Privacy Policy
Last updated: August 18, 2026
Budget-Time (“we”, “us”), operated by K12 Supplier LLC, provides a Google Sheets add-on and companion service at budget-time.com that imports your financial account data into your own Google Spreadsheet. This policy explains exactly what we collect, what we deliberately do not collect, and how we handle it. Where it helps, each point is written twice: once in plain English and once with the technical detail behind it.
How your data moves
Every import follows the same one-way path. Nothing along it writes your financial data to disk on our side.
When you click “Import” (or a scheduled morning update runs), the add-on asks our server for your latest activity. Our server asks Plaid, gets the answer, hands it straight back to the add-on, and forgets it. The add-on - which lives inside your Google account, not ours - writes the rows into your sheet.
The add-on calls our API with a Google OIDC identity token. Our server decrypts the
Plaid access token for that connection, calls Plaid (/transactions/sync,
/accounts/balance/get, /investments/holdings/get,
/liabilities/get), maps the response, and returns it in the HTTPS
response body. The response is a request-scoped object in process memory; when the
request completes it is released to garbage collection. No write to a database,
filesystem, cache, or queue occurs. Only the new Plaid sync cursor is saved.
Our server can't read or edit your spreadsheet. Only the add-on can, and it runs with your permissions, inside your Google account.
The backend holds no Google Sheets or Drive credentials and never calls the Sheets
API. Writes to the sheet are performed by Google Apps Script executing under your
authorization with the spreadsheets.currentonly scope. Our server has no
token that could reach your Drive.
What we store
To operate the service we persist only the following. This is the complete list.
| What | Why | Contains financial data? |
|---|---|---|
| Your Google account identity (email address + Google account ID) | Recognize you and attach your subscription | No |
| Plaid access token for each bank connection, encrypted | Lets us fetch your data when you ask | No - it's a credential, not data. Useless without our server-side key. |
| Connection metadata: institution ID and name, connection status | Show “Chase - connected” in the sidebar | No |
| Plaid sync cursor | Bookmark so the next import only fetches what's new | No - an opaque string issued by Plaid; it encodes a position, not transactions |
| Subscription state (plan, status, Stripe customer/subscription IDs) | Know whether you're on trial, active, or lapsed | No card numbers - Stripe holds those |
| Optional first name you type, and your product-updates email preference | Address you by name; honor your opt-in/opt-out | No |
| Daily API call counts per connection | Track our own Plaid costs | No - counts only (“3 syncs on Aug 12”), never the payloads |
| Our own billing records (invoice ID, amount we were paid) | Revenue reporting | No - this is what you paid us, not your bank data |
What we deliberately do not store
- No transactions, amounts, dates, categories, or merchant details
- No account balances, account numbers, or routing numbers
- No investment holdings, positions, or securities
- No interest rates, minimum payments, or liability details
- No bank usernames or passwords (these go directly to Plaid; they never touch our systems)
This isn't just a promise - it's built into the software so it can't quietly change. Our database has no place to put financial data, and an automated check fails the build if anyone ever adds one.
The database schema is an explicit allow-list of tables and columns (users, items,
link_sessions, subscriptions, api_usage, billing_events). A test in our release suite
asserts the live schema matches that allow-list exactly and that no identifier
contains fragments such as transaction, balance,
holding, amount, merchant,
account_number, or routing. Any change that would persist
financial data fails CI.
To be precise: Plaid's API does give our server the full data each time you import. We could save it - we simply built the system so it never does. We're not claiming an outside restriction; we're describing a deliberate design choice that we enforce and test.
Zero retention is an architectural property, not a vendor limitation. Plaid delivers complete payloads at our endpoints; our code path contains no persistence for those payloads. Plaid itself does store and cache account data on its side to operate its service - see the Plaid End User Privacy Policy linked below.
Logs and monitoring
Our server keeps ordinary technical logs - which endpoint was called, when, and whether it succeeded. Those logs never contain your transactions or balances.
Request logging records method, path, status code, response time, and the requesting
IP. Request and response bodies are not logged. Error logs record Plaid error codes
(e.g. ITEM_LOGIN_REQUIRED) so we can prompt you to reconnect - not the
data payloads. There is no application-level cache (no Redis, no on-disk cache) for
Plaid responses.
How your bank connects (Plaid)
Bank connections are powered by Plaid Inc. When you link an account, you authenticate directly with Plaid or your bank in a Plaid Link window hosted at budget-time.com - your credentials go to Plaid, never to us. Plaid's handling of your information is described in the Plaid End User Privacy Policy. You may revoke access at any time via the add-on's “Disconnect” action, from the Plaid Portal, or through your bank. Disconnecting in the add-on calls Plaid to revoke the connection and deletes its access token, cursor, and metadata from our systems, and we email you a confirmation so an unexpected disconnect is visible.
Connections belonging to accounts whose trial or subscription has lapsed for more than 14 days are automatically revoked with Plaid and deleted, and you receive a courtesy email. Data already in your sheet is untouched.
Google user data & Limited Use disclosure
The add-on requests the minimum Google permissions needed to work:
- View and manage the spreadsheet the add-on is installed in
(
spreadsheets.currentonly) - used solely to write your imported data into that spreadsheet. We cannot access your other Drive files or other spreadsheets. - Connect to an external service (
script.external_request) - used to call our own API and nothing else. - Your email address (
openid,email) - used to identify your account and subscription. We do not request your name or profile photo; if you want to be addressed by name, you type it in.
Budget-Time's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not allow humans to read it except with your explicit consent for support, for security purposes, or as required by law.
Payments
Subscriptions are processed by Stripe. Card details are entered on Stripe's hosted checkout and never reach our servers; we receive only a customer ID, subscription ID, plan, and status. See the Stripe Privacy Policy.
Security
- All traffic is encrypted in transit (TLS/HTTPS).
- Plaid access tokens are encrypted at rest with AES-256-GCM using a key held outside the database and outside the application's source; each token uses a unique random IV and an authentication tag, so a copied database file is unreadable and tamper-evident.
- Every API request from the add-on carries a signed Google identity token that we verify against Google's public keys before doing anything; bank-linking sessions use single-use, expiring nonces.
- Webhooks from Plaid (JWT, ES256) and Stripe (HMAC signature) are cryptographically verified before processing.
- Production access is restricted and protected by multi-factor authentication.
Data retention & deletion
Connection records are deleted immediately when you disconnect a bank. To delete your account entirely (identity, connections, subscription records), email [email protected] - we complete deletion within 30 days. Because we never held your financial data, there is nothing of that kind to delete on our side. Everything imported into your spreadsheet is yours and remains under your control in your Google account; we couldn't delete it if we wanted to.
Children
Budget-Time is not directed at children under 13 and we do not knowingly collect their data.
Changes & contact
We'll post any changes to this policy on this page and update the date above. Questions: [email protected].