Ten Signs a Finance App Sells Your Data — And How to Check Yourself
Every finance app puts "privacy-first" on its homepage. The reality often runs differently. Below are ten concrete signs you can verify yourself — in your browser, on their website, in the privacy policy — that tell you whether an app is monetising your data without saying so out loud.
This checklist works on any finance app. Including Okidoky (and we explain where we stand on each point).
1. The privacy policy contains the words "aggregated", "anonymized" or "pseudonymized"
What to look for: sentences like "we share aggregated and anonymized data with partners".
Why it matters: "Anonymized" sounds harmless but in practice often means your hashed transaction patterns get sold to data brokers. Research repeatedly shows "anonymized" data can often be re-identified given enough dimensions (location + time + amounts).
Okidoky: not applicable — we don't aggregate anything, anonymized or otherwise. Our privacy policy deliberately doesn't contain these words.
2. The free plan has no sensible limit
What to look for: apps with fully unlimited free tier AND no ads.
Why it matters: servers cost money. If neither you nor an advertiser is paying, a third party is paying for your presence — usually by buying your data.
Okidoky: our free tier has clear limits (50 transactions per month, 2 receipt uploads per month, 3-month history visibility) plus limited non-intrusive ads. That combination costs us less than data sales would yield.
3. The privacy policy mentions a data-aggregator partnership
What to look for: names like Tink, Plaid, Yapily, Nordigen, Finicity, Budget Insight, MX in the privacy policy.
Why it matters: if the app offers bank connection via an aggregator, your data passes through the aggregator first — and most aggregators have broader data rights than the app itself. Read the aggregator's policy, not just the app's.
Okidoky: not applicable — we don't have a bank connection and therefore no aggregator. Transactions come in via CSV upload, which stays within our own domain.
4. There's an ad SDK or analytics SDK on logged-in pages
What to check: download the mobile app and use a network inspector (e.g. mitmproxy or Charles). Look which domains are called. For web apps: open F12 → Network tab and log in — which third-party domains do you see?
Why it matters: Firebase Analytics, Mixpanel, Amplitude, Segment or Facebook Pixel on logged-in pages means your behaviour is being tracked — often with transaction categories in the event payload.
Okidoky: open devtools on the dashboard (after login with a paid license). You'll see requests to okidoky.nl plus the normal stateless CDNs for fonts (fonts.googleapis.com, fonts.gstatic.com) and icons (cdn.jsdelivr.net). No Google Analytics, no Mixpanel, no Segment. On free-tier pages pagead2.googlesyndication.com also loads for AdSense — that's our documented revenue source for free accounts, not sneaky data sales. On public marketing pages GA4 loads too (consent-gated, default denied) plus AdSense. The distinction between these groups: CDNs are stateless (no cookies/tracking), analytics and ads do track — and we name exactly which we use and where.
5. The app requests permissions that aren't needed for its function
What to check: for mobile apps — are permissions like "contacts access", "GPS location" or "scan nearby devices" listed in app permissions?
Why it matters: a budget app doesn't need contacts. GPS only makes sense if the app has a "nearby ATM" feature, which a ledger doesn't need. Extra permissions = extra data points to process or resell.
Okidoky: we're a web app; there are no app-level permissions to request. The PWA only requests notification permission if you explicitly opt in.
6. There's no public sub-processors list
What to look for: a URL with a list of every third party that touches your data (hosting, mail relay, analytics, payments). Sometimes called "data processors" or "vendors".
Why it matters: GDPR requires transparency about sub-processors for B2B customers but is laxer for consumers. An app that doesn't publish its sub-processors either has something to hide or has immature governance.
Okidoky: /sub-verwerkers has an exhaustive list per category: infrastructure (Hetzner, Plesk, Cloudflare), payments (Mollie), communication (SMTP via Plesk), analytics (GA4 — consent-gated) and advertising for free-tier (Google AdSense — consent-gated). Each with reason, location and DPA.
7. The exit path is harder than the entry
What to check: how easy is sign-up vs. how easy is account deletion? Do you have to call to cancel? Is there a "hidden" delete button?
Why it matters: apps with data-sale as business model want to retain users, even passively. Hard to leave = longer data pipeline.
Okidoky: honest note — deletion goes via email to info@okidoky.nl with a 48-hour SLA. A self-service button is on the roadmap, not yet built. That's ~5 extra minutes we keep deliberately to prevent misuse, not to force retention.
8. The "free month" requires a credit card
What to look for: during sign-up you're asked for a payment method even for "14 days free".
Why it matters: credit-card-at-signup is a classic dark pattern. The goal is that you forget to cancel and keep paying. Another signal: you're paying with data or credit-card fees during the "free" period.
Okidoky: no credit card at registration. You get 14 days of Premium trial automatically; after that your account drops to free — without us ever having held your payment details.
9. The app shows "sentiment" about your spending
What to look for: messages like "we see you're spending more than usual" or "you had a good month". Sounds friendly, requires machine analysis of your patterns.
Why it matters: these insights are typically generated by an LLM or statistical model running on a central server with visibility across all users. That model trains on your data, even when it gives insights back to you.
Okidoky: no sentiment analysis, no "you did well this month" notifications, no AI coach. Our forecasts use standard statistics (3-6 month averages, seasonal patterns) — not a model trained on user data. More on this in What Okidoky Learns From Your Data.
10. The privacy policy changes silently
What to check: look at the Wayback Machine for their privacy policy URL. Do you see changes in the last 6 months? Were users explicitly emailed about it?
Why it matters: privacy policies that quietly broaden ("we can now also share with marketing partners") are a classic pattern when apps shift from freemium to data monetisation. Good apps send an email for every material change, with explicit opt-in for new data processing.
Okidoky: for every material change you get a dated email. The privacy policy version is visible at the bottom of the page. Wayback Machine history is public.
The two-minute test
If you don't have time to go through every point, run this quick check:
- Open F12 → Network tab in your browser
- Log in to the app
- Open the dashboard / overview (inside the logged-in area)
- Look at which domains get hit
If, inside the logged-in area, you also see analytics.google.com, googletagmanager.com, segment.io, mixpanel.com, firebase.google.com or similar — you're probably being tracked inside the app experience itself. That's a much clearer signal than any analytics on public marketing pages (where it's common and usually consent-gated).
On Okidoky inside the logged-in area (paid account) you see: okidoky.nl + stateless CDNs for fonts/icons (Google Fonts, jsDelivr) + mollie.com during purchase. On a free-tier account you additionally see pagead2.googlesyndication.com (AdSense — the documented revenue source that carries free accounts). On public marketing pages GA4 also loads via Google Tag Manager (Consent Mode v2 — default denied, so nothing is stored without your consent). No Mixpanel, Segment or Amplitude. No analytics SDKs in the logged-in app of paid users. That distinction — and that we openly name every domain — is exactly the point.
This checklist is free to reuse. Run it on three apps you're considering and pick the one with the cleanest score — that's usually the best long-term choice. Okidoky — try free, no credit card.