How Monsave handles your data
In plain language: what we receive, what we cannot do and where the limits are. We only write what matches our code.
What data Monsave receives
Email, nickname, language and time zone; your accounts, transactions, categories and notes. If you connect Monobank: account names, currency, balance, IBAN, masked card number and statement items. For security we keep the IP address, browser and sign-in time.
What Monsave does not receive
We do not ask for or store bank passwords, PINs, CVV/CVC codes, full card numbers, card expiry dates, passport numbers or tax IDs.
Can the service make payments
No. The Monobank integration reads accounts and statements and does not call payment functions. The Monsave code has no operations that debit or transfer money.
How the Monobank connection works
You confirm the request in the bank app. The Monsave database stores the identifier of that permission, without separate encryption. The identifier alone is not enough: every request to the bank is signed with the service private key, which is configured separately from the database.
Encryption
Traffic between your browser and the service is protected by TLS. Passwords are stored only as a PBKDF2 hash with an individual salt, so we do not know them. Financial records are not encrypted separately per user, and we do not promise end-to-end encryption.
Who can access the data
Your data is visible to you and to the people you gave access to. The application works with the database through controlled functions rather than direct table queries. A technical administrator with database access can technically see records, because they are not encrypted with a per-user key.
Logs and backups
You can see your sign-in history in the security settings, where two-factor authentication is also enabled. The service keeps technical logs for stability and abuse protection. Operational backups exist to recover from failures, and data may stay in them for some time after deletion.
Disconnecting and deleting
You can disconnect Monobank in the settings: Monsave removes its connection identifiers, and the permission on the bank side is revoked through the bank. You can delete your account in the settings along with its accounts, transactions and categories.
External providers
Monobank, if you connected it. Telegram, if you use the bot. Google: Analytics after your consent, Google sign-in and receipt recognition in the bot. Microsoft: Microsoft sign-in. And the hosting provider the service runs on. hCaptcha checks the signup, password reset and confirmation email forms for bots.
Why Monsave is free
All features are currently free. A paid plan with extra features may appear in the future. Selling your data is not our business model: balances and transactions are not passed to advertising networks or brokers.
Rules and contact
We follow the principles of GDPR and the Law of Ukraine on Personal Data Protection. To report a vulnerability or ask about your data, write to support@monsave.com.