Security & privacy
What we protect, and how — explained plainly.
We prefer clear explanations over big promises. This page describes our design approach. It is not a certification or audit statement.
Three kinds of data, handled differently
Your device
groceries: 86.00
rent: 1,400.00
Key stays on device
Encrypt
In transit
Sync service
Unreadable payload
On your device
Financial records
Transactions, balances, categories and notes are managed locally and readable on your authorized devices.
Encrypted sync
Synchronization payloads
When you sync or share, records are encrypted on the device first. The service stores them in encrypted form.
Server-side
Account & authorization metadata
To operate sync, the service keeps what it needs: your account identifier, authorized devices, sharing permissions and timestamps.
Principles
Keys stay on your devices
Encryption keys are created on your authorized devices. Data is encrypted there before it is synchronized or shared.
Minimal server-side metadata
To run synchronization the service needs some metadata, such as your account identifier, authorized devices, sharing permissions and timestamps. It is not used to read your financial contents.
You authorize devices
Each new device must be authorized. Review your device list regularly and remove anything you don't recognise.
Recovery is your responsibility too
Because only you hold the keys, losing every authorized device and your recovery options may mean your encrypted data cannot be restored.
No advertising tracking
This website does not use third-party advertising trackers.
Our security approach will continue to evolve. Any independent reviews will be published here only once completed.