By The Income Tracker · Updated 16 September 2026 · 5 min read
The short answer
With your consent, an account information provider can read your account name and numbers, balances, up to 12 months of transaction history, and your standing orders, direct debits and saved payees. It can refresh that data several times a day for 90 days, after which it must ask you to reconfirm. It cannot move money unless you approve a separate payment consent. You can revoke access in the app's settings or from your bank's list of connected apps at any time.
The data an app can read
Account details: the account name, sort code and account number, and the type of account.
Balances: current and available, including any overdraft.
Transactions: typically up to 12 months of history at the first connection, then new items as they arrive. Each row carries the date, amount, merchant or payee name and the bank's own description.
Regular payments: your standing orders and direct debits, plus saved beneficiaries.
What it does not get: your login details, your card PIN, and the ability to move money without a separate, explicit payment consent.
How often, and for how long
The connection can pull fresh data up to four times a day without you doing anything. Consent lasts 90 days, then the app must ask you to confirm it again. Deleting the app does not by itself revoke the consent, which is the bit people miss. Revoke it explicitly.
How long the company keeps the data after you disconnect is set by its own privacy policy under UK GDPR, not by the open banking rules. Some delete on disconnection, some keep it for years. Read the policy before you connect, not after.
How to revoke access
In the budgeting app: find the connected accounts screen and choose disconnect or revoke for each bank.
At your bank: most banking apps have a page called something like Connected apps, Third-party access or Manage open banking. Barclays, Monzo, Starling, NatWest and Lloyds all list every active consent there, with a button to remove it.
Check the app is authorised: search the FCA register for the company name. If it is not there, and not listed as an agent of a firm that is, revoke immediately.
If you would rather share nothing
The zero-consent route is a file. Download a CSV from your bank once a month and import it into The Income Tracker. It reads the file in your browser, no company gets a live feed, and there is nothing to revoke later.
The Income TrackerTrack it free. No account, no bank login.