To access your data from YNAB, "Can I Buy It? for YNAB" uses HTTPS + OAuth in accordance with the YNAB API. "Can I Buy It? for YNAB" presents you with the YNAB login screen, where you enter your credentials and grant read-only access to your YNAB data. If access is granted, YNAB returns access tokens, which are then stored locally on your device in order to make requests on your behalf.
All communication is done securely using HTTPS and the YNAB API. "Can I Buy It? for YNAB" does not store any data except for the access tokens needed to communicate with the YNAB API. The data attained from the YNAB API is only used temporarily for displaying information within the app, and is discarded afterwards. Your YNAB data is never passed on to any third parties.
You can remove your locally stored authorization tokens by clicking "Log Out" from within "Can I Buy It? for YNAB". You can revoke access from the YNAB side by going to YNAB Account Settings and clicking "Revoke".
"Can I Buy It? for YNAB" does not do any analytics on your data. All data that is attained from the YNAB API is only used for displaying the information within the app, and is discarded afterwards.
If you have any questions, reach out to me at firstname.lastname@example.org.