Two different things get called private in this category, and they're worth separating. The strongest form is structural: the app never asks for a bank login, so there's nothing to breach or sell — Gravity, Bobby, and a default Actual Budget install work this way, with your list living on your device (or, for Actual, a server you control). The weaker form is policy-based: apps like Copilot link your accounts through an aggregator with read-only access and promise not to sell the data. That can be a reasonable trade for automation — but it's a promise plus a third-party connection, not an architecture.
A practical middle path: keep the account-linked app only if you genuinely use its automation, and move the subscription-tracking job — renewal dates, trial deadlines, cancellation steps — to a no-link tool. Subscriptions are the one finance category where manual entry is painless, because you already know what you signed up for.