Copper handles your financial data, so it’s built to see as little as it needs and to keep that locked down.

​
Your bank connection

  • Your bank login goes to Plaid, never to Copper. You sign in to your bank inside Plaid’s window. Copper never sees or stores your bank username or password.
  • Read-only. Copper can see balances and transactions. It can’t move, send or withdraw money.
  • Tokens stay on the server. Plaid gives Copper an access token for each bank. It’s encrypted at rest with AES-256-GCM, used only by Copper’s servers, and never sent to your phone.
  • You’re in control. Remove any bank at any time from Settings › Connected Accounts. That disconnects it at Plaid. See Connect a bank.

​
Your data

  • Data is encrypted in transit with TLS.
  • Database access is restricted per person and per budget. Other people only see a budget if they’ve joined it, and private buckets stay hidden even from them.
  • Copper doesn’t show ads, doesn’t sell or rent your personal information, doesn’t use advertising identifiers and doesn’t track you across other companies’ apps or websites.
  • To find crashes and see which features get used, Copper sends usage and error reports to PostHog. They’re tied to your account ID, not your name or email, and never include amounts, balances, or the names of your stores, accounts, buckets or categories. Copper doesn’t record your screen.
Copper shares data only with the services it runs on: Plaid for bank connections, Supabase for its database and sign-in, Railway for the service that talks to Plaid, RevenueCat for App Store and Google Play subscriptions, PostHog for usage analytics and crash reports, Expo to deliver app updates, Expo, Apple and Google to deliver notifications, OpenRouter and TypeSafe to read the questions you ask Penny (the question text and a few names, never amounts), and logo.dev, which receives merchant website names (like starbucks.com) to show logos and nothing about you. The Privacy Policy has the details.

​
Lock the app on your phone

Add a PIN so nobody can open Copper on your phone without it. With Face ID (or Touch ID) set up on your iPhone, Copper asks for your face first and keeps the PIN as the backup. On Android, Copper uses your phone’s Fingerprint or Face Unlock the same way, and the switches and buttons use that name, like Unlock with Fingerprint. Everything below works the same.
1

Open Security

Go to Settings › Security.
2

Set a PIN

Tap Set a PIN, enter 4 digits, then enter them again to confirm.
3

Face ID is on

Unlock with Face ID turns on with your PIN. Switch it off in the same place if you’d rather always type the PIN.

​
Unlocking

When Copper is locked, Face ID starts on its own. If it doesn’t recognize you, or you cancel it or tap Use PIN, the PIN pad appears. The Face ID key at the bottom left of the pad tries again. To change your PIN, tap Change PIN in Settings › Security and enter your current PIN first. Remove PIN at the bottom of the same screen turns the lock off.

​
Forgot your PIN?

Tap Forgot PIN? on the lock screen. Copper signs you out and turns the PIN off; sign back in with your password and set a new one in Settings › Security.

​
Sign in with Face ID

In Settings › Security, under Sign in, turn on Sign in with Face ID (or Touch ID) and enter your Copper password once. After that, the sign-in button becomes Sign in with Face ID on that iPhone. On Android, the switch and button read Sign in with Fingerprint or Sign in with Face Unlock. It’s for accounts with a password; Apple and Google sign-in don’t need it. Your email and password are kept in the iOS Keychain on that device only, and only while your iPhone has a passcode. On Android, they’re encrypted with a key from the Android Keystore, on that phone only. Face ID, your fingerprint and Face Unlock are handled by the phone itself; Copper never receives biometric data. If you change your password somewhere else, Copper clears the saved sign-in and asks you to sign in with the new password.

​
Staying signed in

Copper keeps you signed in on each device until you sign out there. Signing out on your phone doesn’t sign you out on the web or your other devices, and entering a two-step verification code on the web doesn’t either. Changing your password signs you out everywhere except the device you changed it on. If you think someone else is signed in to your account, change your password. Links Copper emails you, like the one to confirm a new account, only work on the device that asked for them. Open them on the same phone.
The PIN lock and Face ID or fingerprint unlock are phone features. On the web, sign out from Settings › Account when you’re on a shared computer.