Is it safe to connect my credit cards through Plaid?
Connecting through Plaid is generally safe for a read-only use case: you sign in on Plaid's or your bank's own screen, the app never sees your password, and the app receives only the data products it requested. The things to check are which products the app requests, how it stores the access key, and how to disconnect.
Plaid is the connection layer behind thousands of financial apps: budgeting tools, investing apps, payment apps and perk trackers like splurn. When an app says “connect your bank”, it is usually Plaid in the middle. Whether that is safe depends less on Plaid and more on what the app asks for and how it behaves.
What happens when you connect
- The app opens Plaid Link, a screen Plaid controls.
- You pick your bank and sign in. For most large banks this is OAuth: you are sent to the bank’s own site, sign in there, and approve the connection. Plaid and the app never see your password.
- Plaid returns an access token to the app’s server. The token is scoped to the data products the app requested.
- The app fetches that data from Plaid as needed.
The token is the sensitive part. A careful app keeps it on its server, encrypted, and never on your phone.
What the app can and cannot do
Plaid sells separate products: Transactions, Balance, Identity, Auth (account and routing numbers), Investments, and payment initiation. An app receives only what it requested and what you approved.
A perk tracker needs Transactions and nothing else: the date, merchant, amount and category of each charge, so it can tell when a credit was used. It has no reason to request your account number, your identity details, or payment rights. If one does, ask why.
An app with read-only Transactions access cannot move money, change your account, or see your password.
Questions to ask any app before linking
- Which Plaid products does it request? Look for a plain answer in the privacy policy. “Transactions only” is the right answer for a tracker.
- Where is the access token stored? It should be on the app’s server, encrypted at rest, never in the app on your phone.
- How long is the data kept? Finite is better than forever. splurn deletes transactions after 180 days.
- How do I disconnect? There should be a button in the app that revokes the connection at Plaid and deletes the data, not just hides it.
- Does the app sell or share the data? The policy should say no, in those words.
How splurn does it
splurn requests Transactions only. You sign in on Plaid’s screen, often via your bank’s own login; splurn never sees it. The access key lives on splurn’s server, encrypted with AES-256-GCM, and never on the phone. Transactions are kept for 180 days and then deleted. Connecting needs Face ID or your passcode. Wallet › Settings has Disconnect, Withdraw consent and Delete account, each of which revokes the connection at Plaid and removes the data. The full policy is on the privacy page.
Connecting is optional. splurn ranks your cards and lists your credits without it; linking only lets credits mark themselves used.
Beyond any single app
Plaid runs a portal at my.plaid.com where you can see every app connected through Plaid with your accounts and revoke any of them. It is worth a look once a year regardless of which apps you use.
The short version
- You sign in on Plaid’s or your bank’s screen; the app gets a scoped token, not your password.
- Read-only Transactions access cannot move money.
- Check what the app requests, where it keeps the token, how long it keeps data and how you disconnect.
Quick answers
Does the app see my bank password when I use Plaid?
No. You enter credentials on Plaid's screen or, for banks using OAuth, on the bank's own site. The app receives an access token for the data it requested, not your login.
Can an app move money through Plaid?
Only if it requested Plaid's payment products and you authorised them. An app that requests Transactions only cannot initiate payments or transfers.
How do I revoke a Plaid connection?
Disconnect inside the app, which should remove the item at Plaid, and review connections at my.plaid.com, where you can see and revoke every app linked through Plaid.
splurn is not a bank, issuer or lender, and is not affiliated with any issuer. Card terms change; confirm rates, credits and fees in your card's current terms before relying on them.