Wealth Mutant for the Privacy-Focused

You're the one who reads the permissions screen before tapping through it. When a finance app offers to securely connect your bank, you want to know who the "securely" belongs to: which company holds the token, which server keeps the copy, and what the terms say happens to the aggregate.

You've either read what actually moves through those pipes or you worked it out on your own. Either way you've noticed that privacy in this category is usually a policy: a promise, revisable by whoever owns the database, and enforced by their good intentions.

Here it's a shape instead. Some things can't be promised away because the machinery to do them was never built.

Three things that can't happen here

Your bank credentials can't leak from us, because we never ask for them. There is no linking screen anywhere in the product, and bank linking sits on the roadmap's Never list rather than its backlog.

There's no aggregator relationship to breach. No Plaid, no Yodlee, no regional equivalent. The pipe isn't switched off; it was never laid.

Your transaction history can't be sold, because the business doesn't run on it. Wealth Mutant costs money once, which is exactly why it can afford to have no other revenue. Software that isn't charging you is being paid by somebody — and you're generally not in the room for that conversation.

What sits on our servers is what you typed, behind your login, encrypted at rest. That's the whole surface area. The most revealing document anyone could assemble about your life has one author and one reader here, and they're the same person.

The details that survive being checked

• Payments. Razorpay handles them (PCI DSS SAQ A) with 3-D Secure. Card numbers travel from you to them; they never touch our servers. The full billing picture.
• AI is opt-in per message. Your financial context reaches the model only when you press send on a specific chat message, only for that conversation, and it isn't used for training. Bring your own API key and it's encrypted at rest with AES-256, never logged, never shown again. Don't use the chat and nothing leaves at all. AI is also a paid feature, so during a trial it isn't even switched on. How it works.
• Notifications carry no amounts. Ever, by rule, in every notification type. A budget alert says a budget crossed its threshold; the figures wait inside the app. Your lock screen learns nothing on a crowded train. The full list of what we can send.
• Support can't look. Staff can see technical facts (how many accounts you have, whether an import failed) and nothing financial. Access to your actual balances requires a grant you create, scoped to a support email, defaulting to 24 hours, revocable in one tap. The database enforces it, not a staff handbook.
• The exit is real. Transactions as CSV, or every table you own as a ZIP, on demand, rate-limited to three an hour because bulk export is the first thing an intruder would try. Account deletion means deletion. Both live in Settings.

Verify it, don't believe it

The right pitch to someone like you is an invitation to audit. Take the seven days (no card is asked for, and there's no bank connection available to refuse). Open the network tab and watch what the app talks to. Read the privacy overview and then check it against what the settings screens actually let you do. Export your data on day one, before you've grown attached, so you know the exit door opens.

Every claim on this page is checkable from inside a free week, which is the only kind of privacy claim worth making. The tour covers the rest of the product if you want the feature picture too.