Simple, honest,
local-first.

By design. Most finance apps use third-party services to pull your transactions directly — which means your bank credentials end up on someone else's server, with ongoing access to your account. A CSV export is a file your bank already gives you. Same data, no credentials handed over, no third-party aggregation service in the middle, no ongoing access. You choose what gets imported and when.

No — and this isn't just a policy. It's how the app is built. By default, the app saves your data to your browser on your device. I built no mechanism to transmit it anywhere and run no server to receive it. If you choose to sign in, your data syncs to Google's servers via Firebase — Google holds it, not me, and only you can read it. Either way, I have no way to see your financial data.

No — and this isn't just a policy, it's structural. Neither the app nor the developer holds your financial data, so there's nothing to steal. That said, here are the three things someone could theoretically attack, and how each is protected:

• The app files — hosted on Cloudflare. Deploying any change requires the developer's Cloudflare account credentials plus their physical machine, and that account uses two-factor authentication. An attacker would need both to make any change.
• The source code — stored on GitHub, also protected with two-factor authentication. Because the source is public, anyone can verify exactly what the app does and spot anything unexpected.
• Your synced data — only relevant if you've signed in. Firebase security rules enforce that your data is accessible only with your own sign-in credentials. An attacker would need to compromise your account, not the developer's.

None of these paths expose your financial data — the app and the developer simply don't hold it.

Two scenarios:

• The website stops working — you'd see a 'page not found' message when you try to open it, but your data is unaffected. Without signing in, it lives on your device. With sign-in, it lives on Google's servers via Firebase — tied to your sign-in credentials, not to this app.
• The developer stops updating it — the app keeps working exactly as-is. No data loss, no changes.

In either case, export your transactions from the Spending tab, budget history from the Budget tab, or a full JSON backup (everything in one file) from the overflow menu (⋯) on the Spending tab — anytime. Your data outlives the app.

Yes — and not just because I say so. Your browser processes the CSV entirely on your device and uploads nothing. The app reads the file, parses the transactions locally, and discards the rest — I never receive the file or its contents. If you've signed in, the parsed transaction records sync to Google's servers via Firebase, but your original CSV file never leaves your computer.

No — and this is technical, not just policy. If you haven't signed in, the app stores your data only on your device and I receive none of it — nothing to hand over. If you have signed in, your data lives on Google's servers via Firebase — any legal request would need to go to Google directly, not to me. Either way, there's nothing for me to hand over.

No — Umami sets no cookies and uses no persistent identifiers. Google's infrastructure may set cookies if you choose to sign in for the optional sync feature. You can block analytics entirely with any privacy extension.

Spyware is malicious software that secretly records what happens on your device — it could capture anything visible on your screen or stored locally, including data this app saves to your device. This risk applies to all software that runs locally, not just this app. I can only control what's in the app's code — your device is yours to protect. Keeping your operating system and browser updated is the single most effective step you can take.

Yes — after the initial page load, the app runs entirely in your browser with no connection required. You can view your data, add transactions, and use every feature offline. The only things that need a connection are: loading the app for the first time, downloading the community rules file when you open the import screen (optional — the app works without it), and syncing if you're signed in.

Honest answer: Firebase is Google infrastructure. I use it here for one thing only — optional sign-in and data sync (authentication and database). The app's files are served by Cloudflare, not Firebase. I chose Firebase for auth because it's reliable, well-audited, and handles the hard parts of secure sign-in. The tradeoff is that Google's servers store your data if you choose to sync. If that's a concern, skip sign-in — the app works fully without it, and the source code is public so anyone can verify exactly what it does.

Yes. The full source code is on GitHub — it's a single HTML file with no build step or server required. Download it and open it directly in your browser, or host it on any static file host. Your data stays wherever you run it.

The app uses D3.js, a widely used open-source charting library, to draw the spending visualizations. Like most web apps, it loads this library from jsDelivr — a content delivery network (CDN) that serves open-source software files. Your browser fetches it when the app loads. jsDelivr receives no financial data — it only delivers a JavaScript file. The same applies to the Firebase Software Development Kit (SDK), loaded from Google's CDN. If you block either request using a privacy extension, your financial data remains completely safe — charts won't render without D3, but all your data stays intact and accessible.

No — and this isn't just a policy, it's how browsers work. Each website gets its own private storage, and your browser strictly enforces those boundaries. No other site can reach what this app stores — not by policy, but by technical design.