Privacy policy

Effective October 7, 2026

BucuBux is operated by BucuBux LLC ("we"). This policy explains what we collect, why, and the choices you have.

What we collect

• Account details: your name, email address and password (stored only as a secure hash).
• Financial data you connect: when you link a bank through Plaid, we receive your account names, balances and transactions, card statement details, and for investment accounts what they hold and their buys, sells and dividends. Your bank login goes to Plaid, never to us. See Plaid's End User Privacy Policy.
• Things you add: categories, notes, tags, rules, and assets you enter by hand.
• Mobile number, if you choose to get text alerts, with the date you agreed to receive them.
• How you found us: when you arrive from one of our links or another website, we note which (for example a campaign name, or "search") with a random id in a cookie on our own site, so we know which of our posts work. We don't record your IP address for this, don't read anything from other sites, and don't use advertising networks' tracking.
• Device and usage data: browser type for push notifications you turn on, and security logs of sign-ins and changes.
• Where you sign up from: BucuBux is for people in the United States for now, so when you create an account we check which country your network address is in (on our own servers) and ask you to confirm where you live. We don't keep the country beyond the sign-in records described below.
• Offers: when you see, open or hide an offer, we count it, so we know which offers are useful. Opening a partner's offer only takes you to their site: we don't share your information with them.
• Sign-in records: to protect your account, each sign-in records the device and browser, its network (IP) address and an approximate location worked out from that address on our own servers (no outside service sees it), and how the sign-in was confirmed. You can see them in Settings › Security. We keep them 90 days, then keep only what happened, without the address, location or browser details. If you use an authenticator app, we keep its key encrypted and your recovery codes only as hashes. If you block a device, we keep its browser identifier and network address until you unblock it (the address only counts for 30 days). Locations use IP Geolocation by DB-IP.
• Email and text records: for each email or text we send you (sign-in codes, password resets, alerts), we keep when, what kind, the address or masked number, the subject with any code blanked out, and whether it was delivered to our provider, for 30 days, so our staff can find out why one didn't arrive. We don't keep the message itself.

The BucuBux phone app

• A copy on your phone: so BucuBux works without a connection, the app keeps a copy of your accounts and transactions on the phone, encrypted with a key held in the phone's secure storage. Signing out or deleting your account deletes it.
• Face ID, Touch ID and fingerprints are checked by your phone. BucuBux only learns whether the check passed; your face or fingerprint never reaches us.
• Push alerts: if you turn them on, we keep your phone's push address, its type (iPhone or Android) and the app version. Alerts go through Expo, Apple and Google, and say only what kind of alert it is, never amounts or merchant names.
• The app has no advertising, and doesn't track you across other apps or websites.

How we use it

Only to run BucuBux for you: show your accounts and reports, detect recurring charges and possible fraud, send the alerts you choose, keep your account secure, and answer you when you contact us. If you connect Claude, it reads your data through BucuBux only when you ask it to.

Sharing

We do not sell your personal information. We share it only with service providers that run BucuBux for us (for example Plaid for bank connections, Google Cloud for hosting, Amazon Web Services for email, Telnyx for text messages, Expo, Apple and Google for phone alerts, and Stripe for subscription payments: your card details go to Stripe, never to us), only as needed to provide the service, or when the law requires it. People you invite to your BucuBux see what their role allows.

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Text-message opt-in data and consent are never shared with any third party, except the messaging providers that deliver the texts you asked for.

Security and retention

Data is encrypted in transit, bank access tokens are encrypted at rest, and access is logged. We keep your data while your account is open. When you delete your account, everything in it is deleted right away and your banks are disconnected at Plaid; copies in our encrypted backups are gone within 30 days. If you've paid for a subscription, we keep the record of each payment (the amount, date, plan and the email address it came from) for as long as tax and accounting law requires, even after your account is deleted.

Your choices

You can change your details in Profile, turn alerts on or off in Settings › Notifications, remove your mobile number at any time, disconnect banks, and download all your data yourself (Profile › Download your data on the web, or More › Settings › Download your data in the app). You can delete your account and everything in it yourself, at any time: on the web in Profile › Delete your account, or in the app in More › Settings › Delete account. Reply STOP to any text to stop text messages.

Contact

BucuBux LLC (doing business as BucuBux)
304 S Jones Blvd, #1214, Las Vegas, NV 89107
support@bucubux.com
bucubux.com