Privacy Policy

Last updated: July 26, 2026

Moneylight Reports for YNAB is a free reporting tool for YNAB users, operated by Sage Canyon Labs LLC ("we," "us," or "our"). It runs entirely in your browser. There is no account to create, no server of ours for your budget data to sit on, and no analytics on this site. This policy covers what the app accesses, where that data is kept, how long it stays, and how to delete it.

The short version

Your budget data never leaves your device. Your browser asks YNAB for your budget directly, does the math locally, and caches the result in your own browser's storage. We never receive it, and we could not read it if we wanted to.

What the app accesses, and why

When you click "Connect to YNAB," you are sent to YNAB's own consent screen. If you approve, YNAB hands your browser a read-only access token. We never see, ask for, or store your YNAB password or your bank login credentials.

Your browser then calls the YNAB API directly and downloads one export of the budget you choose. The app keeps only what the reports need: your category names and groups, the month-by-month spending total for each category, your budget's starting month, and its currency setting. That is the only purpose: building the report you asked for.

The export YNAB returns also contains your individual transactions, payees, accounts, and goals. The app discards all of it in memory before anything is written to storage. It is never saved, never read, and never displayed.

How that data is stored and secured

• Your budget data is cached in IndexedDB, the storage built into your own browser, under the name moneylight-reports. It sits on your device inside your browser's per-site sandbox, which no other website can read. It is not encrypted beyond whatever disk encryption your device already applies, so anyone with access to your unlocked device and browser profile could open it, the same as any other site's stored data.
• Your YNAB access token is held in memory only, for as long as the tab stays open. It is never written to storage of any kind. Reloading the page loses it on purpose, which is why refreshing a report costs one "Reconnect" click. YNAB expires the token after two hours regardless.
• Every request to YNAB travels over TLS (HTTPS), and the page runs under a Content Security Policy that permits network requests to this site and api.ynab.com only. If the app tried to send your data anywhere else, your browser would block the request.
• One item goes to your browser's sessionStorage: a random single-use value that verifies the sign-in response came back from the request that started it, a standard check against sign-in forgery. It holds no budget data and is erased the moment it is used.

How long it is kept

Cached budget data stays in your browser until you delete it. We cannot delete it for you, because we cannot reach it. Your browser may also clear it on its own: Safari removes stored site data after about seven days without a visit, and any browser can evict it under storage pressure. Nothing is lost when that happens beyond one resync.

We keep nothing, because we receive nothing. There is no copy on our side to expire.

Third parties

The data obtained through the YNAB API will never be passed to any third party. It is not sold, shared, aggregated, or analyzed for anyone. It does not reach us in the first place.

Two companies are involved in making this app work:

• YNAB is the source of the data, reached by your browser at your instruction. The token it issues authorizes reading only, and you can revoke this app's access at any time from your YNAB account settings.
• Cloudflare (Cloudflare, Inc.) hosts these pages. Like any web host, it processes the standard request metadata involved in delivering a page to you: your IP address, the file requested, and your browser's user-agent string. That is a function of the page being served, not something we collect or review, and it never includes budget data. Cloudflare's privacy policy is at cloudflare.com/privacypolicy.

There are no analytics on this site, no cookies, no advertising or tracking scripts, no error-monitoring service, and no third-party fonts or CDNs.

Moneylight (moneylight.app) is our separate paid product for YNAB users and shares this name. The two do not share data or accounts. Nothing from this tool reaches Moneylight, and nothing from Moneylight reaches this tool.

Deleting your data

Because everything is on your device, deletion is immediate and does not require asking us. This button erases the cached budget data and disconnects the current session.

Two further steps you can take, both outside our reach:

• Revoke this app's access from your YNAB account settings.
• Clear this site's data in your browser settings, which removes everything described above, including the sessionStorage value.

If you have a question about deletion, or want it confirmed in writing, email hello@moneylight.app and we will reply within 7 days. We hold nothing of yours to delete, so a confirmation is all we can send.

Changes to this policy

If the app ever accesses new kinds of YNAB data, uses it for a new purpose, or adds a third-party service, this page is updated before that change ships, and the "Last updated" date at the top will reflect it.

Contact

Questions about this policy: hello@moneylight.app.

Moneylight Reports for YNAB is operated by Sage Canyon Labs LLC
5900 Balcones Drive, Ste 100
Austin, TX 78731
United States

YNAB attribution and disclaimer

We are not affiliated, associated, or in any way officially connected with YNAB or any of its subsidiaries or affiliates. The official YNAB website can be found at https://www.ynab.com. The names YNAB and You Need A Budget, as well as related names, tradenames, marks, trademarks, emblems, and images are registered trademarks of YNAB.