Only you. Your budget, spending, investments and profile (age, salary…) are encrypted with a key that is itself locked by your password. The person running this site only ever has the scrambled version on disk, and no way to reset or bypass your password. That's why we give you a recovery code at sign-up. Lose both your password and the code and your data can't be recovered. There are no security questions or email resets on purpose: anything that could reset your password without your secret could also read your data. You can test your code on the Account page, and optionally have it emailed to you once (we never store your address).
Honest limit: while you're signed in, the server holds your decrypted data in memory to show you your dashboard. Encryption protects what's stored, not against a host who deliberately changed the site's code to capture passwords. The site operator can see that an account exists (username, display name, password hint) but not its contents.
Username, display name, an optional password hint, and your encrypted data. We don't ask for an email or collect analytics. Delete your account on the Account page and everything is removed.
A household is a shared budget for family or a group. Its book is encrypted with a key that only the members can open, through their own passwords, so the person running this site can't read it. Anyone with the invite link can join, so share it only with people you trust. The link works for a week, and making a new one cancels the old one. Removing someone changes the key, so their access ends.
What the site operator can see: that a household exists and which accounts belong to it. Not its name or contents. Your personal book is never visible to the household. You choose whether to share a summary of your spending, earnings or investments with it, and you can turn that off at any time. Members who can see a summary can of course remember it.
Files you upload on the Documents page (tax forms, pay stubs, receipts) are encrypted the same way, including their names and notes. They are only ever offered as downloads. They count toward a storage limit, and deleting a file or your account removes them.
On the Account page you can choose to share an anonymized snapshot to help improve the app and train models: spending by month and category (rounded), income and balances as ranges, budget percentages. No names, notes, exact dates, or free text, and nothing that links it back to you. Switch it off and your snapshot is deleted. Some of the training data is synthetic (made up).
The chat sends a summary of your totals (no individual transactions or salary) to a third-party AI provider (OpenRouter) to phrase answers. It doesn't work without that, so don't use chat if you'd rather not.
"Load sample data" fills your book with made-up numbers so you can try the features. Empty your book on the Account page to remove them.