Money Map — Privacy Policy
Money Map is a personal financial planner built to work entirely in your browser. Because the numbers you put in are about as private as data gets, this page explains exactly what exists, where it goes, and who can see it.
What Money Map Stores
Only what you put in: budget figures, account balances, savings goals, retirement and compensation figures — including what you plan to spend in retirement and any income you expect then — vacation costs, PTO plans, donations, holdings and any property values or cost bases you record, what you still owe on any debt you record and the rate and payment behind it, any exchange rates you type, any tax brackets you enter on the Tax tab, who each trip line and its parts was paid to, and any notes; plus your preferences (theme, which tab was open, and which boxes you folded up). It also keeps a few dates for the month-end checklist: the day you last downloaded a backup or each year's CSV, and the day each holding, retirement account and property value last changed or was marked as checked. These are synced and kept in a backup like the rest, and are never put in a share link. A net-worth snapshot you press Record on stores the figures the card was showing at that moment — a computed number you chose to keep, which is why "put in" rather than "type in". There is no account, profile, or usage tracking required to use the app. The calculator's tape — figures you picked off the page and where each came from, with where the window sits — is kept in this browser only, under its own key: it is never synced, never in a backup or a share link, and Delete Everything clears it. A link you save for a property's value page is kept the same way — in this browser only, under its own key, never synced, never in a backup or a share link, and cleared by Delete Everything.
The tax brackets are worth naming separately, because they are the one thing here that is about tax: they are a table you type, stored and synced exactly like every other figure above, along with the taxable share you give each retirement income row and any income you type into the tab's calculator. The app ships no brackets of its own, looks none up, and sends nothing anywhere to work tax out — it is arithmetic done in your browser over numbers you entered, and pasting a schedule in parses it on the spot without it leaving the page. Nothing here is a tax return, an assessment, or a figure you have paid.
Where That Data Lives
In your browser (always). Everything is stored in your browser's local storage on your own device. This is the only copy that exists unless you sign in to sync. (Signed in, the browser also keeps the copy it last synced, beside the plan, so changes made on two devices can be combined rather than one replacing the other. It never leaves the browser, and "Delete all data" deletes it too.) Clearing the site's browser data — or the app's own "Delete all data" button — deletes it. If you fill in the Household tab, "everything" includes the names, roles and birth months of the people you add, your children among them — so the same care you would take over the figures applies to a backup file or a screenshot.
A copy of the app itself, so it opens offline. The page, its stylesheet, its chart library and its icons are kept on your device — the same public files anyone can read on GitHub, and nothing else. Your plan is never put there, nor is anything fetched from sync or from the price lookup. Clearing the site's browser data removes it along with everything else.
Google sign-in / Firestore (optional, off until you choose it). If you tap "Sign in to sync", your data is stored in a Firebase/Firestore database operated by the developer so the same figures can appear on your other devices, and Firebase Authentication records your Google account's email address and display name. Access rules restrict every account to its own data — other signed-in users cannot read yours, and the developer does not look at it. This only happens if you sign in; the app never does it on its own. "Delete all data" while signed in empties the synced copy as well as this browser's: the document is left holding a blank plan — no figure, no name, no birth month — and your other devices are asked whether to clear themselves too. The empty document itself, and the Firebase Authentication record of your email address and display name, remain until you ask for them to be removed (see Your choices below). What is synced is the whole plan as one document, so if you have filled in the Household tab that includes your family members' names and birth months, including any children's.
Holding price lookups (optional, off until you add a key). If you enter a Twelve Data API key in Preferences, the Investments tab can fetch current prices for the tickers you have recorded (any holding whose price lookup you have left switched on). Only the ticker symbol and your own key are sent to api.twelvedata.com — never a balance, a share count, or anything else about you. The key is kept in this browser only: it is deliberately not part of your synced data and not part of an exported backup, so you enter it once per device. The box is a password box, so your browser or password manager may offer to remember the key and carry it to your other devices — that copy is theirs, kept and synced under their protection, and this app neither sees it nor sends it anywhere. Fetched prices are cached for six hours and remain editable by hand.
On the Progress tab, reading Net Worth at the last month you marked entered also looks up what those same tickers closed at on that month's last trading day. That request carries the ticker, the month's last date and your key — nothing else. The closing prices are kept with your plan like the cache below (so they sync and are in a backup, and are never in a share link), and are looked up once per ticker per month.
That six-hour cache — the ticker, the price fetched for it and the time it was fetched — is part of your plan, so if you are signed in to sync it reaches your other devices along with everything else, and it is included in an exported backup. That is deliberate: it is what stops a second device deciding a price is out of date and fetching it all over again minutes after the first one did. It is never included in a read-only share link. Delete the key in Preferences to switch lookups off; "Delete all data" removes the key and the cached prices along with everything else.
This used to use Alpha Vantage. Nothing about what leaves your browser has changed — still the ticker and your key, and nothing else — but the address it goes to has, and alphavantage.co is no longer contacted at all. Any Alpha Vantage key you had saved is deleted from this browser the next time the app opens, since nothing can use it any more.
Looking up what a property is worth (a link, not a request). Each property in the Household tab offers a link to a valuation site — Redfin or Zillow for a home, Kelley Blue Book or Edmunds for a vehicle, J.D. Power for a boat. The app fetches nothing and sends nothing on its own: these are ordinary links, and nothing happens until you press one, at which point your browser goes to that site exactly as it would if you had typed the address in yourself. Those sites are not ours and have privacy policies of their own.
A property may also carry a value page link that you paste in yourself — the page for your own house or car on one of those sites — so the button goes straight there instead of to a search page. It is kept in this browser only. It is deliberately not part of your synced data, not part of an exported backup and not part of a share link, so somebody you send a link to never receives it. The box is a password box, so your browser or password manager may offer to remember it and carry it to your other devices — that copy is theirs, kept and synced under their protection, and this app neither sees it nor sends it anywhere.
Share links (nothing is uploaded). The Share button builds a read-only link that carries the figures inside the link itself, compressed into the part of a web address that is never sent to any server. Creating one and opening one both involve no upload, no account, and no storage on the reader's device — and opening one never touches whatever that reader already had saved in their own browser. You pick which tabs go in and how many years go with them; people's names are replaced with "Adult 1" and "Child 1" unless you tick the box to include them, and your written notes and the years you have built ahead are left out unless you ask for them. Anyone who has the link can read everything inside it and there is no way to withdraw one, so treat a link like the figures it contains.
What Money Map Does Not Do
- No analytics or usage-tracking scripts
- No advertising or ad networks
- No selling or sharing data with third parties
- Sharing the app's plain address shares only the app — your numbers travel only in a share link you deliberately create
When Google’s Code Loads
Only when you ask for it. Nothing of Google’s is fetched on an
ordinary visit: open Money Map, use it, close it, and your browser never speaks to Google at
all. The Firebase and sign-in scripts are downloaded from www.gstatic.com and
accounts.google.com the moment you reach for the “Sign in to sync”
button — when your pointer arrives on it, when you tab to it, or when you press it
— and not before.
There is one exception, and it is the only way this can work: if you are already signed in on this device, the app has to load Firebase as the page opens, because asking Firebase whether your session is still good is the only way to find out. It knows to do that from a note it keeps in your own browser, written every time your sign-in state changes — so signing out stops the requests too, not just the syncing. A browser that has signed in at some point but has no such note yet gets one page load that asks, once, and then settles.
When those requests do happen they tell Google your IP address, your browser’s user-agent and which page asked — the ordinary information any request to any server carries. None of your figures goes with them, and nothing is stored or synced until you sign in. Until August 22, 2026 this code loaded on every visit; the page said otherwise, which was wrong, and the app was changed rather than the sentence softened.
Your Choices
You can edit or delete anything in the app at any time, and export a full backup from the Back up dialog. Signing out stops all syncing and leaves the local copy in charge. "Delete all data" while signed in empties the synced copy of everything it held. To have the document itself, and the Firebase Authentication record of your email address and display name, deleted from the developer's Firebase project, email eagleadams86@gmail.com and they will be removed.
Changes to This Policy
If this policy changes, the updated version will be posted here with a new effective date.