Last updated: July 3, 2026
We don't sell your data. Basin is local-first by default: your budget data is stored on your device first, and optional services like bank sync or platform subscriptions only come into play when you enable them.
Basin stores your budget data locally on your device. On the web, local browser storage should be treated like other browser data on that device. Device-level app protection still depends on your phone or browser's own security settings.
If you choose to link your bank account, Basin uses Plaid for account authentication and to retrieve your transactions and balances. Basin does not receive or store your bank login credentials — those are entered directly with Plaid. Basin's own servers store the resulting linked transactions and an encrypted copy of the Plaid access token (the credential used to keep your account in sync) so that your daily budget stays up to date. Bank linking is optional, and disconnecting it in Settings removes the stored access token.
Basin does not use ad trackers or session replay. A bounded on-device activation log stores event names and times only; financial amounts, merchants, balances, and transaction descriptions are stripped and the log is not uploaded by the app.
Basin is designed to work locally first. When you connect a bank, the transactions and access token needed to sync are stored on Basin's servers, which run on managed infrastructure with encryption at rest and encrypted backups. Data is scoped to your own account and is not shared with other users.
Services like Plaid, RevenueCat, Apple, and email providers may process the narrow slice of data needed for their feature to work. They are not meant to become a general-purpose source of your full financial history.
If you enable Face ID or Touch ID, Basin asks the operating system to verify it's you before unlocking the app. Biometric data itself never leaves your device and Basin never sees or stores it.
Daily reminders are scheduled locally on your device by the operating system. Basin does not send remote push notifications in the current beta, so the reminder content is not transmitted off-device.
If you ask for launch updates on our marketing site, we store your email with our email provider so we can let you know when Basin is available. You can unsubscribe at any time and ask us to remove your address.
Deleting the app clears locally stored app data on that device. If you've linked a bank account, disconnecting it in Settings removes the associated transactions and access token from Basin's own servers. Data held by external providers for optional services, such as subscriptions or bank-link infrastructure, follows that provider's retention and deletion process. You can also email us to request deletion of any data held on our servers.