Privacy policy

Last updated: October 31, 2026

MCP Server for YNAB is a private server for its owner's personal use. Only YNAB accounts on the owner's allowlist can sign in.

What it does with your data

When an AI assistant you connected makes a request, the server fetches the relevant YNAB data and returns it to that assistant, or changes the category and approval status of the transactions it names. Your YNAB authorization grants full access to your plan, but the server only offers those actions. Your data is used only for this purpose, and is not sold, or shared with anyone else. Your assistant's provider handles what it receives under its own terms.

What is stored

YNAB budget data passes through the server and is not stored. The server stores your YNAB user id and your YNAB OAuth tokens, encrypted, along with hashed credentials for connected assistants. It never sees your YNAB password.

Security and hosting

The server runs on Cloudflare Workers, and its stored data is held in Cloudflare Workers KV. All connections use HTTPS.

Retention and deletion

Stored tokens expire within 30 days of signing in. To delete your data sooner, revoke this app's access in your YNAB account settings. The server deletes its stored connection the next time it finds that access is revoked.