Reports Open the App

Privacy Policy

Last updated: July 31, 2026

Moneylight Reports for YNAB is a free reporting tool for YNAB users, operated by Sage Canyon Labs LLC ("we," "us," or "our"). It runs entirely in your browser. There is no account to create and no server of ours for your plan data to sit on. Our host counts page views so we know whether anyone is using the tool, and we collect nothing else about you. This policy explains what the app accesses, where that data is stored, how long it is kept, and how you can delete it.

The short version

Your plan data never leaves your device. Your browser asks YNAB for your plan directly, does the math locally, and caches the result in your own browser's storage. We never receive it, and we could not read it if we wanted to.

What the app accesses, and why

When you click "Connect to YNAB," you are sent to YNAB's own consent screen. If you approve, YNAB hands your browser a read-only access token. We never see, ask for, or store your YNAB password or your bank login credentials.

Your browser then calls the YNAB API directly and downloads the plan you choose. The app keeps only the information needed to generate its reports: your plan's name and identifier, category names and groups, month-by-month spending totals for each category, the amount you assigned to each category each month, your plan's starting month, and its currency setting. It also stores which categories are YNAB's automatically created credit card payment categories so they can be excluded from spending totals. Finally, it stores the time of your last sync and a synchronization marker provided by YNAB so future syncs only retrieve changes.

The export YNAB returns also contains your individual transactions, payees, accounts, and goals. The app discards all of that in memory before anything is written to storage. Your transactions, payees, and goals are never saved, never displayed, and never leave your device. Your account names and types are read only long enough to identify credit card payment categories, and are never stored or displayed.

How that data is stored and secured

  • Your plan data is cached in IndexedDB, the storage built into your browser, under the name moneylight-reports. That database is not created until you connect a plan, so a visit that only reads this site or tries the demo leaves nothing behind, and clearing your data removes it rather than emptying it. It remains on your device inside your browser's per-site storage and is never sent to us. It is not encrypted beyond whatever disk encryption your device already provides, so anyone with access to your unlocked device and browser profile could access it, just like any other website's stored data.
  • Your YNAB access token is held only in memory while the browser tab remains open. It is never written to storage. Reloading the page intentionally clears it, requiring you to reconnect. YNAB expires the token after two hours regardless.
  • All communication with YNAB uses encrypted HTTPS connections, and the page runs under a Content Security Policy that permits network requests to this site, api.ynab.com, and cloudflareinsights.com (the page-view counter described below) only. If the app tried to send your data anywhere else, your browser would block the request. The only scripts the policy allows are this site's own and the page-view counter's, loaded from static.cloudflareinsights.com.
  • One value is stored in your browser's sessionStorage: a random, single-use value used to verify that the sign-in response matches the request that started it. It contains no plan data and is deleted immediately after use.

How long it is kept

Cached plan data remains in your browser until you delete it. Because it never reaches our servers, we cannot remove it for you. Some browsers may also clear stored site data on their own: Safari removes it after about seven days without a visit, and any browser can evict it if storage space is needed. If that happens, nothing is lost beyond reconnecting and syncing your plan again.

We keep nothing because we receive nothing. There is no copy of your plan data on our systems.

Third-party data handling

The data obtained through the YNAB API will never be passed to any third party. It is not sold, shared, aggregated, or analyzed. Your plan data never reaches us in the first place.

Moneylight Reports relies on only two third parties:

  • YNAB provides the plan data when you choose to connect. The access token authorizes read-only access, and you can revoke this app's access at any time from your YNAB account settings.
  • Cloudflare (Cloudflare, Inc.) hosts this website. Like any web host, it processes the standard request information required to deliver a web page, such as your IP address, the requested file, and your browser's user-agent string. This information is part of serving the site and never includes your plan data. Cloudflare's privacy policy is available at cloudflare.com/privacypolicy.

We also use Cloudflare Web Analytics, Cloudflare's privacy-first page-view counter, so we can tell whether the tool is being used at all. It loads one script from static.cloudflareinsights.com, which reports the address of the page you are on, the page you arrived from, your browser's user-agent string, and how long the page took to load. It sets no cookies, reads nothing out of your browser's storage, does not fingerprint your device, and does not follow you to other sites. It never receives your plan data or your YNAB access token: the addresses it reports name only which report you opened, such as /app/seasonality, and the script does not read the part of the address that carries your YNAB sign-in.

Apart from that page-view count, there is nothing else measuring you here: no cookies, no advertising or tracking scripts, no cross-site profiling, no error-monitoring service, and no third-party fonts or CDNs. Nothing you do inside a report is recorded anywhere.

Moneylight (moneylight.app) is our separate paid forecasting application for YNAB users. It does not share data or accounts with Moneylight Reports. Nothing from this tool reaches Moneylight, and nothing from Moneylight reaches this tool.

Deleting your data

Because everything is stored on your device, deletion is immediate and does not require contacting us. Use the button below to erase the cached plan data and disconnect the current session. The app's sidebar carries the same "Clear My Data" button, which runs exactly this.

You can also:

  • Revoke this app's access from your YNAB account settings.
  • Clear this site's data from your browser settings, which removes everything stored by the application, including the sessionStorage value.

If you have a question about deletion or would like written confirmation, email hello@moneylight.app and we will reply within 7 days. We hold none of your plan data, so there is nothing for us to delete.

Changes to this policy

If the app ever accesses new types of YNAB data, uses your data for a new purpose, or adds a new third-party service provider, this policy will be updated before those changes take effect. The "Last updated" date at the top of this page will always reflect the most recent revision.

Contact

Questions about this policy: hello@moneylight.app.

Moneylight Reports for YNAB is operated by Sage Canyon Labs LLC
5900 Balcones Drive, Ste 100
Austin, TX 78731
United States

YNAB attribution and disclaimer

We are not affiliated, associated, or in any way officially connected with YNAB or any of its subsidiaries or affiliates. The official YNAB website can be found at https://www.ynab.com. The names YNAB and You Need A Budget, as well as related names, tradenames, marks, trademarks, emblems, and images are registered trademarks of YNAB.