. Money coming in is never looked up. Anthropic runs that search through a search provider it works with, and Gemini through Google Search. Descriptions we can recognize as payments between people (a transfer, a payment app, a named payer or payee) are never looked up. When Penny proves online what kind of shop a merchant is, that answer is kept for up to 180 days as a proven answer: only the category and how sure Penny was, under a code only Mitten's servers can match to your household, never your transactions, amounts, names or household. Once two households have proven the same category for the same merchant, it helps sort that merchant for other households without a new search; until then nobody else sees it. If you correct a category Penny found online, that answer is removed for everyone. When your household's data is deleted, or the household itself (which happens when its last member deletes their account), the household's part in these answers is removed too. These answers are kept per household, not per person, so one member deleting their account while others stay does not remove them. If a removal fails, Mitten retries it where it can; anything left expires within 180 days. Neither provider may use this content to train its models. Anthropic deletes it within 30 days, unless its automated systems flag it as breaking its usage policy (it may then keep it for up to 2 years) or the law requires keeping it. Google keeps it for a limited period to detect abuse, and keeps a web lookup, with what was sent and what came back, for 30 days, during which it may use it to debug and test its search features.
• Product analytics. If we measure feature usage in the app (screens opened, actions taken), events come from a fixed whitelist, carry no financial data or personal details, and are tied to a random identifier rather than your account. Those events may be processed by a product analytics provider hosted in the EU, and carry coarse context only: a country code, how many people share your household, whether the household is on a trial or a subscription, and how long the account has existed. So that each person is counted once, your account also keeps a few small markers: the last day you opened the app, which setup screens you have reached and when, the time you first saw your own month sorted and whether you were shown a sample month, the dates you first used core features (such as an import, a budget or a debt plan), whether you came back one, seven, thirty, sixty or ninety days after signing up, counts of uploads and category corrections, the last day you uploaded a file and the last day you corrected a category, which debt payoff strategy you picked, and the last day you opened Mitten from your home screen on each kind of device (an iPhone or iPad, an Android phone or tablet, or a computer; the day and the kind only), so we stop suggesting you add it where you already have. They hold no financial data and are deleted with your account. The event that records an app visit also says how many days passed since your previous one. One event records that a signup was started, and is sent before an account exists. Your account also keeps a short note of how you found us (see "How you found us" below), and two of these events carry the same values from the same fixed lists: the event that records a completed signup carries the channel, campaign and post, and the event that records your answer to "How did you hear about Mitten?" carries that answer. Like every event, they go to our product analytics provider and to our daily usage counts. We also record which bank a statement came from (read off the statement, or picked by you when an import fails), as one of a fixed list of banks and like the events above tied only to that random identifier, never to your name or email. The events about adding Mitten to your phone's home screen also say which kind of browser and device you used (for example Safari on an iPhone, or an app's built-in browser), again from a fixed list and never the full browser details. Before you sign in, that random identifier lives only in the open page unless you say yes on our cookie card (see "Cookies and how you found us" below). The marketing site's page-view measurement is described under Cloudflare below.
• Where we're going. We are working toward encrypting household financial data at rest, so it is unreadable outside an authenticated household session. Until then, data is protected by access controls, and the commitments above.

We keep the set of data deliberately small. Here is everything, where it lives, and the legal basis for processing it under the GDPR.

• Account identity. Your email address and an authentication identifier, used to sign you in and tie you to your household. Legal basis: performance of our contract with you.
• Household financial records.Transactions, budgets, envelopes, debt accounts, and the categories and rules you create, used to run the product for your household. Legal basis: performance of our contract with you.
• AI processing. Transaction text and statement content you ask Mitten to categorize or parse, and the figures behind Penny's insights, debt summary and weekly brief, sent to Anthropic (Claude) or Google (Gemini), or to both when the first does not return a usable answer. Legal basis: performance of our contract; our terms with both providers forbid them from using this content to train their models.
• Billing (Paddle). Your subscription status and the billing details you give Paddle at checkout. To save you typing, checkout opens with your sign-in email already filled in (only the email; you choose your billing country there yourself). Paddle is the merchant of record and the controller of your payment data. Mitten never receives your full card number; Paddle tells us only the card brand and its last four digits, which we print on your receipt email. We also keep the country of the billing address you enter at checkout (only the country, never the street, city or postcode), to know which regional price applies and to report revenue by region. Legal basis: performance of our contract and Paddle's legal obligations.
• Regional price checks. Our prices differ by country, so we check that a household's price fits where it is. When a household's admin opens checkout, we note the country the connection came from. It rides with the checkout in an encrypted code that only Mitten can read, so Paddle never sees it from us, and the code comes back to us when the household subscribes. We keep it only once the household subscribes. While the household pays, including while a failed payment is being retried, we also keep the country the app is opened from, one per day. That log holds at most the 30 days ending on the most recent day it recorded. Older days are dropped at the next recorded open. Both are deleted when the subscription ends, is paused or stops paying, and when the household is deleted. We keep only the country, never your IP address, region or city. We use it only to check that a regional price matches where the household is. It is never shown to other members and never shared with anyone. Legal basis: our legitimate interest in preventing misuse of regional prices.
• Transactional email. Your email address, used to send account and service messages such as trial and billing notices. Legal basis: performance of our contract.
• Penny's mid-month note. Once a month, in the middle of the month, we email each member of a subscribed household Penny's note on a recent week, the same words and figures as on your dashboard. It has no tracking pixel and no tracked links. Turn it off in one click from the link at the bottom of any note, or in Settings; that stops only this email. Legal basis: our legitimate interest in keeping you up to date with your own household's money, balanced by that easy opt-out.
• Emails from the Mitten team. Now and then one of us may write to you ourselves about your household or Mitten. Mitten fills in your name and address as it sends, so they never appear on the screen the email is written on. These emails have no tracking pixel and no tracked links, and every one carries a one-click link to stop them (or turn them off in Settings). If you reply, your reply goes to the team member who wrote it, so they then see your address. Once they are off, we write to you this way only about a service or legal matter on your account. We keep a record of each email the team sends you (the date, the subject and the text) for up to a year, and delete it when you delete your account. Legal basis: our legitimate interest in hearing how Mitten works for the people who use it, balanced by that easy opt-out.
• How you found us. Unlike the product events above, which use a random identifier, this short note is kept on your account (the signup and answer events carry the same values, as described above). It holds one word for the kind of place you came from (for example a search engine, an AI assistant, Instagram, LinkedIn, or a link someone sent you), the name of the campaign and post a link was tagged with when it was one of ours (from a fixed list), and your answer to "How did you hear about Mitten?" if you choose to give one (also from a fixed list, or that you skipped it). It never holds the address of the page you came from and never anything you typed. We look at it together with whether you imported a statement, started a trial and pay, to see which channels work. Before you say yes on our cookie card, nothing about this is written to your browser: the values travel only in the address of the page and in the open page, and are lost if you reload before signing up. If you say yes, we also copy the first and last of these visits from the cookie described in "Cookies and how you found us" below. Legal basis: our legitimate interest in knowing which channels bring people to Mitten. Retention: kept for the life of your account and deleted with it. You can object to this at any time (see "Your right to object" below).
• Analytics. Aggregate page-view measurement on the marketing site that sets no cookie (see Cloudflare below), and whitelisted, non-financial product events tied to a random identifier in the app. Legal basis: our legitimate interest in understanding and improving the product.

This section explains our cookie card: what a yes stores, and how to change your answer.

• With your yes (our cookie card). When you first visit mitten.money or the app's sign-in pages, a small card asks whether we may remember which post brought you here. If you say "That's fine", we set one cookie that holds the first post or link that brought you (kept for the cookie's whole life) and the most recent one (replaced on each newer arrival): each as the kind of place, the campaign and post from our fixed lists, and the day. Nothing else: no IP address, no browser details, no identifier. It lasts 30 days from your first visit and later visits do not extend it. Only our own servers can read it, it works across mitten.money and app.mitten.money, and it is never shared with anyone. If you sign up while it exists, we copy those two visits onto your account's "how you found us" note, once. A yes also lets the site keep the same values in session storage for the rest of your visit, and lets the app keep the random identifier for product events in local storage, so a returning visit counts as the same visitor before you sign in.
• Remembering your answer. A second small cookie remembers what you chose for six months, on both mitten.money and app.mitten.money, so the card does not ask again. It holds only that answer. It is needed to respect your choice, so we set it whichever way you answer.
• If you say no, or change your mind. Saying "No thanks" changes nothing about how Mitten works. You can change your answer at any time from "Cookie settings" at the bottom of every page on mitten.money, or in the app under Settings, Privacy. Choosing no deletes the 30-day cookie and the session and local storage values above from that browser; only the cookie that remembers your no stays. Visits already copied onto an account stay there; to have them removed, use your right to object below.
• If JavaScript is off. The card does not appear and nothing is stored, which we treat as a no.
• The app's own files. Separately from the card, your browser keeps a copy of the app's program files and pictures for app.mitten.money, so it does not download them again on every visit and can show a "No connection" page when you are offline. It also keeps the date you added Mitten to your home screen or put away our suggestion to, so we do not ask again. None of this is about your money or who you are, none of it is sent to us, and the app needs it to work as you asked, so it does not wait for a yes.
• Unfinished setup. If you stop partway through setting up, your answers so far (such as your partner's first name and your spending guess) stay in this browser, so you can pick up where you left off. They stay for up to 7 days after your last answer, or until you sign out, and are deleted once your household is set up. They are not sent to us before then.
• Links we post. Separately from the card, the links in our posts carry the same campaign tags for everyone who clicks them, and we count clicks on our short links (mitten.money/go/...) as daily totals only, with no cookie and no identifier. See "How you found us" above.

Your right to object. You can object at any time to our use of the "how you found us" note on your account. Email support@mitten.money from the address on your account and we will delete that note and stop recording it for you. This does not affect anything else in your account.

Legal basis: your consent for the 30-day cookie and the storage that comes with a yes (withdraw it as described above, as easily as you gave it); our legitimate interest in knowing which channels bring people to Mitten for the campaign tags and the note on your account; and the cookie that remembers your answer is strictly necessary to honour it.

Mitten is a small service built on a small number of providers. These are all of them, what each one touches, and where it processes it.

• Google (Firebase and Google Cloud). Hosting, authentication, the database that holds your household records, and the account emails Firebase sends. Processed in the United States.
• Anthropic, PBC (Claude API). One of our two AI providers, with Google's Gemini below, behind categorization, statement import and Penny's written summaries. Whenever it handles a request it receives the content described under AI features above. It may not use it to train its models, and deletes it within 30 days unless its automated systems flag it as breaking its usage policy (up to 2 years) or the law requires keeping it. Web lookups run through a search provider it works with. Stores data in the United States; the model itself may run in other regions.
• Google (Gemini API). Our other AI provider, behind the same features. Whenever it handles a request it receives the content described under AI features above, under terms that forbid using it to train or improve models. It keeps requests for a limited period to detect abuse, and web lookups for 30 days, during which it may use them to debug and test its search features. Processed on Google's infrastructure.
• Paddle.com Market Ltd. Our merchant of record, and a separate data controller rather than our processor: your checkout and billing details are its own to handle. Based in the United Kingdom.
• Resend, Inc. Sends our account emails, Penny's mid-month note and emails from the Mitten team. A United States company; our mail goes out from its EU sending region. It receives your email address and each message as written, and some messages carry figures from your household: the trial-ending email's spending summary (what you tracked so far this month, and your debt-free month when you have a plan), the receipt's card brand and last four digits, and the mid-month note's figures and the merchant, category and member names Penny mentions. Never your statements or your full card number.
• Zoho. Hosts the support@mitten.money inbox, in its EU data centre, so it holds whatever you choose to write to us.
• PostHog Inc. Our product analytics provider, on its EU cloud. It receives the whitelisted usage events described above, tied to a random identifier rather than your account, and never your financial records. Processed in the European Union.
• Cloudflare, Inc. Our processor for page-view measurement on our marketing website only, never inside the app. A small script on each page reads the page address, the address of the page that linked to it and basic page-load details and sends them to Cloudflare, which also receives your IP address and browser user agent. It sets no cookie and stores no identifier on your device, and we see the results only as aggregate totals. Processed in the United States.

Transfers outside the EEA. Where a provider processes data outside the European Economic Area, the transfer rests on an adequacy decision where one applies (the EU-U.S. Data Privacy Framework for our United States providers certified under it, and the United Kingdom adequacy decision for Paddle), and otherwise on the European Commission's standard contractual clauses, which form part of our agreement with each provider.

If we add or replace a provider on this list, we will update this section and the "last updated" date above.

We keep your household's data for as long as your account is active so the product has a history to work with. If you delete your account, we remove your household's financial records from our active systems, and backups age out on a rolling schedule after that. When your household is deleted, its part in proven merchant answers (see AI features above) is removed too; what other households proved stays until it expires.

Billing records that Paddle is legally required to retain (for tax and accounting) are kept by Paddle for the period the law requires, independently of Mitten.

Under the GDPR you have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to certain processing, and to receive a copy in a portable format. You also have the right to lodge a complaint with your local data protection authority.

To exercise any of these, email support@mitten.money. We will respond within the time the law allows. You can also delete your household and its data directly from the app's account settings, which triggers our deletion path.

If we change how we handle your data, we will update this page and the "last updated" date above. For material changes we will also let you know by email or in the app before they take effect.