Privacy
This is a self-hosted personal finance application. It runs on the machine or server that you or your administrator controls. The plain summary: your financial data is stored in this installation's own database, it is not sent anywhere else, and nothing here tracks you.
Last updated 13 September 2026
Who is responsible
Whoever operates this installation is the data controller. It is not a hosted service, and the people who wrote the software have no access to it, receive nothing from it, and cannot see anything you enter.
What is stored
| Account details | Your name, email address and a one-way hash of your password. The password itself is never stored and cannot be recovered or displayed — only replaced. |
|---|---|
| Financial records | The accounts, balances, valuations, transactions, budgets, goals and recurring items you enter or import. |
| Imported statements | The rows you confirm on the import preview. The uploaded file itself is read and discarded — it is not retained. |
| Preferences | Your reporting currency and light/dark theme choice. |
| Activity log | Sign-ins, administrative actions and significant changes, with the IP address and browser that made them. This is what makes unauthorised access noticeable. |
| Sessions | An identifier, IP address, browser string and last-active time for each browser you are signed in from. |
What is not stored
- No card numbers, bank credentials or online banking logins. The application never connects to a bank — statements are imported as files by you.
- No analytics, advertising or behavioural tracking of any kind.
- No third-party scripts, fonts or stylesheets. Every page loads only from this installation, so no outside party learns that you visited, or when.
Who can see your data
You can see your own records, and nobody else's. Administrators of this installation manage user accounts and shared reference data such as exchange rates; the admin screens deliberately show counts and never the contents of anyone's accounts or transactions. An administrator with access to the underlying server or database file can, of course, read anything on it — that is true of any self-hosted system and is worth being clear about.
How long it is kept
Your records are kept until you delete them. Sessions expire after 120 minutes of inactivity. Password reset links expire after 60 minutes and work only once. Deleting your data is immediate and cannot be undone.
What you can do
- Export everything as JSON from the Settings screen, at any time.
- Delete everything from your profile. This erases every account, transaction, budget and goal you own.
- See where you are signed in, and sign other browsers out, from your sessions.
- Change your password at any time, which is worth doing if this installation was set up from the seeded default.
Security
- Passwords are hashed with bcrypt. Nobody — including an administrator — can read them.
- Sign-in, registration and password reset are rate limited.
- Every form is protected against cross-site request forgery.
- A Content-Security-Policy forbids loading script, styles, images or fonts from any other origin.
- Requesting a reset link gives the same answer whether or not the address has an account, so the form cannot be used to discover who has one.
If this installation is reachable over a network, it should be served over HTTPS. Over plain HTTP the session cookie is readable by anyone able to observe the connection.
The only email this application sends is a password reset link, and only when you ask for one. There are no newsletters or notifications. Depending on configuration, that mail may be written to a local log file rather than sent.
Cookies
Three cookies at most, all of them functional. See the cookie policy for the full list.