U.S. State Privacy Notice

Last Modified: April 9, 2026
Effective: April 20, 2026

Summary

This U.S. State Privacy Notice (the “Notice”) supplements our Privacy Policy and provides additional information for residents of states with comprehensive consumer privacy laws. YNAB voluntarily extends the privacy rights described in this Notice to residents of the following states, regardless of whether YNAB meets the statutory thresholds for applicability under each state’s privacy law. 

This Notice applies to residents of the following states:

• California (California Consumer Privacy Act/California Privacy Rights Act) 
• Colorado (Colorado Privacy Act) 
• Connecticut (Connecticut Data Privacy Act) 
• Delaware (Delaware Personal Data Privacy Act)
• Indiana (Indiana Consumer Data Protection Act)
• Iowa (Iowa Consumer Data Protection Act)
• Kentucky (Kentucky Consumer Data Protection Act)
• Maryland (Maryland Online Data Privacy Act) 
• Minnesota (Minnesota Consumer Data Privacy Act) 
• Montana (Montana Consumer Data Privacy Act) •
• Nebraska (Nebraska Data Privacy Act)
• New Hampshire (New Hampshire Privacy Act)
• New Jersey (New Jersey Data Privacy Act) 
• Oregon (Oregon Consumer Privacy Act)
• Rhode Island (Rhode Island Data Transparency and Privacy Protection Act)
• Tennessee (Tennessee Information Protection Act)
• Texas (Texas Data Privacy and Security Act) 
• Utah (Utah Consumer Privacy Act)
• Virginia (Virginia Consumer Data Protection Act)

YNAB monitors state privacy legislation on an ongoing basis. If additional states enact comprehensive privacy laws with similar consumer rights provisions after the effective date of this Notice, we will extend comparable rights to residents of those states on the same voluntary basis described herein (regardless of whether YNAB meets applicable thresholds), even if this Notice has not yet been updated to expressly list that state. We update this Notice periodically to reflect changes in applicable law.

If you are a resident of one of these states, you may have specific rights regarding your personal information as described below. YNAB extends the privacy rights described in this Notice to residents of the states listed above on a voluntary basis. This Notice does not constitute an admission or representation that YNAB meets the statutory thresholds (such as revenue, data volume, or consumer thresholds) that would make any particular state's privacy law applicable to our business. We provide these disclosures and rights to support transparency and user choice.

Your Privacy Rights

Depending on your state of residence, you may have the following rights regarding your personal information:

• Right to Know/Access: You may request that we disclose what personal information we have collected about you, including the categories of personal information, the sources from which it was collected, the purposes for collection, and the categories of third parties with whom we share it. 
• Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions permitted by law. 
• Right to Correct: You may request that we correct inaccurate personal information we maintain about you. 
• Right to Portability: You may request a copy of your personal information in a portable, readily usable format. 
• Right to Opt Out of “Sale”: You may opt out of the “sale” of your personal information as the term “sale” defined under applicable state law. We want to explicitly call out – as we have said repeatedly in our policies - we do not sell your information to anyone in the traditional sense of the word (that is, in exchange for money), but certain laws use the word “sale” to describe how certain information is shared even if money is not exchanged. 
• Right to Opt Out of Targeted Advertising. You may opt out of the processing of your personal information for targeted advertising purposes. Under California law, this is referred to as opting out of "sharing" for cross-context behavioral advertising. 
• Right to Opt Out of Profiling: You may opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. We want to be clear – YNAB does not engage in profiling that produces legal or similarly significant effects. 
• Right to Appeal: If we decline to take action on your privacy request, you may appeal that decision by contacting us at privacy@ynab.com with the subject line “Privacy Rights Appeal.” We will respond to your appeal within the timeframe required by applicable law (typically 45-60 days). If your appeal is denied, you may have the right to contact your state’s Attorney General to submit a complaint. We will provide you with the appropriate contact information if we deny your appeal. 

To exercise any of these rights, please submit a request through our Data Subject Rights Request Form or contact us at privacy@ynab.com.

Categories of Personal Information Collected

We collect the following categories of personal information from consumers. This table reflects our current collection practices and our collection practices during the preceding 12 months from the effective date of this Notice Our collection practices are also further described in the “Collection and Use of Personal Information” section of the Privacy Policy. We have made the following disclosures of that information for the purposes described in the “Disclosure of Personal Information” section of the Privacy Policy:

Sale and Sharing of Personal Information; Opt Out Information.

As described in our Cookie Policy, we have incorporated cookies and similar technology from certain third parties into our Services to provide you with more relevant and tailored ads regarding our services and to analyze the performance of our ads and the types of consumers who see and interact with them. We may also share certain identifiers, like a hashed email address, with third-party platforms so that those platforms can display YNAB ads to interested audiences. These technologies allow us and our partners to serve tailored YNAB ads on other platforms, and to limit how often we show ads to consumers who have already subscribed to YNAB.  

Although these advertising activities are a common way for companies like YNAB to promote their products and services, California law categorizes these activities as “selling” personal information or “sharing” personal information for cross-context behavioral advertising – even though we never provide information in exchange for money. 

We want to be clear that we do not under any circumstances “sell” the information you provide through the Product or “share” it for cross-context behavioral advertising purposes, including Financial Data.

Nevertheless, our online advertising activities targeting prospective YNAB users may be considered to be a “sale” and/or “sharing/processing” for targeted advertising purposes under the broad definitions of those terms in state privacy laws. These laws require us to make certain disclosures about these activities, which we provide below.

Over the last 12 months we have “shared” or “sold” Internet or other electronic activity information (e.g., web analytics data and device/IP data) with advertising networks and marketing providers, solely for the purposes of marketing and selling of the Services and showing you advertisements, including interest-based or online behavioral advertising (retargeting).

If you would like to opt out of our online disclosure such as through cookie and pixel technology of your personal information for purposes that could be considered “sales” for those third parties' own commercial purposes, or “sharing” for purposes of targeted advertising, please fill out the Data Subject Rights Request Form or select “Your Privacy Choices” in the Services, and follow the instructions. You must make this choice on each site/app on each browser/device you use to access the Services. You must also renew this choice if you clear your cookies or your browser is set to do that. 

You can also submit a request to opt out of the use of your email address and other personal information related to that email address for targeted advertising purposes and to the disclosure of such information to our marketing and business partners by filling out the Opt Out Request Form. Depending on your jurisdiction, you may be permitted to designate an authorized agent to submit such requests on your behalf. 

Universal Opt-Out Mechanisms

We honor legally-recognized universal opt-out preference signals, including the Global Privacy Control (GPC). If you have GPC or another legally-recognized opt-out preference signal enabled on your browser, we will treat that signal as a valid request to opt out of the sharing of your personal information and targeted advertising for that browser and device. This applies to residents of California, Colorado, Connecticut, and other states that require recognition of such signals. 

You can learn more about GPC at https://globalprivacycontrol.org. 

Processing of Sensitive Personal Information

California Residents: In certain circumstances, the CCPA/CPRA allows consumers to request that businesses limit their use of certain sensitive personal information. 

• To provide core functionality you request: We may collect precise location data when you use location services to record a transaction. We use this information solely to help the Services remember the location where you recorded a transaction, so that the Services may suggest that payee when you record another transaction near that same location in the future. Because this use is necessary to provide the Services you expect and have requested, there is no right to limit this use under California law. You can disable precise location tracking on your device at any time through your device's operating system settings.
• With your consent for optional features: We may collect precise location data in connection with optional features, such as from metadata embedded in content you upload. You control this collection, if any, through your consent, and you can withdraw consent at any time through your device settings or discontinuing the use of the optional feature. 

Other State Residents: Under the laws of certain other states (including, without limitation, Virginia, Colorado, and Connecticut), “sensitive personal information” includes precise geolocation data. 

• To provide core functionality you request: As stated above, we may collect precise location data when you use location services to record a transaction, and we use this information so that the Services may suggest that payee when you record another transaction near the same location in the future. You can disable precise location tracking on your device at any time through your device’s settings. If you disable location services, YNAB will not collect this data, and you will still be able to use other features of the Services. 
• With your consent for optional features: We may collect precise location data in connection with optional features, such as from metadata embedded in content you upload. You control this collection through your consent, and you can withdraw consent at any time through your device settings or discontinuing the use of the optional feature. 

We do not otherwise intentionally collect sensitive personal information as defined under state privacy laws, including data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data, or personal information of known children.

Other State Rights and Information

Please see the “Your Rights and Choices” section of the Privacy Policy for information about the additional rights you have with respect to your personal information under state laws and how to exercise them.

Please see the “Data Retention” section of the Privacy Policy.

Connecticut DPA

The Connecticut Data Privacy Act requires us to disclose whether the processing of your data involves profiling for legal or similarly significant decisions, and we confirm that we do not process your data to profile for legal or other similarly significant decisions. Further, the CTDPA also requires us to disclose whether we collect, use, or sell personal data for the purpose of training large language models, and we confirm that we do not use or share data in this way (and as stated elsewhere in our policies, we reaffirm that we would never sell our customers’ data under any circumstances). 

“Shine the Light” Disclosure

The California “Shine the Light” law gives residents of California the right under certain circumstances to opt out of the sharing of certain categories of personal information (as defined in the Shine the Light law) with third parties for their direct marketing purposes. We do not share your personal information with third parties for their own direct marketing purposes within the meaning of that law.

Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights. Unless permitted by applicable law, we will not:

• Deny you goods or services;
• Charge you different prices or rates for goods or services;
• Provide you a different level or quality of goods or services; or
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Authorized Agents

Depending on your state of residence, you may designate an authorized agent to submit privacy requests on your behalf. To do so, you must provide the authorized agent with written permission to act on your behalf, and we may require you to verify your identity directly with us and confirm that you provided the authorized agent permission to submit the request.

Contact Us

If you have questions about this Notice or wish to exercise your privacy rights, please contact us at privacy@ynab.com.