What “read-only bank access” actually means

The scariest moment in any budgeting app is the bank-linking screen. It feels like handing a stranger your online banking password. Understanding what actually happens turns a leap of faith into an informed decision.

How linking works

Modern apps don't touch your credentials. When you link a bank through an aggregator like Plaid, you authenticate directly with the aggregator (increasingly via your bank's own OAuth login page), and the app receives a token — a scoped credential that can read your balances and transaction history, and nothing else. Your password never passes through the budgeting app's servers at all.

What "read-only" can and cannot do

• Can: see account names, balances, and transaction history — the raw material of budgeting.
• Cannot: move money, pay bills, open accounts, change your address, or log into your bank as you. The token simply has no such powers to exercise.

Questions worth asking any tool

• Does the app ever see or store my bank credentials? (The answer should be an unqualified no.)
• Is the access token kept server-side, or does it ever reach my browser or phone?
• What happens when I disconnect — is the token actually revoked at the aggregator?
• And the business-model question: if the product is free, is my data the product?

Our answers

For Budgeteer Pro: we never see credentials; tokens are readable only by internal server functions; disconnecting an institution revokes the connection at Plaid — as does deleting your account; and the business model is the subscription, not your data. The full detail is on our security page, and every claim there restates the privacy policy. Linking a bank should be a convenience you chose with clear eyes — never a mystery you regret.