Privacy Policy

We don't offer sign-in on money.com.my at the moment, and we are not creating accounts, so no new sign-in records are created.

Our sign-in service (Supabase) is shared with other applications we operate. It is set up so that creating an account also copies the account ID, the email address and a display name made from the first part of the email address into records used by those applications. As no accounts are being created, this does not happen at the moment.

The Money Health Check works out your Money Score in your browser. Your answers are not sent to us or stored. The account version of the Money Score, which stored your answers, isn't offered at the moment.

Saving products isn't offered at the moment. If you saved products on this device before, that list stays only in your browser until you clear this site's data.

If you sign up, we store your email address and where on the site you signed up. Our newsletter has not launched yet, so we have not sent any emails. When it launches, we will use your address only to send you our emails. To have your address removed, email hello@money.com.my and we will delete it.

If our database fails when you sign up, your sign-up is not saved and you will see an error. When that happens, your email address and where you signed up are also written to our hosting provider's error logs (Vercel).

If you answer “Was this helpful?” on a guide, we store your answer, which guide it was about, and any comment you type. This is not linked to your email address. Your browser remembers that you answered, so we do not ask again.

When you click through to a bank or provider, we record which product and page it was, the link you followed, your browser's identification string (user agent) and the page you clicked from. For that page we keep only its path, never anything after the “?”, so none of the figures you entered in a calculator are recorded. We do not record your IP address with it. This tells us which comparisons people find useful.

If you first arrive from another website, or through a link with campaign tags (such as utm_source), your browser remembers those tags, the page you landed on, the page that referred you, and when. We receive this only when someone completes the account version of the Money Score, which isn't offered at the moment. When we do receive it, we keep the referring site and page but nothing after the “?”, and never your name or email address.

We use Google Analytics 4 to understand how the site is used: which pages are visited and how long visits last. We also send it a few events of our own:

• when you click through to a bank or provider: which product, which page it was on, and the provider's website
• which type of product you chose in the Product Finder
• when you unlock the financial health checklist

GA4 records this against a pseudonymous ID, not your name. Google states that GA4 does not log or store IP addresses.

Our calculators keep your figures in the page address, so that you can share a result. We now remove that part of the address before anything is sent to Google Analytics, keeping only campaign tags such as utm_source. Until the evening of 27 September 2026 the figures were sent, and our Google Analytics reports still contain them. When you use the Product Finder, we count only which type of product you looked for, not your answers.

Before you make a cookie choice, and if you decline, Google Analytics sets no cookies. It still sends a basic measurement without cookies: the page address (with your figures removed, as above) and title, the page you came from, your screen size, your browser language, your browser, operating system and device details, what happened (for example, a page view), how long you spent on the page, and a random ID that is replaced each time a page fully loads.

If you accept, Google Analytics sets its analytics cookies so it can recognise return visits. Accepting does not turn on any advertising or personalisation features. Google processes this data under its privacy policy. We do not combine analytics data with your email address.

We also use Plausible Analytics to count page views. Plausible sets no cookies and stores nothing on your device, and it does not keep your IP address or your browser's full identification string. It records the page you visit, where you came from, your approximate location (country, region and city), your browser, operating system and device type, and how far you scroll and how long you stay on the page. It counts visits with an identifier that is reset every 24 hours and is different for every website, so it cannot follow you from one day to the next or across other sites. Plausible receives the full page address, including any figures in a calculator's address, but stores only the site and path: it discards everything after the “?” except campaign and referral tags such as utm_source. Plausible stores this data in the EU. See Plausible's data policy.

Other websites can show our exchange-rate and OPR widgets. When a widget loads, it sends Google Analytics the cookie-free measurement described above (no cookie banner appears inside a widget, so Google Analytics never sets cookies there), and Plausible counts the view. Both can receive the address of the page the widget is shown on, if that website's settings allow it.

Our hosting provider (Vercel) automatically logs standard request data including IP addresses, request timestamps, and URLs visited. On our plan Vercel keeps these logs for 1 day. They are used for security and performance monitoring. See Vercel's privacy notice.

To stop automated abuse, we use your IP address to count requests: at most 5 newsletter sign-ups every 15 minutes, and 60 tracked clicks a minute, from one address. These counts are held briefly by our rate-limiting service (Upstash) and are not stored with anything else you give us.