Privacy

What Whatif reads

Whatif connects to YNAB with read-only access. It cannot change a budget, a transaction, a category or a target — not by design choice, but because the access it is granted does not permit it.

With your permission it reads five things from your budget and keeps them: your account balances, your category names and their budgeted, spent and available amounts, a per-category monthly total and the age of money for every month your budget has, your scheduled transactions, and your individual transactions — which have a section of their own.

What you tell Whatif

Your plan is yours to change, on the web and in the Whatif app, and Whatif keeps what you change in it: a figure you state in place of YNAB’s, a spending you add — what it is for, its amount and its day — and a row you snooze, with the month it is back. It keeps your scenarios too. None of it is sent to YNAB, which could not accept it. It is kept until you change or remove it, disconnect the budget or delete your account, and it is in the backups, as Deleting everything says. A payment you try in the app’s What if is used only to work out what it would do, and is not kept.

Your individual transactions

A forecast is built from balances, categories and the calendar of what is scheduled, and reads your transactions for one thing only: whether something it expects this month has already happened — pay that landed early, or a payment already made to a card or a loan — so that it is not counted twice. Four other things read them — Where it went, which adds up how a month actually went; the forecast’s page for the current month, which shows what each day so far spent against its share of your own spending figures; the assistant on Ask, when a question needs what actually happened; and, in December and January, the year in review, which adds up a year of them and keeps nothing it adds up.

A slide of the year in review can be shared as an image. The image is drawn in your browser and goes only where you send it: Whatif does not upload it, keep it or make a link to it. It shows no amounts unless you turn them on for that image.

So Whatif keeps them, for every budget you connect: the date, the amount, the payee, the category, the account and the cleared status of every transaction, from your budget’s first month. They are kept for as long as the budget is connected — nothing deletes them because of their age. A transaction you delete in YNAB is deleted here at the next sync. Disconnecting the budget deletes every one of them, and so does deleting your account.

Who you paid and how much are encrypted before they are written, with a key that is kept apart from the database and its backups — and so is every conversation with the assistant. A copy of the database, or the reporting tools we use to look at it, see the date, the category and the account of each transaction, and whether each one is cleared or reconciled — but neither who was paid nor how much. Whatif itself can read them, because adding them up for your screens and searching them for the assistant is what they are kept for. The rest of what it keeps — balances, categories, monthly totals, the age of money and scheduled transactions — is stored as it arrives.

Backups hold none of your individual transactions. They are left out of every backup, and if one is ever restored, they are read again from YNAB.

The assistant on Ask can search them, to answer a question about what already happened, and what it looks up is kept in that conversation, encrypted like the rest of it. Conversations have no time limit. Each is kept, with whatever it looked up, until you delete it, disconnect the budget or delete your account. Switching the budget to a different YNAB budget deletes every conversation that looked up its transactions.

Reporting an answer on Ask — as offensive, harmful or wrong — lets Whatif read that conversation, to review the answer: a use of it that you ask for by reporting it. The report keeps which answer it was, the reason if you gave one and when, and is deleted with the conversation. Whatif’s team is told that a report arrived, with its reason and a number for it — never your question or the answer.

The current month’s page arrives with those day totals only, added up on the server, and with what today has already paid, added up the same way by category or by the card or loan it paid. Open one day and it lists that day’s transactions — payee, category, account and amount — read when you open it, and nothing about it is kept.

On Where it went you can mark a transaction with a word of your own — surprise, or anything you type. Those marks are kept in Whatif and are never sent to YNAB, which could not accept them: the access you grant is read-only. They are deleted whenever the transaction they are about is: when it is deleted in YNAB, when you disconnect or switch the budget, and when you delete your account. Unlike the transactions, they are also in the backups, because nothing else holds them — so a copy can outlast a deletion by up to 90 days, as Deleting everything says.

Your connection to YNAB

The credential that lets Whatif read your budget is encrypted before it is written to the database, with a key held separately from it. Disconnecting your budget destroys the credential immediately and deletes every row read from it.

Deleting everything

Delete account, at the foot of the Account menu — or at whatif.money/account/delete, which opens it directly — deletes your budget data, your transactions, your conversations, your scenarios and your credentials, and cancels your subscription first if you have one. It is immediate, and nothing in Whatif can bring it back. What the providers below already hold — Stripe’s payment records, a support conversation — stays under their own policies.

You can also ask for it by writing to support@whatif.money from the address on your account, and it will be done.

Backups are the exception. They hold everything Whatif keeps except your individual transactions — your account, balances, categories, scheduled transactions, plan, scenarios, marks and encrypted conversations — and each backup is deleted on its own schedule within 90 days. So after you delete your account, copies of it can remain in backups for up to 90 days, and then they are gone.

Who else sees it

Your data is not sold, not shared with advertisers, and not used to train anything. The providers below each see only what their part needs, and each is named so that you can read its own policy.

Whatif runs on servers rented from Contabo, in the European Union, which hold the app and its database; copies of the backups are kept in Cloudflare R2. Emails — confirming your address, resetting a password, and once a year the one saying your year in review is ready, which a link in it stops for good — are sent by Resend, which also receives what you write to support@whatif.money. Payments are handled by Stripe: your card details are typed into Stripe’s own pages and never reach Whatif, which tells Stripe your email address and an internal number for your account.

The assistant on Ask is a language model, Claude, run by Anthropic, which writes its answers. When you ask it something, your question, the earlier turns of that conversation and the figures it looks up to answer — the budget’s name, your plan’s balances, categories and amounts, and the transactions it searched — are sent to Anthropic to write the answer, readable, because it cannot answer from anything else. Nothing is sent until you ask.

Anthropic does not use what Whatif sends to train its models, and deletes it within 30 days — except anything its systems flag as breaking its usage policy, which it can keep for up to two years, and anything the law requires it to keep for longer.

One more, added deliberately and worth stating exactly: PostHog, a product analytics provider whose servers are in the United States. It receives a fixed list of events about which screens were used — that setup was finished, that a sync failed, that a password reset was asked for — with an internal number for your account and your plan, and, as with any visit, your IP address and details of your browser. It does not receive any figure from your budget, any account, category or payee name, the contents of any page, or a recording of anything. It sets no cookies.

That list is a file rather than a policy: every event the product can send is declared in one place in the source, and nothing else is collected. Page recording, automatic click-tracking, heatmaps, error capture, performance capture and surveys are all switched off in the code, which is what makes the paragraph above checkable rather than a promise about intentions.

PostHog also holds the switches for features that are not finished yet, which decide who sees them first. Whatif’s own server downloads those rules and decides for you there, for the website and the phone apps alike, so nothing about you is sent to PostHog to decide them.

And the support chat in the corner of each page, run by Featurebase, whose software loads from its own servers along with the page. It sets a cookie holding an anonymous visitor number, so a conversation survives a reload, and it receives what you write to us and the address of the page you are on. If you are signed in, it is also told your name, email address, plan and an internal number for your account, and keeps a second cookie for that, so a reply reaches you. Signing out removes both. It is never sent a figure from your budget, or any account, category or payee name.

And a bot check, Cloudflare Turnstile, on the three pages that email an address typed into them: creating an account, resetting a password and asking for a new confirmation link. It loads from Cloudflare’s servers on those pages only, and sees what any site sees of a visit — your IP address and details of your browser — to tell a person from a program. It is not told the email address you type, or anything from your budget.

And a Product Hunt badge on the front page: an image loaded from Product Hunt’s servers, on that page only. It sees what any site sees of a visit — your IP address and details of your browser — and Product Hunt can set a cookie with it, lasting half an hour, to tell a person from a program. It is told nothing about your account or your budget.

And if you choose Continue with Google, Google confirms who you are and tells Whatif your name, email address and profile picture, which are kept with your account. Google is told nothing about your budget.

And if you use the Whatif app on a phone and let it send you notifications, they travel through Apple’s push service (APNs) to an iPhone, and through Google’s Firebase Cloud Messaging to an Android phone. Whatif sends one when a sync changes your plan, moves your forecast’s lowest point to another day, or takes your cash below zero where it was not before — and, only if you turn them on in the app, on payday and when a month ends. Neither service is given a figure or a name — no amount, payee, category or budget name: only what kind of news it is, internal numbers for the budget and for what changed, which month it is about when a month has ended, and for an iPhone one fixed sentence to show if the phone cannot reach Whatif in time. The app fetches the rest from Whatif itself and writes the notification on the phone. Like any notification, Apple and Google can tell which phone it went to and when. Whatif keeps the address each service gave your phone, the app’s version and your notification settings, and forgets them when you sign out of the app, when Apple or Google says the address no longer reaches the phone, and when you delete your account. So that no notification is sent twice, it also notes which ones each phone has been sent, and forgets each note after a week.

And if the Whatif app crashes, or stops responding, on an Android phone, a report goes to Google’s Firebase Crashlytics: where in the app’s code it stopped (its stack trace) and when, the phone’s maker and model, the versions of Android and of the app, and an installation number Crashlytics makes for that copy of the app. With it goes the phone’s state at that moment — its battery level and whether it is charging, which way the screen was turned and whether the app was on it, its processor, how much memory and storage it has and how much of each was in use, whether it has a proximity sensor, and whether it is rooted or an emulator — and, if the app stopped responding, Android’s own record of that, with the memory the app was using. The library that carries it to Google adds the names Android gives the phone’s hardware, device and product, the exact build of Android it runs, the country and language it is set to, its time zone’s offset from UTC, how long since it last started, and the type of connection it had, such as Wi-Fi — and can include the code of the mobile network that issued its SIM card and, on mobile data, which kind of network it was, such as LTE. The report holds nothing from your budget — no figure, and no account, category or payee name — and Whatif tells it nothing about who you are. When the app does not crash, nothing is reported: it only checks Crashlytics’ settings now and then as it starts, which shows Google that installation number, the phone’s model and the versions. Like any request, each shows Google the phone’s IP address. Google keeps a report for 90 days.

When this changes

If Whatif starts using a kind of YNAB data this page does not describe, or starts using your data in a way it does not describe — including sending it to a provider not named here — this page is updated first, and you are asked to agree before Whatif goes ahead.