Privacy

Who runs MyNewt

MyNewt is a tool for keeping track of savings, investments, debts and reward points. It is run by one person, not a company, and it is invite-only. You can write to us at support@mynewtbook.com.

What it holds

The amounts you put in, and the amounts that arrive from anything you choose to connect. Each one is saved with the day it was true and where it came from. Alongside those: your name and email address, the devices you have signed in with, the settings you have chosen, and site analytics (below).

Only if you choose to keep them: a loyalty programme’s membership number; the password to a loyalty or shop website; the key that opens a statement file your bank sends; your date of birth, because some banks lock the statements they email you with it; and a car’s VIN. The passwords, the statement keys and the date of birth are sealed, and the date of birth is shown only to you, never to your family.

If you ask to join, the name, contact and note you type are kept so the MyNewt team can answer you.

What it never holds

Never a card number. Never a security code from the back of a card. Never a full bank account number, and never a sort code or routing number. Never the password to a bank, a broker or a card company.

These are refused by the part of the app that does the storing, not by a form that could be got around. A card or bank account keeps its last four digits only, so you can tell two of them apart.

Connecting a bank

If you connect a bank, you sign in on the bank’s own page. We never see what you type. What the bank hands back is a read-only pass that you can cancel at any time, and cancelling it hands the pass back and deletes it.

Connecting INDmoney works the same way. The pass it hands back is sealed, as a bank’s is, you can cancel it at any time, and Disconnect hands it back and deletes it. It never holds your INDmoney PIN.

Bank connections are made through Plaid, Indian investments and bank balances through INDmoney’s own sign-in, and an Indian brokerage through Zerodha’s own sign-in. Plaid handles what it receives under its own End User Privacy Policy.

It can only read. It cannot pay, transfer or trade, and neither can anything else in this app.

Connecting an email

If you choose to connect a mailbox, MyNewt asks Google only for permission to read. There is no version of this that can send, delete or change anything in your mail.

It does not read your mailbox. It asks Google only for messages from the senders on a list you control — your airline, your hotel programme, your bank — and, once after you connect, for which senders emailed you a statement, so it can offer your bank statements too. Nothing else is ever read.

From those messages it takes the balance, the programme it belongs to and the date, and keeps those; from a bank statement you agree to, the account’s name, its last four digits, the balance and the month’s transactions. The message itself is never stored. You can see exactly what was looked for, what was found and what was kept, and undo any of it.

You can disconnect a mailbox here at any time. You can also revoke it yourself from your Google account, without asking us, and that works whether or not this app is behaving.

The browser add-on

If you install the MyNewt add-on, it reads the points balance off a programme’s own page — but only on the page you are looking at, and only when you tap its button. It asks your browser for no standing permission on any site, so it cannot look at a page you have not tapped on. That is enforced by the browser itself, not by us.

It never sees any password, on any site. It plays no part in signing you in — you sign in exactly as you always would, and it reads what is already on your screen.

What it sends is the few lines of words around the balance and the name of the site — never the page, never the address you are on, and never your whole account. Anything shaped like a card or account number is taken out before it leaves your browser, and taken out again when it arrives. The one exception is your loyalty membership number, and only on one of the hotel or airline sites MyNewt already knows by name, and only when the page itself captions it with words like “member number” — that is one of the few things this app is allowed to keep, it is what tells two accounts on one programme apart, and a card-length number is never taken for it. On a site you named yourself it is never read at all: saying which points a site holds is not the same as saying whether a number printed there is a loyalty account or a bank one.

On a site MyNewt does not know, it asks you which programme it is — and keeps your answer, so it only asks once. What is kept is the site’s name and the programme you chose. It is yours alone; nobody else in your family sees it, and you can take any of it back at Account › The browser add-on.

The words it read are never stored. Not for thirty days, not for one — there is no place in the database that could hold them. What is kept is the balance, the programme, the day, the membership number when the page named one, and what happened. You can see every read it has made, including the ones that were refused.

The add-on holds one thing: a pass into MyNewt, which you make and can cancel at any time. Cancelling it stops the add-on immediately. And as with every other way a balance arrives, nothing is saved until you tap to accept it.

What Google requires us to say

MyNewt’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not retain data obtained through Google APIs to develop, improve or train generalised artificial intelligence or machine learning models.

Where a computer reads a message for us

Most messages are read by rules written into the app, and those never leave our own server. When a message arrives in a shape the app does not recognise, the part of it that carries a balance may be sent to an outside service to be read: Anthropic, which makes the Claude AI models.

When that happens: anything shaped like a card or account number is removed first; only the part carrying the balance is sent, never the whole message; no person there reads it; and it is never used to train anything. The service does hold what it was sent for up to thirty days before deleting it, and we do not have an agreement that shortens that.

A picture is different, and here is how. You can add points by photographing your own notes or a spreadsheet. A picture cannot have part of it blacked out the way a message can — so the whole picture is sent, once, to be read. Before it goes you see exactly what will be sent and can drag a box around just the part you want read. It is never saved by this app. The service that reads it holds it for up to thirty days and then deletes it, as for any words sent (above). What it finds is shown to you beside the picture, and nothing is saved until you tap.

A file you drop — a bank statement, a CSV, a screenshot — is read by rules written into the app first, on our own server, and the file itself is never stored: it is held for the length of one request and written nowhere. Only if those rules find nothing, and only when you tap to ask, may the words around the amounts go to the outside reader — with anything shaped like an account, card, folio, PAN or customer number taken out first, and you see exactly what will be sent before it goes. A screenshot goes whole, once, the same way a picture of your notes does — and so do the first pages of a PDF that is only pictures of paper, opened on your own device and shown to you page by page, with only the pages you leave ticked sent. What comes back is a list you check, line by line, and nothing is saved until you tap.

A bank statement your bank emails you is picked up the same way: the app reads the newest one from each bank it finds, works out the balance and the month’s transactions, and shows you what it found. Nothing is saved until you agree, account by account, and you can change an amount or leave an account out before you do. While a statement waits for you, a scrubbed reading of it is kept — its amounts and lines, with no address or phone number — until you save it or put it aside; the file itself is never stored.

An email you paste in yourself — a forward from a friend, a voucher confirmation — is read the same way: only the lines naming the voucher go to the outside reader, with anything shaped like an account or card number taken out first, and you see exactly what was sent. If the email says who sent it, you are offered one tap to have future emails from that sender read too. Nothing is added to your sender list until you tap.

You can see exactly what was sent, for thirty days — and then it is deleted. You can also delete it sooner yourself. The message it came from is never stored at all.

Who can see your data

You can. Anyone you have shared an account with can see that account. The app itself reads your amounts in order to add them up for you.

If you name a trusted person, they can download a copy of your data if you stop opening MyNewt for a long while, or sooner if they ask and you do not say no in time. You choose them, and you can take it back at any time.

Nobody else sees them in the app. The MyNewt team can block, close or delete an account, change its email when you ask, and can see how many bank connections a person has and when they last brought anything in — never which bank, which account or any amount. To tell people apart, the MyNewt team may also write down your full name and a short note; erasing your data removes both.

Behind the app, your data is kept in a database. The MyNewt team can reach it directly, from one locked laptop, and only to keep MyNewt running — never to look through anyone’s data.

Who else handles it

Each of these gets only what its own job needs, and only for that job:

• Vercel runs the app and keeps its sealed backups.
• Neon keeps the database.
• Plaid connects a bank, if you connect one.
• Zerodha connects an Indian brokerage, if you connect one.
• INDmoney sends your Indian investments and bank balances, if you connect it; we send it nothing but the sign-in request.
• Google gives read access to a Gmail mailbox, if you connect one.
• Anthropic reads the parts of a message, file or picture described above, when the app’s own rules cannot.
• RentCast is sent a home’s street address, only when you ask for that home’s estimated value.
• Geoapify, an address search built on OpenStreetMap, is sent what you type in a home’s address box, as you type, to suggest the full address — never your name or who you are.
• Photon, komoot’s address search built on OpenStreetMap, is sent the same, only when Geoapify does not answer.
• VinAudit is sent a car’s VIN, about every three months, only for a car you have asked it to value.
• NHTSA, the US highway-safety agency, is sent a car’s VIN when you type it, to fill in the year, make and model — never your name or who you are.
• CoinGecko is asked the price of each kind of coin held in the app — never who holds it or how much.
• SEC, the US markets regulator, is asked for the public holdings list of each US fund held in the app — never who holds it or how much.
• Resend delivers email to the MyNewt team: a note you send from the app, a request to join, and word that you made an account — each with your name and email, so they can reply. It also delivers your invite link to you, at the email you left when you asked to join.
• Your phone’s own notification service (Google, Apple, Microsoft or Mozilla) carries a reminder to your device, locked so that the service cannot read it.

There are no advertising tools and no outside analytics tools. MyNewt sets only its own cookies, which keep you signed in and remember choices you made in the app.

How it is kept

Encrypted on the way here and where it sits, with sealed daily backups. Some things — a membership password, a bank pass — are sealed a second time with a key kept outside the database, so a copy of the database alone does not open them.

How long

Your data stays until you remove it, erase it, or delete your account. A message we read is never stored — only the balance, the programme and the date come out of it. The one exception is the part sent to an outside reader, kept for thirty days so you can see it and then deleted. A file you are asked to unlock is held only until you open it, and swept away if you never come back. An email that reached the MyNewt team — a note, a request to join — stays in that mailbox. Site analytics kept with your account go when your data is erased or your account deleted; those from before signing in belong to no account and are kept.

Backups: a daily copy is kept for thirty days, and one copy from each month is kept, sealed, for twelve months, so the whole app can be restored after an accident. Older copies are deleted by themselves, so something you erase or delete is gone from every backup the app keeps within a year.

Leaving

One tap downloads every amount and its history, in a file you can read without this app: Account › Back up & restore. “Erase my data” erases everything you saved and keeps your account; “Delete my MyNewt account” ends the account too, with your name and email. Either one also deletes the site analytics kept with your account. Both are at Account › Erase or delete, and how to delete your account says what goes, what stays, and how to ask if you cannot sign in.

Nothing is sold, nothing is advertised, and nothing is shared with anyone for their own purposes.

Site analytics

Like most apps, MyNewt keeps simple records of how it is used — such as which screens and features are opened, how often and for how long, how quickly each screen appears, on what kind of device and from which country, and when something goes wrong — so problems can be found and fixed and the app made better. They are kept with your account — or, before you sign in, with no account at all — in MyNewt’s own database; no outside analytics service is used.

They never include your balances, transactions, notes or anything you type, and they are never sold or shared.

Changes

If any of this changes, the date at the top changes with it, and the sentence that moved is changed here rather than quietly dropped.