Updated 27 October 2026

DayPilot uses your information to run your private household space: budgets, bills, transactions and any extra features you choose. This page explains the application's data flows and controls.

Your information and how it is used

Google sign-in supplies your account identity, including your email and name, so DayPilot can recognize you and check access. DayPilot does not ask for your Google password. Invitations use the recipient's email address to create a private account and send a sign-in link.

Financial information includes accounts, balances, transactions, categories, budgets, bills, notes and matching decisions you enter or import. A bank connection through TrueLayer also needs authorization tokens to refresh data. If enabled, other modules store the household, planning, meal, health or vehicle information you provide.

Preferences, access permissions, feature settings and operational logs support the service and troubleshooting. Avoid entering information you do not need to store, especially in free-text fields.

Application administrators can view aggregate access metrics: hourly request counts, country codes when a local country database is installed, security decisions, HTTP error counts, average request duration and sign-in event counts. These metrics do not store IP addresses, email addresses, request URLs or financial records. Country lookups use connection information locally, without an external geolocation service. Aggregate metrics are automatically removed after the 30-day reporting window; this is separate from operational logs and hosting-provider records.

Who can see your household

Invited application users start as ordinary users with a separate household. An application administrator does not receive access to your accounts or transactions through that role. Administrators can manage application accounts and see selected troubleshooting settings, such as currency, time zone, feature switches and permissions.

A household owner must explicitly share access before someone else can use its financial data. Owners and household admins have broad household access; members and viewers follow their role and module permissions. Review or remove access under Household members. These application controls do not prevent authorized hosting or database operators from having technical access needed to operate the service.

AI: your choices and what is sent

New households have AI insights and bill-matching suggestions enabled, but they run only when an authorized member requests them. Opening a page or enabling this switch does not send financial data to AI. Existing households keep their saved settings. An owner can turn AI off under Household features.

Spending insights send app-calculated totals and comparisons, with redacted merchant and category labels. DayPilot calculates the figures; AI selects highlights. It does not calculate balances or give financial advice.

Bill matching sends a limited set of payment amounts, currencies and dates, plus redacted merchant, category and budgeted-bill labels and amounts. Suggestions do not change matches until you accept them. You can choose a different bill before saving.

Category suggestions are off for new households until an owner enables them. Once enabled, bank and card sync may automatically categorize eligible new payments. Category review and backlog processing can also be requested manually. These requests send redacted merchant labels, amounts, currencies and category names.

Chat with confirmed actions uses the AI insights switch. Sending a question sends its text, up to eight recent messages, selected date ranges and authorized app-calculated spending and unpaid-bill highlights, eligible budget choices and category names to the configured AI service. Text you enter is not automatically redacted; do not enter passwords, bank credentials or other secrets. Chat can preview bill creation, an empty budget or reconciliation. A separate Confirm and save button is required before any financial change; typing yes is not confirmation. Permissions are checked again when saving. Confirmed records and minimal duplicate-submit receipts are retained, but DayPilot does not store a chat transcript; navigating away or clearing chat removes this page's conversation. AI answers can be wrong; check the displayed source figures.

Apart from text you enter in chat, these AI requests do not include raw transaction descriptions, notes, payment references, bank credentials or account details. Redaction reduces identifying text but cannot guarantee anonymity: merchant names and custom categories or bill names may still identify a person. AI can be wrong. Check the suggested category or match before accepting it.

DayPilot sends requests to its configured Azure OpenAI service over HTTPS. Accepting or correcting a category saves a household merchant rule, not model training. Microsoft states that Azure-hosted prompts and outputs are not used to train foundation models without permission, but service safety and abuse-monitoring processing can apply. Processing location depends on the deployment configuration; no particular region or zero-retention guarantee is made here.

Microsoft's Azure AI data and privacy documentation

Category and insight responses may be cached in application memory for six hours. Daily AI request counts are stored without prompts. Category-run bookmarks are kept in this browser tab for up to seven days; review confirmations expire after one hour. Accepted categories, matches and merchant rules remain as household records until changed or deleted. Turning AI off stops future requests, not previously saved changes.

Service providers and browser storage

The hosted service uses Microsoft Azure for application hosting, database storage and AI. Google handles sign-in, Gmail SMTP handles invitations in the configured deployment, and TrueLayer handles bank connections you authorize. Each provider processes the data needed for its part of the service under its own terms. Local or self-hosted deployments may use different database or email providers.

Sign-in and security cookies keep your session working. Browser storage also keeps display preferences and optional AI-run progress. Fonts, icons and scripts loaded from external providers can expose normal connection information, such as your IP address, to those providers.

Keeping, correcting and deleting information

DayPilot keeps household records so budgets, history and sharing continue to work. You can correct or delete records using the controls available to your role. Disabling an account or disconnecting a bank is not the same as deleting stored history.

For access, export, account deletion, privacy questions or a concern about sharing, contact the DayPilot administrator who invited you. They can identify the service operator and arrange the appropriate request. Ask them about the hosting location and applicable retention periods for backups, logs and provider records; deletion from the live application does not itself establish when those separate copies expire.