Actual Budget is an open-source (MIT-licensed), local-first envelope-budgeting app: its own Privacy Policy states no personal information is required for basic functionality, financial data is stored on the user's device rather than transmitted to or stored on the operator's servers, no data is collected automatically, and no tracking mechanisms are employed. Multi-device sync happens directly between a user's own devices and their own self-hosted server, with no third-party server in the path, and optional end-to-end encryption is available with a locally generated key the operator says it cannot access. The project is fiscally sponsored by the Open Source Collective, with a small named admin/core-contributor team and an unusually transparent public ledger of donations and disbursements. Its one real architectural wart is optional bank-sync: users can connect third-party aggregators (Akahu, Enable Banking, GoCardless, SimpleFIN, Pluggy.ai) for automatic transaction import, and the resulting API secrets are stored server-side outside end-to-end encryption, which a disclosed 2026 vulnerability confirmed could be enumerated by non-admin users before it was fixed.
TIMELINE
1 ENTRY
[2026-08-31] · NEW RECEIPTS
7 new sources on file for Actual Budget.
Actual Budget's file gained 7 new sourced claims since its last review.
Actual Budget's Privacy Policy (effective 13 Jan 2024) states the app does not require any personal information for its basic functionality, and that the user's financial data is stored locally on their device and is not transmitted to or stored on the operator's servers, meaning the core app's default architecture never gives Actual Budget the company access to a user's budget data.
GitHub's API record for the actualbudget/actual repository confirms the complete codebase is published under the MIT open-source license, and GitHub's own repository description labels the project 'A local-first personal finance app.'
Actual Budget's Open Collective page discloses its fiscal host as Open Source Collective and publishes an itemized public ledger with named admins, named core contributors, and exact running totals for funds raised and disbursed to date.
Actual Budget's bank-sync documentation states the optional integration relies on the user supplying their own API credentials, obtained by signing up directly with a third-party financial-data aggregator, in order to enable automatic transaction import; it further discloses that the resulting API secrets and keys are stored on the self-hosted server outside end-to-end encryption, so a server administrator or hosting provider with direct database access can read those bank-sync tokens even when a user's core budget data is end-to-end encrypted.
Actual Budget's Privacy Policy states that multi-device sync is carried out through direct, secure communication between a user's own devices and their own server (if the user has set one up), without involving any third-party server.
Actual Budget's GitHub Security Advisories page publicly discloses a moderate-severity vulnerability, published June 2026 by a named maintainer, describing missing authorization on a server endpoint that allowed non-admin OpenID users to enumerate admin-configured bank-sync secrets — a real, dated confirmation of the bank-sync wart flagged above, disclosed and fixed under the project's public security-advisory process rather than left unreported.