Honest & local-first.

By design. Most finance apps use third-party services to pull your transactions directly — which means your bank credentials end up on someone else's server, with ongoing access to your account. A CSV export is a file your bank already gives you. Same data, no credentials handed over, no third-party aggregation service in the middle, no ongoing access. You choose what to import and when.

No — and this isn't just a policy. It's how I built the app. By default, the app saves your data to your browser on your device. I built no mechanism to transmit it anywhere and run no server to receive it. If you choose to sign in, the app encrypts your data on your device before syncing to Cloudflare's servers, and neither Cloudflare nor I can read it. Either way, I have no way to see your financial data.

Not through my servers — and that's structural, not just policy. Because your financial data stays on your device unless you enable sync, I don't maintain a server-side copy in readable form. When sync is enabled, your data is encrypted on your device before upload using a passphrase only you know — that passphrase is never sent to the server or stored anywhere I can access. This significantly limits what someone accessing the database could learn, but no software can eliminate every security risk — your device and browser security while signed in, your sync passphrase strength, and the integrity of the app code all matter too. Here are the three things someone could theoretically attack, and how each is protected:

• The app files — Cloudflare hosts these. Deploying any change requires my Cloudflare account credentials plus my physical machine, and that account uses two-factor authentication. An attacker would need both to make any change.
• The source code — I keep it on GitHub; that account also uses two-factor authentication. Because the source is public, anyone can verify exactly what the app does and spot anything unexpected.
• Your synced data — only relevant if you've signed in. The app encrypts your data on your device before sending it to Cloudflare's Workers infrastructure — even if someone accessed the database, they'd find only encrypted data they can't read. Each API request requires a valid session token, restricting database access to your own account.

None of these paths expose your readable financial data to me or anyone with access to my infrastructure. The remaining risk surface is your own device and browser security while signed in, and the strength of your sync passphrase — things outside this app's control.

Two scenarios:

• The website stops working — you'd see a 'page not found' message when you try to open it, but your data is unaffected. Without signing in, it lives on your device. With sign-in, the app encrypts it on your device and stores it on Cloudflare's infrastructure, tied to your email address.
• I stop maintaining it — the app keeps working exactly as-is. No data loss, no changes.

In either case, export your transactions from the Spending tab, budget history from the Budget tab, or a full JSON backup (everything in one file) from the ⚙ menu in the nav bar — anytime. Your data outlives the app.

Yes — and not just because I say so. Your browser processes the CSV entirely on your device and uploads nothing. The app reads the file, parses the transactions locally, and discards the rest — I never receive the file or its contents. If you've signed in, the app encrypts the parsed transaction records on your device and syncs them to Cloudflare's servers, but your original CSV file never leaves your computer.

Yes. When you sign in, the app encrypts all your data — transactions, budgets, accounts, snapshots — on your device using AES-256-GCM before sending it to Cloudflare's servers. The server stores only encrypted data it cannot read. The app derives the encryption key from a passphrase you set (not your sign-in email) and that passphrase never leaves your browser, so the server never has what it would need to decrypt your data. There's no way to reset it: if you forget your sync passphrase, you can't recover your synced data — your local data on this device is unaffected either way. If you don't sign in, you don't need encryption — your data never leaves your device in the first place.

Not in readable form — and that's architectural, not a policy choice. If you haven't signed in, the app stores your data only on your device and I receive none of it — nothing to hand over. If you have signed in, the app encrypts your data on your device before sending it to Cloudflare's servers, so even a legal request would produce only encrypted data that neither Cloudflare nor I can read. Either way, there's nothing usable for me to hand over.

Only one, set during Google sign-in: a 5-minute security cookie that prevents a forged sign-in from attaching someone else's account to your browser. It expires on its own and is never used for tracking. Sign-in also stores a session token in localStorage (not a cookie). Umami sets none. You can block analytics with any privacy extension.

Spyware is malicious software that secretly records what happens on your device — it could capture anything visible on your screen or stored locally, including data this app saves to your device. This risk applies to all software that runs locally, not just this app. I can only control what's in the app's code — your device is yours to protect. Keeping your operating system and browser updated is the single most effective step you can take.

Yes — on your first visit the app installs a service worker that caches everything it needs (the app itself, fonts, and libraries). After that, it works fully offline even after closing the tab or restarting your browser — no connection required. You can view your data, add transactions, and use every feature offline. The only things that need a connection are: the very first load (to install the cache), downloading the community rules file when you open the import screen (optional — the app works without it), and syncing if you're signed in.

Sign-in and sync run on Cloudflare Workers with a D1 database, which is the same infrastructure that already serves the app's files. Because the app encrypts your data on your device before sending it, none of your financial data leaves your device in readable form, and no third-party JavaScript needs to load from an outside CDN. The app encrypts your synced data on your device before sending it to Cloudflare's infrastructure, so Cloudflare stores only encrypted data it cannot read. Sign-in is either Google or a passwordless email link — no password to store or steal. If that's still a concern, skip sign-in — the app works fully without it, and the source code is public so anyone can verify exactly what it does.

Yes. The full source code is on GitHub — it's a single HTML file with no build step or server required. Download it and open it directly in your browser, or host it on any static file host. Used locally (no sign-in), your data stays wherever you run it, fully independent of trakyodollas.com. One caveat: the optional sign-in/sync feature calls this project's own Cloudflare Worker API — a self-hosted copy that syncs still sends its encrypted data there, not to a Worker you control. Skip sign-in on a self-hosted copy and it behaves exactly like the hosted version, entirely local.

The app uses two open-source charting libraries — Chart.js for the main spending bar charts (including Trend), and D3.js for the Split, Flow, and Net Worth views. Chart.js, D3, and the Flow chart's d3-sankey plugin are all self-hosted from this app's own /lib/ folder. No code loads from any outside CDN. None of this sends any financial data — these files contain only JavaScript. Your financial data stays intact on your device.

No — and this isn't just a policy, it's how browsers work. Each website gets its own private storage, and your browser strictly enforces those boundaries. No other site can reach what this app stores — not by policy, but by technical design.