Trust Center
The expat balance sheet you can audit. Here is where your data lives, what leaves your device, and the controls you hold — each claim pointing to shipped code or our security and privacy docs.
Where your data lives
Local-first by default, with the cloud strictly opt-in and every control in your hands.
Your data lives on your device
By default every account, transaction, budget and goal is stored in your browser's local storage under keys prefixed fintrack- — not on our servers. Clearing your browser storage erases it.
Backed by: Privacy Policy
Opt-in cloud sync — optionally encrypted
Cloud sync is off until you turn it on. When you do, a copy is stored in Google Cloud Firestore, access-controlled to your account and encrypted at rest by Google's infrastructure. If you also enable the password vault, an optional setting encrypts the cloud copy's contents with a key derived from your password — a forgotten password then makes that cloud copy unrecoverable, while sync metadata stays readable.
Backed by: Settings → Cloud Sync · Privacy Policy
Export or delete, anytime
From Settings → Data you can export everything as CSV or JSON, or delete your account. Deletion is permanent and completes within 30 days.
Backed by: Settings → Data · FAQ
Two-factor authentication — optional, recommended
Turn on an authenticator-app code (TOTP) for sign-in anytime from Settings. It works with 1Password, Authy, Google Authenticator, Bitwarden and others — optional but strongly recommended, with recovery codes issued when you set it up.
Backed by: Settings → Security · Security page
Passkeys for password-free sign-in
On a device that supports them, add a passkey (WebAuthn) and sign in with its Face ID, Touch ID or security key instead of a password.
Backed by: Settings → Security
Lock the app with a password
Add a master password and the app re-prompts after 30 minutes idle. The password never leaves your device — it unlocks your local encryption key. Your two-factor secret and the AI advisor's learned facts are AES-GCM encrypted before they touch browser storage.
Backed by: Security page
What leaves your device
Three surfaces can send data off your device — each is narrow, and one is not live yet.
AI advisor
What you type is sent to our server, sanitized against prompt-injection tricks, then forwarded to the model provider — Google Gemini or Anthropic Claude by default, your own provider with a BYOK key, or a self-hosted Ollama in Local mode. With on-device AI (a WebGPU browser such as desktop Chrome or Edge), the model runs in your browser over your local data; only the question you type plus your jurisdiction and currency leave, for a required safety check. Because your question does travel, keep specific balances or account numbers out of it.
Analytics
Product analytics are opt-in through your cookie choices. When on, events carry only structural identifiers — a route name, a keyboard-chord name, or a 3-letter currency code — never an amount, balance, or personal detail. Our error and analytics tooling additionally scrub email and numeric clusters, and honour the disable-analytics setting.
Bank feeds (not live yet)
Bank feeds aren't live yet — you track accounts by manual entry and statement import (CSV / PDF) today, with read-only Plaid + Lean feeds on our Q1 2027 roadmap. When they launch, any bank access tokens will be stored on our servers, encrypted at rest and access-controlled to your account — never kept in your browser.
See the detail
Nothing here is marketing shorthand. Read the full documentation: