We never see a cent of it.
Most privacy policies are long because the company has a lot to account for. This one is short for the opposite reason, and it still names everything.
Last updated 19 October 2026
The short version. Stuffed has no account and no login, and there is no server holding your budget. Your envelopes, pay, goals, debts, net worth and spending live on your phone. Your budget is never sent anywhere. The app sends two things: anonymous usage counts, with no money, names or anything you type, which you can turn off; and a record of your purchases, so your plan works and we can see how plans are doing. Neither identifies you, neither is used for advertising, and nothing is sold.
What we don't collect
The app does not send us your name, email address, phone number, address, bank login, account numbers, balances, or anything you record in it. None of that is ever sent anywhere. (If you email us, we see your email address and what you write. See Feedback.)
Stuffed contains no advertising and no advertising code, never asks to track you, and does nothing that tracks you across other apps or websites. Everything it shows you, like what's left to spend, how fast you're spending and how a goal is tracking, is worked out on your phone from data that stays there.
Anonymous usage counts
From version 1.2, Stuffed sends a small number of anonymous usage counts, so we can see where the app is hard to use. They are counts of moments like these: opening the app (once a day), reaching each step of setup, finishing setup, seeing the plan screen, starting a trial or buying a plan, a purchase that was cancelled or didn't go through, logging a first spend, and finishing a payday.
Each count carries only the name of the moment, the app version and build, the iOS version, the region set on your phone, whether the app came from the App Store or TestFlight, and a random ID made on your phone. A few carry one small detail more: how many days since you first opened the app, which plan was chosen, or, at the end of setup, how many bills and goals you added and whether you put money in. That ID isn't linked to you, your Apple Account, your device or anything else. A count never carries an amount, a name, an envelope, or anything you type.
The counts go to PostHog, an analytics service, and are stored in the EU. PostHog is set to discard IP addresses, to skip working out a location from them, and to keep no profile of anyone. The counts are never used for advertising and never sold.
Turn them off any time in Settings, Your data, Share anonymous usage. If you set Stuffed up before version 1.2, they start off, and stay off unless you turn them on.
What stays on your device
Everything you enter is stored on your phone, in the app's own storage, shared only with the Stuffed widget:
- Your envelopes, their plans and balances, and your spends and notes
- Your pay, your paydays and your settings
- Your savings goals, your debts, and the things you list in your net worth
On iPhone, that data is part of your normal backups (iCloud Backup, or a backup to a Mac or PC), which belong to your Apple Account. On Android, it is part of Android's own backup to your Google Account, if you have backup turned on. Either way, the backup is yours and we have no access to it. Deleting the app deletes the data with it.
Stuffed does not connect to your bank. You type your balances and spends yourself, so there are no bank credentials to hold and no feed to intercept.
Purchases
Stuffed is sold through the App Store on iPhone and Google Play on Android, as a monthly or yearly subscription or a one-time purchase. The store takes the payment and tells the app one thing: whether you have a plan. We never see your name, your card or your billing address. If you've turned on notifications, the reminder before a trial ends is set on your phone, not sent from anywhere.
On iPhone, Stuffed uses RevenueCat to keep a record of purchases, so we can see how plans are doing. Your plan itself is checked with Apple, not RevenueCat. When you buy or restore a plan, the app passes RevenueCat the App Store's record of it, and Apple tells RevenueCat when a plan renews, is cancelled or is refunded. That record holds which plan, its price and currency, the App Store country, its dates, and whether it began with a free trial, filed under a random ID made by the app. It doesn't include your name, email, card or anything from your budget.
Like any service on the internet, RevenueCat sees the IP address your phone connects from when the app talks to it. The purchase record isn't used for advertising, isn't used to track you, and is never sold.
Saying a spend
If you use Say it to add a spend by voice, Stuffed uses the microphone only while you hold the button, and your phone's own speech recognition turns your words into a spend on the device. The recording isn't kept and is never sent to us. On Android phones that can't recognise speech on the device, Say it isn't offered.
Feedback
Send feedback, in Settings, opens an email for you to write and send yourself. The app adds only its version, your phone model and your iOS version, and you can see all of it before you send. We use your email only to reply and to fix what you tell us about.
Crashes and diagnostics
Stuffed does not send crash reports or diagnostics to us or to anyone on our behalf.
Separately, if you have turned on Share iPhone Analytics in iOS Settings, Apple may share anonymous crash and performance data with developers. That data is Apple's, it identifies no one, and it holds none of your financial information. You can turn it off in Settings, Privacy & Security, Analytics & Improvements.
On Android, if you have allowed your phone to share usage and diagnostics with Google, Google Play may share anonymous crash and performance data with developers in the same way. It holds none of your financial information either, and you can turn it off in your phone's Google settings.
Who handles it
Three services handle data for Stuffed, each only for the job described above: PostHog (anonymous usage counts, stored in the EU), RevenueCat (the record of purchases on iPhone), and Apple (payments on the App Store; on Android, Google does the same through Google Play). None of them receives your budget.
How long it's kept
Usage counts and purchase records are kept only as long as we need them to run Stuffed and make it better, and we'll delete them if you ask. Your budget is kept on your phone for as long as you keep it there.
Children
Stuffed is not directed at children under 13. It doesn't ask anyone, including children, for information that identifies them. The only things it sends are the anonymous usage counts and purchase records described above.
Your rights
Under the Privacy Act 1988 and the Australian Privacy Principles, under the CCPA and CPRA in California, and under the GDPR in the EU and UK, you can ask what personal information a business holds about you, and ask for it to be corrected or deleted.
We don't collect information that identifies you. Your budget is on your device, where you can read it and change it, export it to a spreadsheet, or erase it all from Settings, Start over. The usage counts and purchase records our services hold are filed under random IDs made by the app, not your name, so we can't look them up by who you are. You can stop the usage counts at any time in Settings, and if you'd like either deleted, write to [email protected] and we'll help you find and remove them. We have never sold personal information or shared it for advertising.
Changes
If this policy changes in a way that matters, the app will tell you, not just this page. The date above is always the current version.
Contact
Questions about privacy: [email protected]. A person reads it.