Privacy Policy
Last updated: 15 August 2026
Overview
BlinkSync is operated by Arrowknee Ltd, a company registered in England & Wales. We are committed to protecting your privacy. This policy explains what data we collect, why, and how we keep it safe.
BlinkSync is built with a zero-knowledge architecture. We process your transactions in real time but do not store transaction data after delivery.
BlinkSync is not affiliated with, endorsed by, or officially connected to YNAB (You Need A Budget), Monzo, Starling Bank, Up Bank, bunq, Lunch Money, PocketSmith, Liquid Budget, or any of their subsidiaries. All product names, logos, and brands are property of their respective owners.
What we collect
| Data | Purpose | Retention |
|---|---|---|
| Email address | Account login (via one-time passcode) | Until account deletion |
| Connection config | Link your bank to your finance app | Until connection deleted |
| API tokens | Authenticate with your bank or finance app | Encrypted at rest (AES-256 via AWS KMS) |
| Transaction data | Forwarded from bank to finance app | Not stored. Forwarded in real time |
| Daily sync counts | Activity dashboard (success/error counts only) | 90 days |
What we don't collect
- ✓ We never store your transaction amounts, descriptions, or merchant names
- ✓ We never sell or share your data with third parties
- ✓ We never use your data for advertising, analytics, or profiling
- ✓ We never access your bank account balance or account details
How syncing works
When your bank sends a webhook notification, BlinkSync receives the transaction, normalises it, and immediately forwards it to your chosen finance app. The transaction payload is held in memory only for the duration of processing (typically under 5 seconds) and is never written to disk or a database.
For banks that require API lookups (e.g. Up Bank), BlinkSync uses your encrypted API token to fetch the transaction details, forwards them, and discards the response.
Encryption & security
- 🔐 All API tokens are encrypted with AES-256 via AWS KMS before storage
- 🔐 Tokens are only decrypted in memory at the moment they are needed
- 🔐 All connections use HTTPS/TLS. Data is encrypted in transit
- 🔐 Authentication uses passwordless email OTP and passkeys (WebAuthn)
- 🔐 Infrastructure runs on AWS in the EU (eu-west-2, London)
Third-party services
| Service | Purpose | Data shared |
|---|---|---|
| AWS (Amazon Web Services) | Cloud infrastructure | All data processed on AWS |
| Amazon Cognito | User authentication | Email address |
| Google Analytics | Marketing site analytics | Anonymous page views (marketing site only) |
| YNAB API | Create transactions, list budgets & accounts | Budget ID, account ID (stored). Transactions forwarded, not stored. |
| Bank APIs (Monzo, Starling, Up, bunq) | Receive or fetch transaction webhooks | Transaction data forwarded in real time, not stored |
Google Analytics is only present on the marketing site (blinksync.zip), not in the app (app.blinksync.zip).
Your rights
You can exercise any of the following at any time:
- Export Request a copy of your stored data
- Delete Delete individual connections or your entire account
- Revoke Revoke API tokens from your bank or finance app at any time
Deleting a connection immediately removes the webhook URL, encrypted tokens, and all associated configuration. Deleting your account removes all data.
Cookies
The BlinkSync app uses only essential authentication cookies (session tokens). No tracking cookies are used in the app.
The marketing site (blinksync.zip) uses Google Analytics which sets cookies for anonymous usage tracking. No personal data is collected.
Data breach notification
In the unlikely event of a data breach affecting your personal data, we will notify affected users by email within 72 hours and report to the ICO as required by UK GDPR.
Where your data is processed
All data is processed and stored on AWS infrastructure in the EU (London, eu-west-2). Your data is not transferred outside the United Kingdom or European Economic Area.
Do Not Track
The BlinkSync app does not track you and does not alter its behaviour based on Do Not Track signals. The marketing site uses Google Analytics for anonymous page-view statistics only.
Changes to this policy
We may update this privacy policy from time to time to reflect changes to our practices or for legal, operational, or regulatory reasons. Material changes will be communicated by email.
Contact
If you have questions about this privacy policy or your data, contact us at:
Arrowknee Ltd · England & Wales