Privacy

Last updated 23 August 2026

bb2 is a monthly budget planner operated in Australia by [legal operator name] (we, us or our). This policy explains how bb2 handles personal information. We use the Australian Privacy Principles as our baseline where they apply.

What we collect and why

• Account information: your name, email address, email verification status, accepted Terms version, password hash and account timestamps. We use this to create and protect your account and send account emails.
• Session and security information: session identifiers and expiry, IP address and browser user agent. We use this to keep you signed in, secure the service and limit abuse.
• Financial information you enter: budget months, entry labels, amounts, frequencies and categories, actual amounts, net worth items and goals. We use this only to provide the planner and its backup and restore features.
• Technical information: IP addresses and request metadata in server logs, plus error details and technical context sent to Sentry. We use this to operate, secure and troubleshoot bb2.

We collect information when you enter it in bb2 and automatically when your browser uses the service. Your browser also stores a necessary sign-in cookie, your theme preference in local storage, and your email address temporarily in session storage while you complete verification.

What we don't do

bb2 does not connect to banks or collect banking credentials or transaction feeds. It does not use advertising, analytics or tracking cookies, and it does not sell personal information. We do not send newsletters or marketing emails.

Service providers and overseas processing

We disclose information only as needed to run bb2:

• Neon provides the managed PostgreSQL database that stores account and financial information. The current database project uses the AWS Sydney region.
• Our server provider hosts the app and its request logs on a virtual private server in Sydney.
• Resend processes the recipient email address, subject, message content and delivery metadata for account verification, password reset and email-change messages in the United States. Resend may use its listed subprocessors there.
• Sentry processes error reports for this project in the United States. Its listed service affiliates may also provide support from Austria, Canada and the Netherlands. bb2 disables Sentry collection of user details, request bodies, cookies, request and response headers, URL query parameters, database query data and stack-frame variables. Error messages or technical context may still contain incidental personal information.

We do not deliberately send your budget content to Resend or Sentry. Provider locations and subprocessors can change, so we review this policy when our providers or their terms change.

How we use and protect information

We use personal information to provide accounts and budgeting features, authenticate users, send transactional account emails, prevent abuse, troubleshoot errors and comply with applicable law. The site uses HTTPS, the app connects to the database over an encrypted connection, and passwords are stored as hashes.

If a data breach occurs, we will assess it and notify affected people and the Office of the Australian Information Commissioner where Australian law requires it.

Retention and deletion

Account and financial information remains in the live database while your account is active. Deleting your account removes the account and its associated budgets, entries, net worth records and goals from the live database. Expired sessions and verification records, server logs, Sentry reports, Resend email records and provider recovery copies may remain until routine deletion or the relevant provider retention period ends. We may retain information longer where the law requires it or where reasonably needed for security or a legal claim.

Access and correction

You can update your name, email address and financial information in the app. Account → Data → Download my data exports your budget months, entries, actual amounts, net worth records and goals. It is a financial-data backup, not a complete copy of all personal information held by bb2 or its providers.

To request access to other personal information, correction, or help with deletion, contact [support email]. We may need to verify your identity. We will respond within the period required by applicable law and explain any lawful refusal.

Age and intended users

bb2 is intended for people aged 16 and over in Australia. If we learn that an account belongs to someone younger, contact us so we can investigate and delete it where appropriate.

Complaints

If you think we have mishandled personal information, contact [support email]. We will investigate and respond within a reasonable time. If the Privacy Act applies and you are not satisfied, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes and contact

We will update the date at the top when this policy changes and give additional notice where a change materially affects how we handle personal information. Questions and privacy requests can be sent to [support email].