Frollo - Free Expense Tracking, Expense Analyics, Budgeting, etc app

• 

  tenpercent on 01/04/2025 - 19:27

  +1

  data privacy concerns

  Which is why this will have to be a yeah nah for me.

  Any tech heads on here know how to create something like this that can be self-hosted?

  • 

    Dyl on 01/04/2025 - 19:49

    Looked into it further, it seems their policies disallow any sale of data.

    It says in their policy they rely on Yodlee to maintain its privacy and Yodlee's policy says:

    Your personal information will not be sold, shared, rented or traded with any affiliated or unaffiliated third parties, except (i) to provide you with the Yodlee Services , (ii) pursuant to joint marketing arrangements described below, or (iii) as required or permitted by law

    The info described below it just describes how they forward login details to your bank to confirm access of data, etc, The third party obviously being Frollo in this case, so (i) applies.

    Frollo themselves state they only use the data to provide the service advertised, so they can't sell it either. The ACCC accreditation is strict on this. It actually looks good privacy wise. Removed my comment about this from OP because their policies are actually quite fair and strict + ACCC accreditation as a data receiver is quite reputable

    • 

      tenpercent on 01/04/2025 - 19:55

      We won't monetise your most personal private and sensitive data EXCEPT under the following three vague and open ended conditions with holes big enough to drive a BelAZ 75710 through.

      • 

        Dyl on 01/04/2025 - 20:02

        +1

        Not particularly, it seems very straight forward to me?

        (i) is to the provider (Frollo) who purchases use of their API (you consent with Frollo for this data to be transferred to them and have to provide login credentials for it to happen, can withdraw consent whenever, etc)
        (ii) is a bit vague (there's details on it in the full policy) but essentially just clarifies they do have to provide your bank login details to your bank (obviously…) so they can provide the service and access open banking APIs. Things like that. No holes I see in it - just noting down when they NEED to disclose information to provide the service.
        (iii) is a standard disclaimer - if legally required to disclose they have to.

        Having worked in a FinTech that happened to use the Yodlee API though, this can differ in practice. The policy might be great, but things like incorrect access restrictions allowing employees to view your data without authority for example… I actually even seen data access logs that employees not related at all to credit assessment had looked at my homeloan application, ie my colleagues saw my private financial data. That particular company is a horror story though, I still hold whistleblower information against them. (Note I can't name the company as they've made legal threats to sue for defamation so I'm cautious, but it was an online homeloan application non-bank lender). Frollo, however, is ISO compliant so (assuming it remains compliant) would have correct access restrictions in place to enforce their policies. They would have breakglass protection and what-not to view data (which is how I found out my data was illegally viewed) and likely act on any malicious behaviour.

        tl;dr:
        They don't sell your data or use it for other purposes, but employees with high level access may still be able to view data illegally. They're accredited and ISO compliant, so likely have good internal policies and access restrictions.

• 

  Wiadro on 01/04/2025 - 20:26

  +2

  isnt this like wemoney

  • 

    Dyl on 01/04/2025 - 20:27

    They also use the Yodlee API, so likely.

    Yodlee is basically in the industry standard. It does all the Open Banking API access and categorising of transactions. Most of these apps, online credit card and home loan applications, etc all use it.

  • 

    isthisreallife22 on 02/04/2025 - 16:35

    Would be interested in comparisons between the two

• 

  wannagrababargain on 01/04/2025 - 22:24

  +3

  Open Banking (aka Consumer Data Right) is a revolution. By now all Australian banks are mandated to use it. But please don't refer to it as the "Yodlee API"

  Yodlee as a company predates Open Banking and uses a traditional login and web scraping and deservedly has a shady reputation. It would be a shame to confuse them and seed doubt about an otherwise brilliant system.

  • 

    Dyl on 01/04/2025 - 22:29

    I referred to it as Yodlee API as that's the API they use.

    Most FinTech's use Yodlee because tThey're already an Accredited Data Recipient (so you don't need accreditation), and because they categorise the data for you. It did use to be a screen scraper, but now uses Open Banking too.

• 

  Rako on 01/04/2025 - 23:06

  Bank aggregation is a security risk, if you bank account is compromised & funds are taken by a scammer, you have broken your contract with the bank by giving out your login details to Frollo, sounds like something from Lord of the rings!

  • 

    Dyl on 01/04/2025 - 23:17

    You're providing your details to a third party accredited by the ACCC for specific use cases; that doesn't break any contracts like providing them to a scammer may. I believe there's legislation around it. Banks legally had to implement the APIs, so they can't punish you for using them.

    Don't use dodgy apps, but Frollo is ACCC accredited so it's safe and doesn't break any contracts with your bank.

    • 

      pscac001 on 02/04/2025 - 08:28

      The Open Banking APIs don't require you to give your password to anyone, you log in to your bank and authorise the third party to have access. If you are giving ANYONE your username and password, then you are almost certainly in breach of your contract with your bank.

      • 

        Dyl on 02/04/2025 - 08:50

        Banks all have 2FA now, if they’re not going via OpenBanking it wouldn’t work.

        You are correct but the app mirrors the page, so users may believe (and technically) it is sharing the password with your bank. Just, it’s directly typed into the banks site, via the app. There servers aren’t, but their app IS (directly) sharing data with your bank to confirm your details and gain access consent.

        Frollo never sees your credentials.

        • 

          pscac001 on 02/04/2025 - 11:24

          @Dyl:

          Frollo never sees your credentials

          Right, that's the bit that makes it safe and not a breach of contract. It's nothing to do with ACCC accreditation, or some convoluted logic about how the banks are required to provide a service so they can't punish you. It's just plain and simple not doing the thing that the contract prohibits.

  • 

    interlocal on 02/04/2025 - 09:59

    Frollo does not ask you bank login details, it uses special bank API, so basically you tell Frollo name of your bank and account nr, and you need to confirm in your bank app that you allow Frollo to have a) read-only b) time-limited access to your balance and/or transactions. So you do not share bank credentials and bank is totally fine with this way of doing things, as it's mandated by the law.
    (at least it was ~1yr ago when I stopped using frollo)

• 

  Rako on 01/04/2025 - 23:07

  -1

  Is it really to hard to enter the data manually?

  • 

    Dyl on 01/04/2025 - 23:15

    +1

    Hard? No
    Time consuming? Yes

    What alternative are you using where it would be worth spending hours entering the data over this solution? What features is this missing that something else has…

    • 

      tenpercent on 02/04/2025 - 20:05

      Time consuming

      Doesn't need to be. Once you have a spreadsheet set up you can just download monthly (whatever frequency) csvs into a particular folder and the spreadsheet will pull in new data.

• 

  Baysew on 02/04/2025 - 11:28

  +2

  Analyics

  Sounds a bit rude, what is that?

  • 

    tenpercent on 02/04/2025 - 20:13

    Giggidy

    ⠀⠀⠀⠀⠀⠀⠀⢀⣠⣴⣶⣾⣿⣿⣿⣿⣶⣶⣶⣦⣤⣀⠀⠀⠀⠀⠀⠀⠀⠀
    ⠀⠀⠀⠀⠀⣠⣾⣿⣿⣿⣿⠿⠿⠟⠛⠛⠉⠙⠻⢿⣿⣿⣷⡄⠀⠀⠀⠀⠀⠀
    ⠀⠀⠀⠀⢰⣿⣿⣿⡟⠁⠀⠀⠂⠈⠀⠀⠀⠀⠀⠀⠀⠈⡙⢿⡄⠀⠀⠀⠀⠀
    ⠀⠀⠀⠀⢿⣿⣿⣿⣇⠀⢀⠔⠉⠉⠉⢢⠀⠀⠀⡠⠐⠒⠠⣠⠃⠀⠀⠀⠀⠀
    ⠀⠀⠀⠀⠈⣿⣿⣿⣿⡆⢘⠊⠉⠉⠉⠉⡇⠀⠘⠒⠒⠒⠒⠚⡄⠀⠀⠀⠀⠀
    ⠀⠀⠀⠀⠀⠘⢩⢿⡿⠀⠘⢤⠤⢒⣲⡔⠀⠀⡰⡤⠤⠤⠦⣰⠁⠀⠀⠀⠀⠀
    ⠀⠀⠀⠀⠀⡜⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠰⠉⠉⠉⠉⠹⡄⠀⠀⠀⠀⠀
    ⠀⠀⠀⠀⡜⠀⠀⠀⠀⠀⣀⡀⠀⠀⠀⠀⠤⠀⠀⠱⡀⠀⠀⠀⠈⠢⡀⠀⠀⠀
    ⠀⠀⠀⡸⠀⠀⠀⠀⠀⣍⠀⠱⡀⠀⠀⠀⠢⡀⠀⠀⠘⢄⠀⠀⠀⠀⠙⢄⠀⠀
    ⠀⠀⢰⠁⠀⠀⠀⠀⢀⣿⣦⡀⠘⢤⡀⠀⠀⠈⠒⠤⣀⠀⠑⡄⠀⠀⠀⠈⢆⠀
    ⠀⠀⡇⠀⠀⠀⠀⠀⢸⣿⣿⣿⣦⣀⠈⠑⠢⠤⢀⣀⣀⡈⠩⡁⠀⠀⠀⠀⠈⡆
    ⠀⠐⠀⠀⠀⠀⠀⠀⠸⣿⣿⣿⣿⣿⣿⣶⣶⣤⠤⠤⠤⠏⠁⠀⠀⠀⠀⠀⠀⢱
    ⠀⠀⢇⠀⠀⠀⠀⠀⠀⢫⠙⠻⣿⣿⣿⣿⣿⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸
    ⠀⠀⠈⢦⠀⠀⠀⠀⠀⠀⠣⡀⠹⣿⣿⣿⣿⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⠆
    ⠀⠀⠀⠀⠑⢄⠀⠀⠀⠀⠀⠀⠉⠉⠉⠉⠉⠉⡱⠀⠀⠀⠀⠀⠀⠀⠀⣠⠊⠀
    ⠀⠀⠀⠀⠀⢨⣷⣄⡀⠀⠀⠀⠀⠀⠀⠈⠉⠉⠢⠀⠀⠀⠀⠀⠀⢀⠞⠁⠀⠀
    ⠀⠀⢀⣠⣶⣿⣿⡇⠉⠒⠤⢄⡠⡤⠤⢖⠂⠀⠀⠀⠀⠀⠀⣀⠔⠁⠀⠀⠀⠀
    ⣠⣴⣿⣿⣿⣿⣿⣧⠀⠀⠀⢀⣼⡇⠀⠀⠈⠓⠂⠤⠄⠒⠉⠀⠀⠀⠀⠀⠀⠀
    ⣿⣿⣿⣿⣿⣿⣿⣿⣷⡄⢀⣾⣿⡿⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
    ⣿⡟⠋⠘⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡜⠄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
    ⣿⣉⠀⠐⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣜⡄⠀⠀⠀⠀⠀⠀⠀⠀