MCP privacy

You decide when AI access begins

MoneyCoach MCP is disabled by default. If you enable it, the AI app you connect can request read-only financial data, from your Mac or from the optional MoneyCoach Cloud copy, and may forward that data to its AI provider.

MCP is off until you give permission

MoneyCoach MCP is disabled by default. No financial data is available through MCP until you turn on Allow AI Connections and confirm the disclosure in MoneyCoach. The optional cloud copy is also off by default and needs its own opt-in.

You choose the recipient

You choose the AI app that receives requested data, such as Claude Desktop, Cursor, Codex, Gemini CLI, Ollama, ChatGPT, or Claude. The cloud copy works with ChatGPT, Claude, Gemini, Muse and Grok, and you approve each assistant on a consent screen after you sign in. MoneyCoach does not choose an assistant for you.

What connected clients can read

When you enable MCP and connect a compatible client, that client can request permitted read-only MoneyCoach data from your Mac or, if you turn on the cloud copy, from the copy, including account names and balances, transactions, categories, budgets, goals, reports, subscriptions, bills, and related financial metadata.

Your client may use a cloud AI provider

The local helper returns requested records to your chosen client. Depending on its configuration, that client may send the data off your Mac to OpenAI, Anthropic, Google, or another AI provider under that provider’s privacy, retention, and model-training rules. Assistants that read the cloud copy (ChatGPT, Claude, Gemini, Muse or Grok) work the same way once they have retrieved your data.

Two ways to connect: local or cloud

The local MCP server runs on your Mac and does not send data to MoneyCoach. The optional MoneyCoach Cloud copy is a read-only copy stored with a hosting provider in Germany, so assistants can answer without your Mac being on. It is off by default and available with Premium Max.

Read-only, logged, and deletable

Assistants can only read. They cannot create, change or delete anything, move money, or contact your bank. We log each assistant request without its content. You can delete the cloud copy and disconnect every assistant at any time.

Readable data (local MCP)

Account names, account details, and balances.
Transactions, categories, dates, amounts, and currencies.
Budget details, goal details, reports, and progress.
Active subscriptions, bills, and related financial metadata.
Payee and merchant names, transaction titles, descriptions, notes, invoice references, and purchase details when the corresponding sharing controls are enabled.

What MCP does not do

Creating transactions.
Editing or deleting MoneyCoach data.
Triggering sync.
Payments, bank transfers, or irreversible financial actions.
Remote network exposure of the local MCP server on your Mac.
Long-lived app-hosted MCP sockets.
Uploading account numbers (such as IBANs) or account owner names to the cloud copy.
Uploading attachments or photos.

MoneyCoach Cloud for AI assistants

This optional feature lets AI assistants you approve (ChatGPT, Claude, Gemini, Muse or Grok) answer questions about your finances without your Mac being on. It is off by default and available with Premium Max. Nothing is uploaded until you turn it on in Settings, then MCP & AI, and confirm the disclosure. MoneyCoach then stores a read-only copy of selected data with a hosting provider in Germany. It is encrypted in transit and at rest, and your data is kept separate from other users’ data.

What the cloud copy contains

Accounts and balances.
Transactions: amount, date, category, and account name.
Budgets and goals.
Recurring costs and bills.
Your Premium Max status and expiry date, which we take from our subscription records so the service can check your plan.
Payee and merchant names, and transaction notes such as invoice references or memo text, only if you separately switch on Share Payee & Merchant Names and Share Transaction Descriptions. Both are off by default.
Transactions imported from bank accounts you linked are part of the transactions uploaded.

Account numbers (such as IBANs), account owner names, attachments and photos never leave your device.

How long it is kept

The copy stays until you turn the feature off and delete it, delete your MoneyCoach account, or 90 days pass without activity (no upload, no sync status check and no assistant use).
If you disconnect a bank, the accounts and transactions from that connection are removed from the copy.
Encrypted backups of the hosted database expire within 15 days.
We keep access and security logs that show which assistant made a request and when, never the content. We also keep a minimal record that an erasure took place.
Deleting the copy does not delete data an assistant has already retrieved. That data is governed by the assistant provider’s own terms.

You sign in to MoneyCoach with our authentication provider. Assistants never receive your sign-in details. You approve each assistant on a consent screen, and it can only read. MoneyCoach is the controller of the cloud copy. After an assistant retrieves records, its provider processes them under its own terms and privacy policy, and MoneyCoach does not control how it stores, uses, or trains on them. The consent screen names the company that receives the data, and that company can process it outside the EU, for example in the USA. Grok's provider, SpaceXAI, has no company in the EU, so Grok can only connect after you also agree to the transfer to the USA on the consent screen. Our legal bases are your consent and, for payee, merchant, and note text, your explicit consent. You can withdraw consent at any time by deleting the copy. See the Privacy Policy, Section 6A, for details and your rights.

Your controls and responsibility

The AI Tools settings screen includes the main Allow AI Connections toggle plus privacy toggles for Share Payee & Merchant Names and Share Transaction Descriptions. If you hide those details, connected tools can still answer with balances, amounts, dates, categories, budgets, goals, subscriptions, and bills.

For the cloud copy, open Settings, then MCP & AI. There you can turn the feature on, choose whether to share payee, merchant, and note text, and choose Delete Shared Data and Disconnect to erase the copy and disconnect all assistants at once. Deleting your MoneyCoach account also erases the copy.

Before you connect a client

MCP is optional, disabled by default, and requires your confirmation before data becomes available. The cloud copy needs its own opt-in and Premium Max.
MCP access is read-only. The local MCP server is designed for a trusted single-user Mac.
The local MCP server does not send data to MoneyCoach and MoneyCoach does not store a copy of its responses. If you turn on MoneyCoach Cloud for AI assistants, the read-only copy described on this page is stored with a hosting provider in Germany, encrypted in transit and at rest. We do not use MCP responses or the cloud copy to train AI models.
MoneyCoach does not control third-party AI tools, model providers, prompts, logs, retention, training policies, account settings, security practices, or onward sharing.
Review the privacy, retention, security, and model-training terms of your selected client and AI provider before connecting them.
You can immediately block future local MCP requests by turning off Allow AI Connections. To stop cloud access, choose Delete Shared Data and Disconnect in Settings, then MCP & AI. This erases the copy and disconnects all assistants at once. You should also remove the MoneyCoach configuration from clients you no longer use.
AI-generated outputs are informational only and are not financial, investment, tax, legal, accounting, or professional advice from MoneyCoach.
You are responsible for reviewing all AI-generated responses before relying on them.

This page explains the product design and privacy boundaries. It is not legal advice and should be reviewed together with the full Privacy Policy and Terms of Service.

Setup guide See examples Full Privacy Policy Terms of Service