How we handle your data

Parsed on this device

Bank statements and tracker exports (CSV, QIF, OFX/QFX, PDF text — including Cashew, Actual Budget, GNUCash, and Firefly III) are parsed in your browser. Bytes are not posted to our servers, an LLM, or a third-party parser. Open the network tab while a file is parsed — that emptiness is the product.

What stays in this browser

• localStorage holds the portrait you typed, commitments, an evidence pack of derived figures — not a transaction register — and year archives of last compiled plans, until you clear this origin.
• sessionStorage holds statement rows only while you review them. Closing the tab drops the register.
• IndexedDB holds the last saved vault document, an optional folder handle, optional OAuth tokens for your cloud — not ours — and an optional passkey credential id.

Encrypted vault files

A .ndv file is AES-GCM. The wrapping key is either a passphrase (PBKDF2, 600,000 iterations) or a passkey (WebAuthn PRF when your authenticator supports it). Raw transactions are off unless you check “Include raw transactions.” There is no recovery for a lost passphrase or passkey. A wrong unlock fails cleanly and does not overwrite what is already on this device.

What we cannot see

We do not operate a sync server. Shared plans live in the URL fragment, which the browser does not send to us. Optional Sentry or PostHog, if an operator enables them, receive scrubbed events without money-shaped keys. PostHog never identify()s you, never autocaptures, and never records a session. Unknown event names are dropped. The product works with both blocked.

Names we may send, and nothing else:

• instant_mode_completed
• commitment_created
• commitment_verified
• file_correction_kept
• restatement_uploaded
• restatement_read
• business_compiler_checkout_started
• business_compiler_unlocked
• shared_plan_created
• shared_plan_forked
• outcome_changed_next_dollar_yes
• outcome_changed_next_dollar_no
• outcome_later_file_confirmed_yes
• outcome_later_file_confirmed_no

Business compiler

Unlocking sole-proprietor contribution room is guest Stripe Checkout. Email entered there is for the receipt and to restore the unlock — not marketing, and not a Rungline account. We do not keep a first-party user table. After payment, this browser gets a signed httpOnly cookie listing paid tax years. Browsers drop that cookie after about 400 days; receipt restore re-issues it for every paid year. The cookie is not your numbers. Statement bytes still never leave this device. The webhook verifies Stripe's signature; it cannot set the cookie.