What Ralphy does with your data

• Sign in with AppleRalphy holds no passwords
• PlaidYour bank login never reaches us
• SOC 2 Type II infrastructureConvex, encrypted at rest
• Read-onlyNo transfer permission exists

Four things Ralphy cannot do

Not "does not". Cannot. These are properties of how it is built, and the first one is the one that matters most: the connection Ralphy holds is read-only, so there is no transfer permission on it to misuse, by us or by anyone who took it from us.

• Move your money. Read-only end to end. Ralphy holds no payment or transfer permissions of any kind, and the spend limit is advice: it never sits between you and your card.
• See your bank password. You sign in at your bank, inside Plaid. Credentials never touch our systems, so there is nothing on our side to leak.
• Sell your data. The subscription is the only way Ralphy makes money. No ads, no data sale, no affiliate kickbacks.
• Keep what you delete. Deleting your account purges your rows and revokes the bank connection at Plaid. More on that below.

How the bank connection actually works

Ralphy uses Plaid, the same connection layer used by a large part of the US fintech industry. You type your bank credentials into Plaid, never into Ralphy. What Ralphy receives back is a read-only token.

You sign in to Ralphy itself with Sign in with Apple, which means Ralphy holds no password of yours either. There is no Ralphy password to be stolen, reused, or leaked, because one was never created.

What actually leaves your bank

The honest answer, and the one worth stating plainly: Ralphy does receive your financial data. It has to. The number is made of it. Anyone telling you their budgeting app does not see your transactions is either wrong or not doing arithmetic. What is true is that it is narrow, and it is listed here:

• Accounts and balances for the accounts you choose to link.
• Transactions: date, amount, merchant and the category your bank's data provider assigned.
• Card terms, if you link a credit card: its APR, minimum payment and due date. This is the Plaid "Liabilities" product, and it is what lets Ralphy tell you what a card will actually cost rather than guessing.

And what never arrives at all: your bank username or password, your full card numbers, and any government identifier. Ralphy asks your bank for nothing else.

What the AI sees, exactly

This is the question we get asked most, so here is the precise answer rather than a comfortable one.

Your categories come from your bank's data provider, not from a model. A model is used in exactly one place: peer-to-peer payments, the Venmo-style rows where the merchant field is not a shop but a person's name and whatever note they typed. Plaid returns no useful category for those, so without help they file as "Other" and your spending picture has a hole in it.

When that happens, what gets sent to the model is one line per payment, and this is the entire shape of it:

{ note: "🍜",  amount: -52.59 }

The note the payer typed, and an amount. Not your name, not the other person's name, not your account numbers, not your balances, not your other transactions. The model is never given the account any of it belongs to, so the text arrives with nothing to attach it to. The provider is Fireworks AI.

It is not trusted with more than that on purpose: benchmarked over 2,795 real transactions, a model was no better than the bank at naming ordinary merchants, so it is confined to the rows the bank could not read.

Where it is stored, and who can reach it

• Encrypted in transit and at rest. All traffic is HTTPS/TLS 1.2+, and the iOS app enforces App Transport Security. Data lives in Convex, which is SOC 2 Type II and AWS-hosted, and encrypts at rest.
• Bank tokens never touch your phone. Plaid access tokens are stored server-side only.
• One person can reach production, and that is me. There are no shared accounts. Multi-factor authentication is required on every system that can reach production or your data.
• Production and development are separate deployments with separate credentials. Development only ever talks to Plaid's sandbox, never to a real bank. Destructive developer tools are compiled out of release builds entirely.
• Every query is scoped to you. Server-side authorization runs on every function; there is no path that returns another user's rows. Roughly 2,280 backend tests run before anything deploys.

What happens when you delete

In the app: Settings, then Delete account. It irreversibly purges your rows across every table and revokes the bank connection at Plaid, so the link itself stops existing rather than simply going unused. Unlinking a single bank does the same for that one. Nothing is archived, and nothing is kept in anonymised form.

If something goes wrong

Any suspected exposure of your data is treated as an incident: contain it by rotating credentials and revoking affected bank connections, then notify affected users, Plaid, and regulators as applicable within 72 hours of confirming it. Then a written review, and the fix folded into the policy.

What Ralphy does not have

Every page like this one lists strengths. Here is the other half, because a trust page that only flatters itself is not worth reading.

• Ralphy is not SOC 2 certified. Convex, where the data lives, is SOC 2 Type II, and Plaid is SOC 2 Type II and ISO 27001. Ralphy itself has been through Plaid's production security review and signed their agreement, but it has not been independently audited as a company. Anyone implying otherwise with a badge is doing something you should be suspicious of.
• It is one person. There is no security team. What there is instead is a small attack surface: three vendors, no advertising SDKs, no third-party trackers, no data sale, and no ability to move money.
• It is early. Ralphy is in beta. If that is too early for you to link a bank, that is a completely sensible call, and the demo below needs no bank at all.

Stephen, building Ralphy 🦙

Try it with no bank →Read the Privacy Policy