Security & privacy
Your finances are personal. Here is, concretely, how we protect them.
Encryption
- Every connection uses HTTPS (TLS): nothing travels in clear text.
- Passwords are hashed with Argon2id and never stored in readable form.
- Sensitive secrets (keys, tokens) are encrypted with AES-256-GCM on our servers.
- Optional backups are encrypted on your phone (AES-256-GCM) with a passphrase only you know.
Two-factor authentication
- Protect your account with an authenticator app code (TOTP).
- Backup codes let you sign in if you lose your phone.
Biometric lock & discreet mode
- Unlock the app with your fingerprint or Face ID.
- Discreet mode hides amounts when you are in public.
Your location stays on your phone
- Visit detection runs on the phone: your GPS positions are not sent to our servers.
- Location is only used while the app is open, and you can turn it off at any time.
Your GDPR rights
- Access all your data and export it from the app.
- Correct or delete your information at any time.
- Delete your account: your data is erased as described in our policy.
Responsible disclosure
Found a vulnerability? Write to ayoub_sifaou@hotmail.com with the details (steps, impact). We reply within 72 hours, keep you informed and credit you if you wish. Please do not access other users’ data or disrupt the service.