Your statement never leaves your browser
A tool that reads your spending has to earn that access. Here's exactly what happens to your data, including the parts that aren't flattering.
CSV upload is entirely local
When you drop a statement into the app, it's parsed by JavaScript running on your own machine. The file is never uploaded, never transmitted, and never stored on a server. Turn off your network connection after the page loads and it still works.
You can verify this yourself — open your browser's network tab and drop a file in. There's no request.
Connecting a card uses Plaid, read-only
If you link an account, it goes through Plaid, the same infrastructure most banking apps use. Two things worth knowing:
- We never see your bank credentials. You enter them with Plaid, not with us. We receive a token that reads transactions and balances.
- Read-only. The connection cannot move money, make payments, or change anything about your account. It can only read.
How access tokens are stored
The token Plaid issues is encrypted with AES-GCM before it's written to storage, using a key held separately as a server secret. Someone who obtained a dump of the database would get ciphertext, not tokens. This is verified by an automated test that asserts the token is unreadable in storage and that a wrong key yields nothing rather than leaking.
Sessions are signed HTTP-only cookies, sign-in is rate-limited per IP, and every data route rejects requests without a valid session.
What we don't do
- We don't sell your data. There's no advertising network here and no third-party trackers on this site.
- We don't need your Social Security number, and we don't pull your credit.
- We don't ask for card numbers. The app works from transaction history, not card details.
The honest caveats
This is an early product. It hasn't been through a third-party security audit or a SOC 2 examination. If you're deciding whether to link a real account, that's a fair thing to weigh — and CSV upload gives you the full product with none of that risk.
Disconnecting removes the token from our storage and revokes it at Plaid in the same action, so access ends immediately rather than merely being hidden.