Honest & local-first.

By design. Most finance apps use third-party services to pull your transactions directly — which means your bank credentials end up on someone else's server, with ongoing access to your account. A CSV export is a file your bank already gives you. Same data, no credentials handed over, no third-party aggregation service in the middle, no ongoing access. You choose what gets imported and when.

No — and this isn't just a policy. It's how the app is built. By default, the app saves your data to your browser on your device. I built no mechanism to transmit it anywhere and run no server to receive it. If you choose to sign in, the app encrypts your data on your device before syncing to Supabase's servers — even Supabase can't read it, and neither can I. Either way, I have no way to see your financial data.

No — and this isn't just a policy, it's structural. Neither the app nor I hold your financial data, so there's nothing to steal. That said, here are the three things someone could theoretically attack, and how each is protected:

• The app files — hosted on Cloudflare. Deploying any change requires my Cloudflare account credentials plus my physical machine, and that account uses two-factor authentication. An attacker would need both to make any change.
• The source code — stored on GitHub, also protected with two-factor authentication. Because the source is public, anyone can verify exactly what the app does and spot anything unexpected.
• Your synced data — only relevant if you've signed in. The app encrypts your data on your device before sending it to Supabase — even if someone accessed the database, they'd find only encrypted data they can't read. Row-level security policies add a second layer, restricting access to your sign-in credentials only.

None of these paths expose your financial data.

Two scenarios:

• The website stops working — you'd see a 'page not found' message when you try to open it, but your data is unaffected. Without signing in, it lives on your device. With sign-in, the app encrypts it on your device and stores it on Supabase's servers — tied to your sign-in credentials, not to this app.
• I stop maintaining it — the app keeps working exactly as-is. No data loss, no changes.

In either case, export your transactions from the Spending tab, budget history from the Budget tab, or a full JSON backup (everything in one file) from the overflow menu (⋯) on the Spending tab — anytime. Your data outlives the app.

Yes — and not just because I say so. Your browser processes the CSV entirely on your device and uploads nothing. The app reads the file, parses the transactions locally, and discards the rest — I never receive the file or its contents. If you've signed in, the parsed transaction records are encrypted on your device and synced to Supabase's servers, but your original CSV file never leaves your computer.

Yes. When you sign in, the app encrypts all your data — transactions, budgets, accounts, snapshots — on your device using AES-256-GCM before sending it to Supabase's servers. Supabase stores only encrypted data it cannot read. The app derives the encryption key from a passphrase you set — not your sign-in credentials — and that passphrase never leaves your browser, so Supabase never has what it would need to decrypt your data. There's no way to reset it: if you forget your sync passphrase, you can't recover your synced data — your local data on this device is unaffected either way. If you don't sign in, encryption isn't needed — your data never leaves your device in the first place.

No — and this is technical, not just policy. If you haven't signed in, the app stores your data only on your device and I receive none of it — nothing to hand over. If you have signed in, the app encrypts your data on your device before sending it to Supabase's servers — even a legal request to Supabase would produce only encrypted data that neither they nor I can read. Either way, there's nothing usable for me to hand over.

No — Umami sets no cookies and uses no persistent identifiers. Supabase and Google's sign-in infrastructure may set cookies if you choose to sign in for the optional sync feature. You can block analytics entirely with any privacy extension.

Spyware is malicious software that secretly records what happens on your device — it could capture anything visible on your screen or stored locally, including data this app saves to your device. This risk applies to all software that runs locally, not just this app. I can only control what's in the app's code — your device is yours to protect. Keeping your operating system and browser updated is the single most effective step you can take.

Yes — after the initial page load, the app runs entirely in your browser with no connection required. You can view your data, add transactions, and use every feature offline. The only things that need a connection are: loading the app for the first time, downloading the community rules file when you open the import screen (optional — the app works without it), and syncing if you're signed in.

Supabase is an open-source backend platform — not an ad company. I use it here for one thing only — optional sign-in and data sync (authentication and database). Cloudflare serves the app's files, not Supabase. I chose Supabase because it's open source, privacy-focused, and handles the hard parts of secure sign-in without tying your data to Google. The app encrypts your synced data on your device before sending it to Supabase's infrastructure (AWS servers in the US) — Supabase stores only encrypted data it cannot read. If that's still a concern, skip sign-in — the app works fully without it, and the source code is public so anyone can verify exactly what it does.

Yes. The full source code is on GitHub — it's a single HTML file with no build step or server required. Download it and open it directly in your browser, or host it on any static file host. Your data stays wherever you run it.

The app uses two open-source charting libraries — Chart.js for the main spending bar charts (including Trend), and D3.js for the Split, Flow, and Net Worth views — plus the Supabase client for sign-in and sync. Like most web apps, it loads these from public CDNs (content delivery networks that serve open-source software): Chart.js and D3's core both from cdnjs, and a small D3 plugin (d3-sankey, used only for the Flow view) plus the Supabase client from jsDelivr. Your browser fetches these when the app loads. None of these CDNs receive any financial data — they only deliver JavaScript files. Blocking cdnjs breaks every chart. Blocking jsDelivr breaks only the Flow view and disables sign-in/sync, since those are the only two things it delivers. Either way, your financial data remains completely safe and stays intact on your device.

No — and this isn't just a policy, it's how browsers work. Each website gets its own private storage, and your browser strictly enforces those boundaries. No other site can reach what this app stores — not by policy, but by technical design.