What your budgeting app sees when it connects to your bank

Updated August 14, 2026

You install a budgeting app. Second screen: “Connect your bank.” You pick yours, you authenticate, and thirty seconds later every transaction is there, already categorised.

It is an excellent product. The question is not whether it is convenient — it is — but what was transmitted, to whom, and for how long. Few people know, and the consent screen does not really say.

First, the good news

Before PSD2, these connections worked by screen scraping: you handed your banking credentials to a third party, which then logged in as you. It was as bad as it sounds.

PSD2 ended that model. In Europe, account aggregation now goes through bank APIs and licensed operators — account information service providers (AISPs), supervised by national regulators. You authenticate with your bank, not with the third party. It never sees your password.

That is a real improvement, and it deserves saying before anything else.

What is transmitted, however

The aggregator does not receive your password. It receives your data.

For each connected account, in practice: the balance, the account number, the account type, and the transaction history — date, amount and label. Providers advertise a minimum of three months of history, and up to twenty-four months depending on the bank.

Two years of statements. Take a second to picture what yours contain.

The label, not the amount

This is the part almost everyone misses.

An amount alone says nothing: “€34.90” is not information. The label names the merchant. And the list of merchants you pay describes your life with a precision no questionnaire would ever obtain:

a pharmacy every month, a testing lab, a hospital;
a law firm, a notary, a dating service;
a union subscription, a donation to a party, a religious association;
a betting site, a tobacconist;
recurring train tickets to the same city, every other Monday morning.

The GDPR gives stricter protection to certain categories — health, political opinions, trade union membership, sexual orientation. A bank statement is not legally health data. But a “Central Pharmacy” line every 28 days is a reliable proxy for it, and that is exactly why the question deserves more than a shrug.

For how long, without you thinking about it

Since the PSD2 technical standards were revised, an aggregation connection stays active for 180 days before asking you to authenticate again — up from 90. The intent was legitimate: frequent re-authentication was breaking these services.

The side effect is just as real. Twice a year is not many reminders that a third party is reading your accounts continuously. A connection set up one Sunday in January “just to try” is still alive in June, and you have not thought about it since.

What this does not mean

Precision matters here, otherwise it tips into fantasy.

European aggregators are regulated operators, licensed and supervised. They may not use your data for purposes beyond the service you consented to, and the GDPR applies in full. Many also operate white-label: the app you use is often not the entity holding the licence.

The risk is not that someone sells your statement. The risk is surface. Your data exists in readable form, at one more company, in one more database, reachable by a non-zero number of employees and by anyone who obtains that access. No regulation prevents a breach; it organises what happens afterwards.

And that surface is not really optional: it is the condition of the service. An aggregator that could not read your transactions would be useless.

The other model: never receive the data

There is a way to frame the problem differently — make it so the server cannot read, whatever happens.

That is what end-to-end encryption does. Your budget is encrypted on your device, with a key derived from your passphrase, before anything is sent. The server only ever stores unreadable bytes. A database breach yields nothing usable, and the vendor — us — can no more read your budget than an attacker can.

That is the choice Arca made, and it is also why Arca does not connect to your bank: you cannot both receive transactions in readable form to categorise them and claim you can read nothing. You have to pick one.

What that choice costs

Let us be blunt, because an article about privacy that hid the price of its own position would be worthless.

With no bank connection, transactions arrive by hand or by CSV import from your bank’s own export. Concretely:

it takes a few minutes a week, or one file a month;
nothing appears on its own, there is no “you just spent €12” notification;
reconciling against the real account balance is something you do, not something that is simply true.

For many people that is a dealbreaker, and it is an entirely reasonable trade. For others, the manual entry is exactly what makes budgeting work — you do not spend the same way when you have to write the expense down.

What we refuse to do is pretend either option is free. Both models have a cost: one is paid in exposure, the other in minutes.