What we can see, and what we cannot

Updated 14 September 2026.

FinnTrack encrypts your data on your device before storing it. This page says what that protects, what it does not protect, and what we still see. Plainly: a promise with unstated exceptions is not a promise.

What is encrypted

Amounts, descriptions, merchants, categories, account names, balances, loans and trips. They are locked on your device with a key derived from your access phrase, and they leave it already locked. What gets stored is data we cannot open — not us with full access to the servers, and not Google, who hosts it.

What we see

• Your email address and your name. Signing in needs them to know who you are, whether you use an email address and a password or Google or Apple.
• The date of every entry. It is the one piece of your finances that is not encrypted, and it is that way so we can bring you only the months you are looking at. Dates alone show when you write things down and how much you write down; never how much you spent, where, or on what.
• How many entries you have, how much space they take and when you write them. A pattern of use reads fairly well from just that.
• Who you share an account with, though not what is inside it.

What the encryption does not protect

• An unlocked device. While the application is open, your key is in the device's memory. Anyone holding it unlocked reads exactly what you read.
• Someone you share an account with. A shared account is read in full by both people. That is precisely what it is for, and it is why we do not say "only you".
• What you take out. A CSV, a screenshot or a backup exported without encryption are already outside.
• The code we serve you. The encryption runs inside the application we give you. Anyone able to publish a different version could publish one that keeps your key. This is true of every web application that encrypts in the browser, and we would rather say it: that is why the site only lets our own code and Google's sign-in run, and nothing else.
• Notifications and email. An "expense added" notification carries the amount and the merchant to your phone's notification system. The email we send you goes out unencrypted.

What happens if you lose your key

Nothing is recovered, not even by us. If you lose your access phrase and your recovery key, your data stays locked forever. That is why the application makes you save the recovery key before you start, and why the backup exists.

Three more details, in case you look for them

• Invitations store a fingerprint of your email address. So an invitation knows who it is for without the address travelling readable, a fingerprint of it is stored. The same address always gives the same fingerprint, so whoever holds an invitation link can check whether it is addressed to an address they already suspect. The address cannot be recovered from the fingerprint; a specific one can be confirmed.
• Changing your access phrase does not change the key. Changing it locks the same key again with the new phrase. That protects against someone who knew your old phrase, not against someone who had already copied the unlocked key. Really changing the key would mean re-encrypting your whole profile, and that is not done yet.
• The sums happen on your device. Totals and analysis are worked out where the readable data is, which is your phone or your browser. Nothing is added up on our servers, because we could not.

What this does not change

There is no usage analytics, no advertising identifiers and no tracking of any kind. FinnTrack does not connect to your bank and does not sell anything you write down. The detail is on the privacy page.