Privacy

What we collect

• Sign-in identity: your email address. When you ask for a sign-in link, we also keep the time and the IP address it was asked from, to stop abuse.
• Sessions: a session cookie, stored by us only as a hash, with its expiry and a form protection token.
• Passkeys: if you add one, its public key, ID, type, when you added it and when you last used it. The private key never leaves your device or password manager.
• Your budget: accounts, currencies, opening balances, transactions (date, payee, note, amounts), categories, allocations, reconciliations, and the history of every edit.
• CSV imports: the file name and a fingerprint of each file; the file text until it is imported; for every imported row, its original cells and the values read from them; saved mappings with up to 50 sample lines of a file; category rules.
• Request logs: Cloudflare logs each request (address, time, status and connection details such as IP address) and any error message.

No analytics, ads or third-party trackers. The only cookies are the sign-in and session cookies.

What we use it for

Only to run the app: to sign you in, show and calculate your budget, import your files, and find and fix errors. We do not sell or share your data, or use it for advertising.

Cloudflare hosts the app, its database and its logs, and sends the sign-in emails.

How long we keep it

Profile, budget data and history

Until you delete your profile.

Imported rows and mapping samples

Until you delete your profile.

File text of an upload you import

Deleted when the import completes.

Upload you never import

Deleted at your next upload once older than 7 days, or with your profile.

Session records

Stop working after 7 days. Deleted when you sign out or delete your profile.

Sign-in link records

Stop working after 10 minutes or one use. Deleted after a day.

Passkeys

Until you remove them in Settings or delete your profile.

Cloudflare request logs

Up to 7 days.

Database backups

Up to 30 days.

Budget history is append-only: editing or deleting a transaction, or undoing an import, records a change and keeps the earlier version, so the history adds up.

Deleting your profile

Settings, then Delete profile and data. It is immediate and cannot be undone: your profile, budget, history, imports, mappings, rules and all sessions are deleted in one step.

Database backups and Cloudflare logs expire on the schedule above. Remove the passkey from your device or password manager yourself. Signing in again creates a new, empty profile.

Exporting your data

Settings, then Export data. Download JSON gives everything listed under Your budget and CSV imports: accounts, currencies, opening balances, transactions with every ledger line, categories, assignments, reconciliations, the history of every edit, saved mappings, category rules and imported rows. Amounts are exact, with their currencies, and the format is documented.

Download CSV lists your current transactions, one row per account, for a spreadsheet. Neither file includes sessions, request logs or the text of uploads you never imported. Export stays available on every plan, so you can take a copy before deleting your profile.