Personal Finance privacy

Sign-in and workspace access

Google sign-in supplies your email address and a stable Google account identifier (sub). The app uses them to verify your invitation, identify your account and authorize access to your workspace. Session cookies keep you signed in. Google manages its own sign-in and consent screens.

Your workspace can contain account details, balances, transactions, categories, notes, schedules and reconciliation records that you enter or import. These records are stored in AWS. Access controls separate invited users’ workspaces; the app operator has administrative access to stored records for operating and supporting the service.

Bank transaction downloads

Where a bank connection is configured, Plaid provides account and transaction information. Bank downloads are read-only and start when you choose to sync bank transactions. Entries, schedules and transfers recorded in the register are bookkeeping records: the app does not initiate electronic payments or move money.

Bank access credentials are kept separately from financial records and are excluded from portable financial backup archives.

Optional Google Drive backups

The owner can choose to connect Google Drive to copy encrypted portable archives into a separate app-managed backup folder. This connection requests Google’s drive.file permission, not whole-Drive access. The implementation uploads, verifies and manages its own app-created backup files. It does not read unrelated Drive documents or manage existing local-uploaded backups or recovery-key files.

Google authorization credentials used for continuing Drive access are stored on the server in an encrypted secret store. They are not included in portable archives. The app uses this connection to copy archives, verify their remote checksums and apply backup retention.

App-managed backups and Drive copy attempts run when you use the app or explicitly request them. There is no scheduled timer for these app-managed copies. AWS backup success and a verified Drive copy are reported separately.

You can choose Stop Drive backups in Settings. This stops future copies and retains existing files. You can also review or revoke the app’s Google access through your Google Account connections. Removing Google access does not itself delete financial records already stored by the app or existing backup files.

Encryption and recovery material

Portable archives are encrypted using the configured public recovery key. The hosted app does not request, receive or upload your private recovery key or recovery passphrase. Keep the matching recovery-key file and its passphrase separately protected; both are needed to restore an archive.

Workspace access controls and backup encryption serve different purposes. The running app processes financial records to display the register, calculate balances and create backups; portable archive encryption does not remove the operator’s administrative access to the live service.

Retention and removal

Portable backup retention keeps up to 30 daily and 12 monthly recovery points. These are retention groups, not a promise that a backup runs on days you do not use the app. Separate AWS recovery history can also retain up to 10 points from before significant changes.

Older app-created Drive copies may be moved to Trash under this retention policy. The app does not empty your Drive Trash; Google Drive’s usual Trash and removal controls apply. Existing backup files and recovery-key files outside the app-managed set are preserved.

Changing or removing a live financial record does not immediately remove it from previous backups. Earlier copies can retain those records until their retention period ends or the copies are manually removed. Disconnecting Drive, signing out or losing workspace access does not erase saved records or backups.