Security
What we do to protect your data, and what we don't. No exaggeration.
The main thing: there's nothing to steal
The risk with a finance app is usually that it holds the keys to your bank. Here those keys don't exist: we don't ask for banking credentials, we have no access to your account, and anyone breaking into our server could not move your money. At worst they would see a list of purchases.
How we protect your account
- Passwords stored with Argon2id, the currently recommended algorithm. We cannot see your password.
- Sessions in signed cookies, marked Secure and HttpOnly, expiring after 14 days.
- Changing your password closes every session open on other devices and voids any pending recovery links.
- Confirmation and recovery links are signed and expire (24 hours and 1 hour). Each recovery link works only once.
- Attempt limits on sign-in and on outgoing email, to stop brute-force attacks.
- All traffic goes over HTTPS, with HSTS enabled.
How we protect the data
- Every query is scoped to your user: one account cannot read or modify another's data.
- We store the minimum: last 4 digits, merchant, amount, date. Never the full card number or your balance.
- The bank email's body is deleted as soon as it is processed; the ones we couldn't read are stored encrypted and removed after 30 days.
- We only accept email coming from a known bank domain; everything else is discarded.
The limits of that encryption
The email bodies we keep are encrypted in the database, and the key lives in the server's configuration. That protects backups, database dumps and stolen disks. It does not protect against someone who gets into the server itself, because that's where the key is. We'd rather say it that way than call it end-to-end encryption, which it isn't.
What this project is not
This is a one-person project. I have no SOC 2 or ISO certification, no security team, and I'm not going to tell you we have "bank-level security" because that would be a lie.
What I can offer you is verifiable:
- The code is open: you can read exactly what we do with your email. View the code.
- You can download all your data and delete your account at any time, without asking permission.
- You can cut off the forwarding from your own Gmail whenever you want.
- This page says what we store and who else sees it, including the uncomfortable parts.
Report a vulnerability
Email me at [email protected]. I respond within 72 hours at most. There's no bug bounty, but there is credit if you want it. Please don't test against accounts that aren't yours.
Last updated: 2026-07-25