No bank connection
We never ask for bank logins, card numbers or account access. Every figure is one you typed in.
Private by design,
not by promise
A finance app only works if you trust it. Here is exactly what we store, how it’s protected, and who else is involved.
Only you see your data
Every request is checked against your session, and every database query is limited to your own records.
No ads, nothing sold
There are no advertising trackers, and your data is never sold, shared or used to profile you.
Yours to take
Export your net worth history as a CSV file whenever you like.
Delete means delete
Removing an account, transaction, loan or goal deletes it from the database. There is no hidden archive.
Secured by default
Encrypted connections everywhere, hashed passwords and short-lived, signed sessions.
What we store
- Your login
- Your email address and a hashed version of your password (never the password itself).
- What you enter
- Accounts, balances, transactions and transfers, loans and repayments, goals, and cash flow entries.
- Your session
- A signed cookie that keeps you logged in for up to 7 days.
What we never store
- Bank or card credentials
- Your contacts, location or device data
- Advertising or cross-site tracking identifiers
Security
Passwords are hashed with scrypt and a random salt before they’re stored. Nobody, including us, can read your password back.
Sessions use a signed cookie that scripts on the page can’t read, that’s only sent over HTTPS, and that expires after 7 days.
Access is checked on every request, and every database query is scoped to your account, so one person’s records can never appear in another’s.
Connections between your browser, the app and the database are encrypted.
Services we rely on
- Vercel
- Hosts the app, and counts page views with cookie-free Web Analytics.
- Neon
- Runs the Postgres database where your data is stored (AWS, US East).
- ExchangeRate-API
- Provides exchange rates. Our server asks for current rates; none of your data is sent.
Cookies
One cookie, set only when you log in, to keep you logged in. Page view counts are collected without cookies. There are no advertising or third-party tracking cookies.
Last updated October 16, 2026