Where your numbers actually live
Your vault is a file on your own disk, encrypted, and nothing reads it without your password. This page is the honest version: what is always true, what is true until you switch something on, and what we never see either way.
Always true
There is no account
No sign-up, no email, no password reset through us. Your password is the only way in, and we cannot reset it, because we never hold it.
The vault is encrypted at rest
The file on disk is ciphertext. Opening it needs your password; there is no server-side copy to compare against.
Sync is a folder
Two devices agree by writing encrypted log files into a folder your own cloud client already syncs. We do not run a sync service.
Removing a device rotates the key
Revoking a phone is not a flag in a database; the household key is rotated so the removed device cannot read new records.
True when you switch it on
| If you enable | Then this leaves your Mac | And this never does |
|---|---|---|
| Bank sync (SimpleFIN) | Your bank connection token, to the provider you chose | Your vault, your password, other accounts |
| Live prices | Ticker symbols, to a price feed | How many shares you hold, or your net worth |
| On-device AI | Nothing, while it runs on this Mac | Everything, unless you explicitly pick a cloud model |
| Quasar pairing | The household key, to your own phone, encrypted to it before it moves | Anything to us |
| Updates always on | Your version number, to GitHub, at launch | Your data, your household, that you exist as a person |
| Licence check always on | Your licence key, to Polar, once a week after activation | Anything about what is in the app |
| Direct sync relay when needed | Encrypted records, through a public iroh relay, when your devices cannot connect directly | Your household key, so the relay sees only ciphertext |
With every optional service off, the app still opens three connections, and we would rather name them than have you find them: a signed update check to GitHub at launch, a licence check to Polar once a week, and, when two of your own devices sync and cannot reach each other directly, a public relay that carries only ciphertext. None of the three carries anything from your vault.
What we see
We see whether a version was downloaded, and anonymous page counts on this website. We do not see your household, your accounts, your figures, or that you exist as a person. There is no analytics SDK in the app.