Privacy
The short version
Your budget is end-to-end encrypted. It is encrypted on your device with a key that only your household's devices hold, and the server stores what it cannot read. Budget Bandit cannot see your envelopes, transactions or balances, and neither can anyone who breaks into it. It never sells your data, shows ads, or tracks you across the web. You can download everything, and delete everything, at any time from Settings.
How the encryption works
When a household is created, the browser makes a random key and keeps it on that device. Every document in the budget is encrypted with that key before it is sent, and decrypted after it comes back. The server checks that what it receives is ciphertext and refuses anything else, so there is no unencrypted mode to fall back to.
The key gets to your other devices and to the people you share with directly, by scanning a code off a screen or opening a link, never through the server in a readable form. While a link is out, the server briefly holds a copy of the key wrapped under a secret it never sees; that copy is deleted when the link is used and expires on its own if it isn't.
A passphrase you set in Settings › Household is a copy of the key wrapped under something only you know, so you can open the budget on a new device on your own, with no other device to hand. We store the wrapped copy and the random salt it was stretched with; the passphrase itself never leaves your browser, which is why there is no reset link — a forgotten one is changed from a device that still works, or after the recovery code opens the budget again.
The recovery code you can make in Settings › Household is another wrapped copy of the key, stored so it can open the budget on a new device when every device with the key is gone. Only the code you wrote down opens it. Budget Bandit has no way to recover a budget for you: if every device with the key is gone and there is no recovery code, the budget is gone.
What the server can see
Encryption hides the budget, not the fact that you have one. In the clear, the server keeps:
- Your email address and the name you gave, to sign you in. Sign-in links and codes are emailed; there is no password.
- Your household: its name, who is a member, who invited whom, and the plan it is on.
- Signed-in devices: a label such as "iPhone · Safari", when each was added and last seen, and how it got the key, so you can see them all and remove any of them. Removing a device moves the budget to a new key that your other devices get and it doesn't.
- Wrapped keys: for each member who set a passphrase, the salt and the encrypted copy of the household key it opens; and the same for a recovery code. Not the passphrase, and not the code.
- The shape of the budget: which months have documents, when each document last changed, how big it is, and which version of the app last wrote them. Not what is in them.
- Encrypted documents and wrapped copies of the key, which it cannot open.
- A count of how many questions you have asked Claude today, and how many envelopes Auto-categorize has asked for, for the daily limits.
- Reminder dates, if reminders are on: the day your oldest unreconciled transaction began waiting, the last month every envelope has an amount for, the date of your newest transaction, and the thresholds you set. Dates and numbers only, never a name or an amount. They are what lets the server email you that it is time to reconcile or plan the month without reading the budget. Turn reminders off in Settings › Household and the row is left as it is but never acted on.
Backups
Alongside the live copy, the server keeps encrypted copies of your budget as it stood at the start of each day: daily for three months, then one a month for three years. You can put any of them back from Settings › Data, and go back to any moment in the last 30 days. They are encrypted like everything else, under your household's current key, so when the key changes (after a device or a person is removed) the older copies can't be opened any more and are deleted.
It lives on Cloudflare's infrastructure. Deleted data is gone from the live copy at once; the storage's own disaster-recovery history is kept for up to 30 days and then is gone too. That history is ciphertext like everything else.
What the server cannot do
Anything that would need to read the budget. It cannot email you a digest of your month, run reports, or repair data on your behalf. If something goes wrong with your budget, fixing it starts with a backup file you download yourself, from your own browser, and choose to share.
Your bank
Budget Bandit does not connect to your bank. It never asks for a banking login and no third party reads your statements on its behalf. Transactions get in because you log them, paste them, or import a file you downloaded yourself.
Smart sorting, questions and Auto-categorize
The features that sort transactions or answer questions about your month are one of the places readable budget data can leave your device. When you use them, your browser sends the relevant merchant names, amounts, dates and envelope names through Budget Bandit's server to Anthropic's Claude API. The server passes the request along while it is in flight and keeps nothing. That happens only when you use those features. Anthropic does not train its models on this data.
Another is Auto-categorize, an experimental setting that is off unless someone in your household turns it on in Settings › Experimental. While it is on, when you log or import a merchant your budget hasn't seen before, your browser sends the merchant's name, the amount and your envelope names through Budget Bandit's server to TypeSafe's Jev model, which picks an envelope. The server passes the request along and keeps nothing. TypeSafe does not train its models on this data.
Speaking a line
Voice input is an experimental setting, on unless you turn it off in Settings › Experimental on that device. Its mic in the spending line uses your browser's own speech recognition. Where the browser can do it on your device, as recent Chrome can, the audio stays there. Otherwise the browser sends it to its maker to be turned into text: Apple for Safari, Google for Chrome. That happens only while the mic is on, and nothing you say passes through Budget Bandit. If you'd rather it didn't leave your device, type the line or use your phone keyboard's dictation instead.
Budget Bandit emails you sign-in links and codes, invitations, and the note that says you are in the beta. Emails are sent through Resend. No email ever contains your budget or the key.
Errors
When something breaks, a report goes to Sentry so it can be fixed. Amounts, email addresses and page contents are stripped before it leaves your browser; the report carries an anonymous account id and the technical details of the failure. That scrubbing is part of the encryption promise, since an error report is one more way readable data could leave your device.
Cookies
One cookie, which keeps you signed in. Nothing for advertising or analytics.
Your data is yours
Settings › Backup downloads everything, decrypted, as a file you can keep or import elsewhere. Settings › Household deletes your household or your whole account, including the encrypted documents and every wrapped copy of the key. Shared households stay with the other members.
This is a beta
Budget Bandit is early software, shared with a small group. Things will change and some will break. Keep a downloaded backup and a recovery code if the budget matters to you, and tell hello@budgetbandit.app when something is wrong.