You are being asked to connect a bank account, which is a lot to ask. Here is exactly what that gives us, what it never gives us, and how you take it back.
Paagaa can read your transactions so it can sort them. It cannot move money. Making a payment needs a completely separate permission that Paagaa does not request and could not use even if it wanted to.
This is not a promise about our intentions. It is a property of the permission your bank grants: reading and paying are different things, and we only ever ask for the first.
When you connect, you are handed to your own bank to log in. You type your credentials on your bank's page, exactly as you would to check your balance, and your bank tells us you approved it.
Paagaa never receives, stores, or has any way to see your username or password. There is no screen in the app that asks for them, and there never will be. Any app that does ask for them is doing something you should refuse.
Three things, shown to you before you approve anything:
Your bank data is used for one thing: showing you your own money picture.
Anything that touches your bank data sits behind two-factor authentication, checked on our servers rather than in the browser. A password on its own is not enough to reach it, even if someone has yours.
That is a deliberate trade: it makes signing in slightly slower, and it means a stolen password does not become a stolen bank picture.
Everything is encrypted in transit, and the database is encrypted at rest with AES-256. Private messages between you and an adviser are separately encrypted before they are stored, so they are not readable in the database itself.
You can disconnect your bank from your settings at any time. We cancel the consent with your bank straight away rather than just hiding the data at our end.
You can also delete your financial data while keeping your account, or close your account entirely. Both are real deletions rather than a flag on a row, and both are in your settings without needing to email anyone.
If cancelling the consent with your bank ever fails, the app tells you so and points you at your bank's own app, where you can revoke it yourself. We would rather say that plainly than imply a guarantee we cannot always keep.
If you think you have found a security problem, email hello@paagaa.com and tell us what you found. We would much rather hear it from you than not hear it at all, and we will not go after anyone acting in good faith.