Your data

366.money is developed independently, and this page describes exactly what it keeps about you. Last updated 15 October 2026.

What is stored

Your email address — it identifies the account. It is used to sign you in and to send you emails about the account: the link that confirms your address and the link that resets your password. Nothing else is sent to it — no newsletters, no marketing.
Whether and when you confirmed that address.
Your name, if you enter one — the field is optional and is not shown anywhere in the interface.
Your password as a bcrypt hash, if you have a password. The password itself is never written down and cannot be recovered from the hash. If you only sign in with Google, there is no password at all.
Your screen-lock PIN as a hash, if you set one. A copy of this hash is also kept in your browser, so the app can be unlocked without a connection. Removing the PIN erases both.
If you sign in with Google: the permanent account number Google gives 366.money for you, so that you can sign in even after changing your email address at Google. Google also tells us your email address and name; the address is used as described above, the name is not stored. 366.money never sees your Google password and gets no access to your mail, contacts, files or anything else in your Google account.
Everything you record: assets, balances, currencies, expenses, income, transfers, categories and the dates you give them.
Sign-in sessions: one record per device you are signed in on, holding a hash of the session key and when it was issued.
Emails sent to you: which email it was, the address it went to, when, and its number at the delivery service — so that a lost email can be traced. The one-time link inside is erased from this record as soon as the email has been sent; the links themselves are kept only as hashes, together with when they expire and whether they were used.

Nothing else is collected. There is no profiling, no location tracking and no attempt to link you to activity elsewhere.

Cookies

The site sets one cookie, and it is required for signing in. There are no advertising or analytics cookies, which is why you are not asked to consent to any. The one exception comes from Google: see who else sees it.

Name: rt — your session key
Lifetime: 30 days, refreshed while you keep using the app
Protection: Not readable by scripts, sent over HTTPS only, and only to the sign-in endpoint — not with ordinary requests

Your browser also keeps a few values locally to make the interface behave sensibly: your user id and email address for display, drafts of forms you have not submitted and, if you use a PIN, its hash and when the app was last left. These never leave your device and are cleared when you sign out. How soon the app locks is kept on the device too, as a choice of that device.

Where it lives

In a PostgreSQL database on a server rented from Amazon Web Services, reachable only by the application itself. Records carried over from the earlier version of 366.money remain in the old database, which is kept read-only and is never written to again.

Who else sees it

Your records — assets, balances, operations — are seen by no one else. They are not sold, rented, shared or handed to advertisers, and there is no analytics provider receiving a copy. Two services see a small part of what is described above, and only for one job each:

Resend delivers the emails 366.money sends. It receives your address and the text of the email — a confirmation or password-reset link — and nothing about your finances.
Google, if you use Sign in with Google. Google then knows that you signed in to 366.money, as with any site that offers this button. The sign-in form loads Google's script to show the button, and that script can set Google's own cookies; it is loaded only while the sign-in form is open, not on the rest of the site and not inside the app. What Google does with this is covered by Google's privacy policy.

Apart from that one script, the site loads no third-party scripts and no external fonts, so opening it does not announce your visit to anybody else. Exchange rates are fetched by the server, not by your browser.

Text you type yourself

Some fields take any text you like: the names of your assets and categories, notes on operations, your name. 366.money does not check what you write there and cannot tell what it means. Please do not put anything sensitive in these fields — card numbers, passwords, bank sign-in details, document numbers, health information or anything else you would not want another service to see. 366.money is not responsible for sensitive information you choose to enter into them.

This matters more once the planned paid features built on AI appear: voice input, reading operations from receipts, screenshots and bank statements, and analysis of your spending. To work, they will send what they need — the recording, the image or file, your operations together with the text in them — to an AI provider to be processed. None of these features exist yet. Before they launch, this page will name the provider and say what it receives and how long it keeps it.

How long it is kept

For as long as your account exists. Assets you delete inside the app are marked hidden rather than erased at once, so an accidental deletion can be undone. Some records are removed on their own:

Links in emails stop working after 24 hours (confirming your address) or 1 hour (resetting your password), and each works only once. The records of them are deleted a week after they expire.
Sign-in sessions are deleted once they expire, 30 days after you last used the app on that device.
The record of an email sent to you is deleted after 90 days.

Having it erased

Write to anton.blagoveshchenskiy@gmail.com from the address your account uses and ask for it to be deleted. Your user and every record attached to it will be erased. You can also ask for a copy of what is stored about you. If you signed in with Google, you can also remove 366.money from the list of connected apps in your Google account.

Security

Traffic runs over HTTPS. Passwords are hashed with bcrypt. Access tokens expire after fifteen minutes and are held in the memory of the browser tab, never in storage a script can read. Session keys are stored on the server only as hashes, so even a copy of the database would not let anyone sign in as you. The same goes for links in emails: only their hashes are stored. Signing out on one device can also end sessions on all the others, and changing or resetting your password always does.

The screen-lock PIN only guards an app that is already open — it stops someone who picks up your unlocked phone. A PIN of four to six digits is short, so its hash is not treated as a secret: after five wrong attempts the device is signed out, and a forgotten PIN is removed by signing in again with your password or Google.

366.money is an independent project. It is not a bank, holds no money and is not a licensed financial service — please keep that in mind when deciding what to record in it.

Changes to this page

If what is stored ever changes, this page changes with it, and the date at the top is updated.