for-ynab privacy policy

Last Updated: 2026-10-23

What for-ynab is

for-ynab is a personal connector run by its owner. It lets the owner's own AI assistant (claude.ai) read and change the owner's YNAB data at the owner's request, through YNAB's documented API. Only YNAB accounts the owner has listed can connect.

What data is used, and why

• YNAB access and refresh tokens, to call the YNAB API for you.
• Your YNAB user id, to keep your data apart and to check that your account is allowed.
• Plan data the assistant asks for (accounts, categories, payees, months, transactions, scheduled transactions), to answer and carry out your requests.
• A log of when requests were made, to stay under YNAB's rate limit.

Where it goes

Plan data is sent only to the AI assistant that you connected, when that assistant asks for it on your behalf. It is not sold, and it is not passed to any other third party. for-ynab runs on Cloudflare Workers, which hosts the service and stores its data.

How it is stored and secured

• Tokens and cached data are kept in Cloudflare Durable Object storage, which Cloudflare encrypts at rest, in a store dedicated to your YNAB account. They are never written to logs or returned to the assistant.
• The connector's own grants are kept in Cloudflare Workers KV by the OAuth library, which stores tokens only as hashes and encrypts grant data.
• All traffic uses HTTPS.

How long it is kept

• Cached plan data is deleted after 30 days without use.
• A full plan export snapshot is deleted 10 minutes after it was made, by a scheduled cleanup at that time or by the next tool call, whichever comes first.
• Tokens are kept until you disconnect, or until YNAB reports that access was revoked, when they are deleted.
• Request log entries older than one hour are deleted at the next request.

How to delete your data

• Visit /disconnect, sign in at YNAB and confirm, and for-ynab deletes your tokens, cached data and request log and revokes its connector grants at once.
• Revoke for-ynab in YNAB under Account Settings, Developer Settings, Authorized Applications. for-ynab then deletes your tokens the next time it tries to use them.
• Requests to delete data are honored.

Changes

A change to what data is used, or how, updates this page and its Last Updated date, and asks you to agree again before the new use begins.