Here's exactly what Mitten can and can't see. No fine print required to understand it.
Mitten never asks for your online banking username or password, and never connects to your bank account directly. You upload a statement (PDF or CSV) when you choose to, and that's the only information Mitten ever sees.
That file is one you export yourself, for the accounts you choose, for the months you choose. Nothing arrives that you did not send.
One person told us they nearly reported a real purchase as fraud because the charge showed up under a name they didn't recognize. That's exactly the problem Penny solves: she reads each line of your statement and turns cryptic entries into something readable, checking with you first whenever she's not sure, instead of guessing silently.
Account, card and IBAN numbers are masked before that text is sent to one of our two AI providers, Anthropic (Claude) and Google (Gemini). If the first does not return a usable answer, the other gets the same text, so either or both may receive it. If a statement's text cannot be read, the PDF file itself is sent instead, unmasked. Neither provider may use it to train its models. Anthropic deletes it within 30 days, unless its automated systems flag it as breaking its usage policy (it may then keep it for up to 2 years) or the law requires keeping it; Google keeps it for a limited period to detect abuse.
Anyone in the household can edit or delete a row she filed, and a correction teaches her how your household sorts things.
Traffic between your browser and Mitten travels over an encrypted connection, and the databases and file storage behind it encrypt what they hold on disk. In the app, household records are visible only to members of that household; the server checks membership on every request.
We are also working toward encrypting household financial records so they are unreadable outside an authenticated household session. That work is not finished, and the privacy policy says so in the same words.
Application logs, error reports, and analytics are built to exclude transaction descriptions, merchant names, and amounts. Product analytics events may be processed by a provider hosted in the EU, and carry a coarse country code and how many people share your household. Mitten personnel do not read household financial records in the ordinary course of business. You can delete your uploaded statements and your account at any time; deleting your account takes those records out of the active systems, with backups ageing out on a rolling schedule afterwards.
This page is the plain language version. For the full legal terms, see our privacy policy and terms of service.
The policy sets out every category of data, why it is processed, the legal basis under the GDPR, how long it is kept, and how to get access to it, correct it, or have it deleted.
Questions? Email support@mitten.money. We're happy to answer anything this page didn't cover.
