Terms
Version 1. Plain language, because the consequences here are unusual and you should know them before you start.
Your passphrase is the key, and we do not have it
Every amount, payee and note you record is encrypted with a key that only your passphrase can unlock. We do not store it, and we cannot read your figures without it.
This is not a marketing claim -- it is how the storage works. If someone stole the entire database they would get row counts and timestamps, but not a single amount, date, payee, or account name.
If you lose it and your recovery code, the data is gone
There is no reset link and no support route back in. That is the direct cost of the paragraph above: a way for us to recover your data would be a way for anyone else to.
Your recovery code is shown once, at registration. Write it down somewhere that is not the device you use this on.
What is readable, honestly
Encrypted: every amount, every payee, every note, every transaction date, the names of your accounts and categories, subscription names and amounts, loan counterparties, principals and instalments, and your phone number.
Not encrypted: which account and category a row belongs to (as opaque numbers), loan interest rates, row counts, and timestamps. Your phone number is stored as a one-way lookup value -- protected by a key on the server rather than by yours, because a sign-in has to find you before you have proved anything.
Changing your passphrase
You can change it whenever you like. We do not force periodic changes: forced rotation makes people pick predictable variations of what they had, which is worse than leaving a good passphrase alone (NIST SP 800-63B).
Changing it re-locks the key; it never re-encrypts or moves your data, so it is quick and cannot lose anything.
Your data is yours alone
Each account has its own encryption key. One person's key cannot open another's rows, so a bug that crossed accounts would return unreadable bytes rather than someone else's money.
Nothing is shared, sold, or sent anywhere. This runs on the machine you installed it on.
No warranty
This is a personal bookkeeping tool, not a bank, an accountant, or tax advice. Keep your own records for anything that matters legally.