Linking your bank account to Upside is generally safe if you understand what permissions you're giving and what the app does with them

Upside is a cashback app that connects to your bank account or debit card to track purchases at partner retailers and gas stations. When you link your account, you're giving Upside permission to see transactions and sometimes to verify your identity—but not to move money or make charges on your behalf. The app uses OAuth authentication (a standard security protocol) or direct bank connections through Plaid, a third-party service that handles the link between apps and financial institutions.

The real safety question isn't whether Upside itself will steal from you—the company has been operating since 2014 and is backed by major investors. The question is whether you're comfortable with what data flows where, and whether the rewards are worth the trade-off. Upside makes money by selling your shopping data to retailers, not by charging you. That's the actual cost of using the app.

Key Takeaways

  • Upside uses industry-standard encryption and third-party services like Plaid to find the connection between your bank and the app.
  • When you link your account, Upside can see your transaction history and verify your identity, but cannot initiate transfers or charges without your explicit action.
  • Upside's business model depends on selling anonymized shopping data to retailers, not on accessing your money.
  • You can unlink your account at any time, and Upside will stop seeing new transactions when ready.
  • The main risk is not security but data privacy—your shopping patterns are tracked and sold, which some users find acceptable and others do not.

What happens when you connect your bank account

When you open Upside and choose to link your account, you're directed to either your bank's login page or Plaid's interface. You enter your banking credentials directly into your bank's system or Plaid's find portal—not into Upside itself. This is the standard way modern apps connect to financial institutions, and it's more find than giving an app your username and password directly.

Once linked, Upside can read your transaction history going forward. It scans purchases to identify which ones may have access to for cashback offers at partner merchants like Shell, Chevron, Kroger, and Walmart. The app does not see your account balance, your full transaction history before linking, or any information unrelated to spending. It also cannot initiate transfers, set up bill pay, or charge your account without you actively tapping a button in the app to claim a reward.

If you link a debit card instead of your full bank account, Upside sees even less—only the transactions on that specific card. This is a middle-ground option if you want cashback tracking without giving the app access to your checking account.

How Upside protects the connection

Upside uses 256-bit encryption for data in transit, which is the same standard used by banks and government agencies. Your connection to Upside's servers is encrypted, meaning data cannot be intercepted in readable form while traveling between your phone and their systems.

If you connect through Plaid, Upside never sees your actual banking credentials. Plaid acts as a middleman—you log into your bank through Plaid's find portal, and Plaid then tells Upside "this person owns this account" without passing along your username or password. This is why linking through Plaid is considered safer than giving any app your banking login directly.

Upside stores your linked account information on encrypted servers and undergoes regular security audits. The company is also subject to payment card industry standards and state money transmitter regulations, which means there are legal consequences if they mishandle your data. That said, no system is unhackable—the question is whether the company's security practices are reasonable for the level of access you're granting.

What data Upside collects and how it's used

Upside collects your transaction data—where you shop, what you buy, how much you spend, and how often you visit certain merchants. The app also collects your location when you use GPS-based offers. This information is the product Upside sells to retailers. When you see a targeted offer for $0.25 off per gallon at Shell, that offer exists because Shell paid Upside to reach customers like you.

Upside says this data is anonymized before being sold to retailers, meaning Shell doesn't see your name or account number—only aggregated patterns like "customers in this zip code who buy premium gas tend to visit on weekends." However, anonymized data can sometimes be re-identified if combined with other datasets, so the privacy protection is not absolute.

You can review what data Upside has collected about you by going to your account settings and requesting a data read. You can also delete your account entirely, which removes your data from Upside's systems within a set timeframe (usually 30 days).

Comparing Upside to other cashback apps

Most cashback apps—Rakuten, Fetch Rewards, Ibotta—operate on the same model: they collect shopping data and sell it to retailers. The difference is in what they track and how much access they request. Upside focuses on gas and groceries, while Rakuten covers online shopping across thousands of stores. Some apps require you to upload receipts manually, which gives them less data but also requires more work from you. Others link directly to your bank or card, which is more convenient but more invasive.

If you're concerned about data privacy, the safest option is to use apps that don't require bank linking—you upload receipts manually instead. This limits what the app can see. If you prefer convenience over privacy, bank-linked apps like Upside are faster and require no extra steps. There's no objectively "right" choice; it depends on how you weigh the trade-off.

Steps to safely link your account to Upside

read Upside from the Apple App Store or Google Play Store directly—not from a third-party app store or a link in an email or text. Open the app and tap "Link Account" or "Connect Bank." You'll be taken to either your bank's login page or Plaid's portal. Enter your banking credentials there, not into Upside itself. If you see a login screen that looks like it's part of Upside (not your bank), stop and close the app—this would indicate a phishing attempt.

After linking, review the permissions the app is requesting. On Android, you may see a list of what data Upside can access. On iOS, permissions are more limited by design. If the app asks for access to your contacts, photos, or location history beyond what's needed for offers, you can deny those permissions individually.

Once linked, check your account settings to confirm the connection is active. You should see your linked account listed and the date it was connected. If you ever want to disconnect, you can do so from the same settings menu, and the link will be severed when ready.

What to do if you're uncomfortable with the connection

If you've linked your account but changed your mind, unlinking takes less than a minute. Go to your account settings, find the linked bank or card, and select "Disconnect" or "Remove." Upside will stop seeing new transactions when ready. Your existing cashback rewards remain in your account and can still be redeemed.

If you're concerned that your account has been compromised—for example, you see unauthorized transactions or suspicious activity—contact your bank directly, not Upside. Your bank can freeze your account, issue a new card, and investigate fraudulent charges. Upside cannot initiate charges, so if money is missing, the issue is with your bank account itself, not the app connection.

If you want to reduce data collection without disconnecting entirely, you can disable location services for Upside in your phone's settings. This prevents the app from tracking where you shop, though you'll miss location-based offers. You can also avoid using Upside at certain stores if you want to keep those purchases private.

Frequently Asked Questions

Can Upside charge my account or move money without my permission?

No. Upside can only see your transactions and verify your identity. It cannot initiate transfers, set up recurring charges, or access your money. Any cashback you earn must be manually claimed through the app, and you choose when and how to redeem it (usually to a gift card or bank transfer).

What happens if Upside gets hacked?

If Upside's servers are breached, your transaction history and shopping data could be exposed, but your banking credentials would not be—you entered those into your bank or Plaid, not into Upside. Your bank account itself would not be at risk. You would likely receive a notification from Upside and should monitor your accounts for suspicious activity, but the risk is to your privacy, not your money.

Is Plaid safe?

Plaid is a widely used service that handles connections for thousands of apps and financial institutions. It uses the same encryption and security standards as banks. However, Plaid has experienced data breaches in the past, so it is not risk-free. If you want to avoid Plaid entirely, you can link your debit card directly to Upside instead, though this gives you fewer features.

Can I use Upside without linking my bank account?

Upside requires either a bank account or debit card link to function—it needs to see your purchases to award cashback. If you don't want to link, you can use other cashback apps that let you upload receipts manually instead, though these typically offer lower rewards.

Does Upside sell my data to third parties besides retailers?

Upside's stated policy is that it sells aggregated, anonymized shopping data to retailers and partners. The company does not sell individual-level data or your personal information. However, you should review Upside's privacy policy directly to understand exactly what data sharing is permitted, as policies can change.