How your data is protected

End-to-end encrypted

It is encrypted on your phone before anything is sent. What reaches our servers is a block of unreadable data — unreadable by us, by anyone we hand it to, and by anyone who compels us.

Where the key lives

On your phone, and in your iCloud Keychain so it reaches your other devices — which Apple encrypts with a key Apple does not hold either.

We do not have a copy. That is the point, and it is also the risk: lose every device with iCloud Keychain off, and nobody can recover your will. Not even us.

Your income, expenses, savings and assets are encrypted in transit and at rest, but not end to end — see what we can and cannot see, below.

Encryption at rest protects your data against a stolen disk; it does not stop us reading it. So here is exactly where the line falls.

It never connects to your bank

There is no Plaid, no open-banking link, and no screen that asks for banking credentials. You enter figures yourself. That is slower, and it means a breach here cannot reach your accounts.

Receipts are read on your device

Scanning uses Apple’s Vision framework on the phone itself — the text is extracted locally and only the amount, date and merchant are saved. The photo is uploaded only if you tick "keep image"; leave it unticked and the picture never leaves the device.

A check before we email you a code

Asking for a sign-in code makes us send mail, so the web asks Cloudflare Turnstile to confirm a real browser made the request. It is usually invisible — it watches how the page behaves rather than asking you to identify traffic lights — and it stops a script having us post codes to strangers. The check is verified on our server, not just in the page, because a widget nobody verifies is decoration.

Passkeys, not passwords

Sign-in supports passkeys, Apple and Google — credentials that cannot be phished or reused, because there is no password to steal. Email codes are single-use and expire in minutes.

A separate lock on the app itself

An app passcode with Face ID or Touch ID, held in the iOS Keychain. Someone holding an unlocked phone still cannot open your figures.

Encrypted in transit and at rest

Every request is HTTPS. Data is stored on Convex, which encrypts at rest; the app adds no unencrypted side channel of its own.

It asks for very little

An email address, and the figures you choose to enter. No phone number, no address, no contacts, no location, no advertising identifier, and no third-party analytics watching what you do.

Your data is yours, and leaving should be as easy as arriving.

Export everything

A full export of your records, from Profile, in a format you can open elsewhere.

Delete your account

Permanently, from inside the app. It removes your records rather than flagging them hidden.

See your devices

Sign out of other devices from Profile → Security whenever you want to.

Security email

You are told when a new device signs in, or when something looks wrong. These are never affected by marketing preferences.

A security page that lists only strengths is a marketing page. These are real gaps, stated plainly, and each line stays here until it stops being true.

No third-party security audit

Nobody outside the project has reviewed the code or the infrastructure. There is no SOC 2 report and no ISO 27001 certification, and this page will not claim one before it exists.

No penetration test

The app has not been tested by a professional attacker. That is planned before wider release, not done.

No bug-bounty programme

There is no paid disclosure programme yet. Reports are still very welcome — see below — and will be answered by a person.

If you have found a vulnerability, please tell us before telling anyone else. Include what you did and what you saw; a proof of concept helps but is not required.