Why Dribs will never ask for your bank password

Most budgeting apps start the same way. Pick your bank from a list, log in, and your transactions appear. The login screen often looks like your bank's own. Usually it belongs to an aggregator, a company that sits between the app and thousands of banks, and the app is its customer.

Two ways to connect

The better way uses a token. You log in on your bank's own site or app, approve access, and the bank hands the aggregator a token that lets it read your data without ever seeing your password. That's how open banking is designed to work.

The older way uses your credentials. You type your username and password into the aggregator's screen, and it logs in to your bank as you, often reading the pages your bank shows you. It works with almost any bank. It also means a company you've never heard of holds the keys to your account.

That second model ended up in court in the US. In a class action against Plaid, one of the largest aggregators, the plaintiffs alleged that its login screens had "the look and feel" of the banks' own and that it used people's credentials "to obtain the maximum amount of data accessible", an average of 3,700 transactions per person, according to the court's 2021 order. Plaid said the claims didn't reflect its practices. It settled for $58 million in 2022 and agreed to delete transaction data for people whose apps hadn't asked for it.

Open banking helps, up to a point

In the EU, apps that read your accounts are regulated. They need to be registered and supervised, and you have to confirm access with your bank at least every 180 days. In the UK, the provider has to reconfirm your consent every 90 days. In the US, the rule meant to give consumers similar rights over their financial data was put on hold by a court in 2025 and is being rewritten.

These rules make the connection safer. They don't change what it's for. Once you link an account, a copy of every transaction keeps flowing to the aggregator and to the app's servers, for as long as the link stays active. Each company in that chain keeps a copy of your financial history under its own privacy policy, and each is another place it can leak from.

What Dribs does instead

Dribs doesn't connect to banks at all. You add transactions yourself, or import a CSV file exported from your bank, one account at a time. Everything is stored on your iPhone, with optional sync through your own iCloud account. There's no Dribs account to sign up for, and no server of ours holds your transactions. The only one we run delivers exchange rates and release notes.

There's a cost, and we'd rather be upfront about it: you do the typing. In practice that's a few seconds per expense, less with recurring transactions, and a CSV import catches up a month at once. Plenty of people find that writing things down is half the point. You notice a purchase more when you have to log it.