Privacy Policy

This instance is operated by the operator of this instance. Your data lives in that instance's own database and file storage. It is not pooled with other deployments, and there is no central service collecting from them.

• Account details — your email address, an optional display name and phone number, and an optional profile photo. Your password is never stored; only a bcrypt hash of it is.
• Your date of birth — collected once when the account is created, to check the age requirement below. It is stored on your account and is not used for anything else: not for personalisation, not for marketing, and it is never sent anywhere outside this instance.
• Financial records — transactions, recurring rules, budgets, savings goals, accounts and the balances you log for them, investment holdings, and exchange rates you configure.
• Documents— any file you upload (payslips, Form 16, tax returns, bank statements), stored on the server's own disk.
• Household activity— a log of who in your household did what and when (for example “deleted account — HDFC Savings”), visible to every member of that household.
• Notification subscriptions — if you turn on push notifications, the subscription your browser issues for that specific device.

Every record belongs to a household, and every member of your household can see all of it— including uploaded documents and the activity log. That is the point of a shared household, but it is worth being explicit: inviting someone gives them full visibility of the household's finances, not a limited view. Members of other households cannot see any of it.

Whoever administers the server can technically access the database and the uploaded files, in the same way that is true of any self-hosted application.

This app has no analytics, no advertising, and no third-party tracking. Data is sent outward in exactly four cases:

• AI features (Anthropic).Tax Insights sends that financial year's aggregated category totals, plus any salary/TDS figures previously read off your uploaded payslips or Form 16, to the Claude API. Receipt, bank-statement and bill scanning send the photo or PDF you chose; document auto-fill sends the file you're about to upload. Natural-language quick-add sends the sentence you typed. These run only when you click the button that starts them — nothing is sent in the background. Every call uses the Claude API key your household's owner saved under Settings, so usage is billed to that key and visible in that Anthropic account; the key itself is stored encrypted and is sent only to Anthropic. Results are shown for you to review and are never stored, with one exception: the figures extracted from a document at upload (gross salary, tax deducted, declared deductions) are kept alongside that document so Tax Insights can use them. Without a saved key, these features are simply unavailable.
• Sign in with Google. If you choose to sign in with Google (and only then), Google tells this app your email address, name and whether Google has verified that address; nothing about your finances goes the other way. Google, in turn, knows that you signed in to this app and when. Depending on how the instance is configured, that handshake may be brokered by Supabase (an authentication service), in which case Supabase also holds your email address and name, and a record of the sign-in — but nothing else from this app. An account created this way has no password until you set one from the Forgot password page.
• Email (Resend). Your email address and the message body are handed to Resend to deliver sign-up verification, password-reset and household-invite emails.
• Push notifications.If you opt in, bill/budget/goal alerts are delivered through your browser vendor's push service (Google, Mozilla or Apple, depending on your browser). The message text goes through them by necessity.

Uploaded documents are never sent to any third party, including the AI features. They stay on the server's disk and are only ever streamed back to you when you download them.

Worth stating explicitly rather than leaving as an absence: this app runs no analytics, product-analytics SDK, heatmap, or session-replay tool. Nothing records your screen, your keystrokes, your mouse movement or the values you type into a form, and no third-party script runs on any page — so there is no recording of your salary, balances or documents to be masked, retained or leaked in the first place.

Two things back that up rather than leaving it as a promise. Every page is served with a Content-Security- Policy that permits scripts and stylesheets only from this instance's own origin, so an outside tracking snippet cannot be added without also changing the server configuration. And the fonts the app uses are downloaded at build time and served from this instance, not from Google's servers — loading a web font from a third party would hand them your IP address on every page view, which is exactly the kind of quiet data flow this page exists to rule out.

Every email from this app is transactional: a sign-up verification link, a password reset you asked for, or a household invite someone sent you. No marketing or promotional email is sent, so there is no mailing list to be on and nothing to unsubscribe from. Each message identifies who sent it and carries the operator's postal address. If a promotional email ever is introduced, it will be opt-in and will carry a working unsubscribe link.

One cookie is used, and it is strictly necessary: the session cookie that keeps you signed in. There are no advertising or analytics cookies. Your browser also stores two preferences locally — your light/dark theme choice and whether the sidebar is collapsed. Those never leave your device.

Deleting a transaction or recurring rule moves it to Trash, where it stays until you permanently delete it from Settings. Nothing is purged on a timer. Deleting a document removes both the database record and the file on disk immediately. Deleting a user account removes that user; deleting a household cascades to everything the household owned.

Passwords are hashed with bcrypt and never stored or logged in plain text. Password-reset and email-verification links are stored only as SHA-256 hashes, are single-use, and expire (30 minutes for a reset, 24 hours for a verification). Changing your password or choosing “sign out all devices” invalidates existing sessions within a few minutes. Every database query is scoped to your household, and document downloads check ownership before streaming a file.

No system is perfectly secure, and this one is a personal-scale application rather than a bank. Use a unique password, and keep in mind that the security of a self-hosted instance also depends on how the server itself is run.

• You can edit or delete any record from within the app at any time.
• You can export your transactions to CSV from the Transactions page.
• You can turn push notifications off from your profile, or in your browser's settings.
• You can ask for your account and its data to be deleted by contacting whoever runs this instance (see below).

This app is for adults. You must be 18 or older to create an account or join a household, and the sign-up form asks for a date of birth and refuses a younger one — as do the invite-acceptance form and, on first entry, an account created through Google sign-in. No personal information is knowingly collected from a child: an account that answers with an under-age date of birth is deleted rather than kept on file. If you believe a child has nonetheless created an account here, contact us using the details below and it will be removed.

If what this app does with your data changes, this page changes with it and the “last updated” date above moves. Material changes will be surfaced in the app rather than left here quietly.

This instance has not configured a contact address. If you are running it, set the SUPPORT_EMAIL environment variable; if you are using someone else's instance, contact whoever gave you access.

See also the Terms of Service and the Copyright / DMCA page.