{
  "slug": "ynab",
  "category": "budgeting",
  "name": "YNAB",
  "description": "Subscription budgeting app based on zero-based budgeting, where every unit of income is assigned a job, with optional bank account syncing.",
  "website": "https://www.ynab.com",
  "license": null,
  "platforms": [
    "android",
    "ios",
    "web"
  ],
  "jurisdiction": {
    "code": "US",
    "name": "United States",
    "eyes": "Five Eyes",
    "eu": false,
    "gdpr": false,
    "cloud_act": "provider"
  },
  "pick": false,
  "pick_reason": null,
  "disclosure": null,
  "grade": "F",
  "score": 0,
  "coverage": 100,
  "summary": "YNAB scores 0 out of 100 (grade F) on the budgeting criteria. It does not meet open source, no trackers or telemetry, no ads or data sales and independent audit. It is based in the United States: Five Eyes member; subject to the US CLOUD Act.",
  "url": "https://privacyratings.com/budgeting/ynab/",
  "markdown": "https://privacyratings.com/budgeting/ynab/index.md",
  "answers": {
    "open_source": {
      "title": "Open source",
      "weight": 3,
      "answer": "no",
      "evidence": null,
      "note": "Closed source."
    },
    "no_trackers": {
      "title": "No trackers or telemetry",
      "weight": 3,
      "answer": "no",
      "evidence": "https://reports.exodus-privacy.eu.org/en/reports/com.youneedabudget.evergreen.app/latest/",
      "note": "The Exodus report finds Amplitude, Bugsnag and Google Firebase Analytics in the Android app, and the privacy policy names Google Analytics and session recording tools."
    },
    "no_ads": {
      "title": "No ads or data sales",
      "weight": 2,
      "answer": "no",
      "evidence": "https://www.ynab.com/privacy-policy",
      "note": "Funded by subscriptions and says user data is not sold, but the privacy policy describes ad-network cookies, pixels and hashed email addresses shared with platforms for ad targeting."
    },
    "independent_audit": {
      "title": "Independent audit",
      "weight": 2,
      "answer": "no",
      "evidence": null,
      "note": "No independent audit is published."
    },
    "transparency_report": {
      "title": "Transparency report",
      "weight": 2,
      "answer": "n/a",
      "evidence": null,
      "note": "Only applies to hosted services with a website to test."
    },
    "user_notice": {
      "title": "Tells users about requests",
      "weight": 1,
      "answer": "n/a",
      "evidence": null,
      "note": "Only applies to hosted services with a website to test."
    },
    "tls": {
      "title": "TLS configuration",
      "weight": 2,
      "answer": "n/a",
      "evidence": null,
      "note": "Only applies to hosted services with a website to test."
    },
    "security_headers": {
      "title": "Security headers",
      "weight": 1,
      "answer": "n/a",
      "evidence": null,
      "note": "Only applies to hosted services with a website to test."
    },
    "web_standards": {
      "title": "Modern web standards",
      "weight": 1,
      "answer": "n/a",
      "evidence": null,
      "note": "Only applies to hosted services with a website to test."
    }
  },
  "tests": {
    "ssllabs": null,
    "observatory": null,
    "internetnl_web": null,
    "internetnl_mail": null,
    "trackers": [
      {
        "name": "Amplitude",
        "host": "cdn.amplitude.com",
        "effect": "no"
      },
      {
        "name": "Google Fonts",
        "host": "fonts.googleapis.com",
        "effect": "none"
      }
    ],
    "tested_at": "2026-10-01T06:59:54.530Z"
  },
  "last_modified": "2026-10-01T07:44:20Z"
}