Is it safe to connect your bank to an app?

Is it safe to connect your bank account to a budgeting app?

It is reasonable to be cautious, and the honest answer depends on how the app connects. A connection that asks for your internet banking username and password is one you should refuse. A read-only open banking connection, approved on your bank's own login screen, is a much narrower thing and is the method New Zealand's banking rules are built around.

Paagaa uses the second kind. You are handed to your bank to log in, your bank confirms it is you, and Paagaa receives only the information you approved.

Who actually sees your bank login?

Only your bank. When you connect, you are taken to your bank's own secure login page to approve the request. You type your credentials there, on your bank's site, exactly as you would when checking your balance.

Paagaa never receives, stores, or has any way to see those credentials. There is no screen in the app that asks for them, and there never will be.

Can the app take money out of your account?

No. The permissions Paagaa asks for are read-only: account names and types, balances, and transaction history. Moving money requires a completely separate payment permission that Paagaa does not request and could not use.

This is worth checking with any app you connect, not just this one. The permission list is shown to you before you approve anything, so read it.

How do you disconnect your bank?

From your settings, at any time, without contacting anyone. Paagaa cancels the consent with the bank straight away rather than simply hiding the data at our end, so access genuinely stops.

Being able to leave easily is part of what makes connecting reasonable in the first place. If an app makes disconnecting hard, treat that as the warning sign it is.

What happens to your data?

Your bank data is used to show you your own money picture: spending by category, income, and progress towards the goals you set. It is not sold, and it is not passed to advertisers.

If you decide you want it gone, Paagaa has a delete-my-data option that erases your financial records, and a separate option that closes your account entirely. Both are in your settings, and both are real deletions rather than a flag on a row.

What should you check before connecting any app?

There are four questions worth asking about any service that wants access to your accounts, whoever it is.

• Does it send you to your own bank to log in, or does it ask for your password directly? Only the first is acceptable.
• Does it show you the exact permissions before you approve them?
• Are those permissions read-only, or do they include making payments?
• Can you disconnect yourself, immediately, without emailing support?