What protects your budget.
Six technical commitments. If one of them changes, it changes here first.
Sign in without a password
You sign in with a code sent by email, or with Apple or Google. No password to remember, so none to steal. Each signed-in device can be signed out in one tap from the settings. The code expires within minutes and locks after a few attempts.
Face ID, if you want it
Turned on, it locks the app when it opens: nothing shows before your face or the device passcode.
Encryption
Exchanges go over TLS. Daily backups are encrypted before they leave the server.
Hosted in the European Union
The servers and the database are in the European Union. Providers based elsewhere, and what they see, are listed in the privacy policy.
Household walls
Members see the shared bills, never your personal spending or your income. Every access is checked by the server, and tests block any version that would let anything else through. Your photo is never public: only the members of your household see it.
Real deletion
A deleted account is erased 30 days after the request, then leaves the encrypted backups no later than three months afterwards.