Privacy and your data

What is stored, and where#

On your device. Expenity saves financial records in your browser first, so it works offline. Without an account, that is the only place your data lives.

On Expenity's server, if you create an account. To sync between your devices, your email address and your data (wallets, transactions, bills, budgets, goals, categories, recurring income and some settings) are stored on a Cloudflare Worker and database (D1). The connection is encrypted, and access needs your passkey. Expenity does not look at your data, sell it, share it or use it for advertising. As with most online services, it is not end-to-end encrypted.

Notifications. If you turn on notifications when the app is closed, the server keeps the address your browser gives it for sending them, your time zone and the hour you chose, and looks at which of your bills are due to build the daily summary. It also keeps the app version your device runs, so it can tell you when a newer one is published. Turning them off removes it.

Passkeys. The server stores only the public part of each passkey. Recovery codes are stored hashed.

Shared wallets. If you share a wallet, the people you invite can see that wallet's transactions and each other's email address. Nothing else of yours.

Exchange rates. The app asks the Expenity server for public currency rates once a day. No personal data is sent with that request.

Analytics. The website and the app count visits anonymously with Cloudflare Web Analytics: no cookies, no personal data, never the contents of your wallets.

Bank details. Expenity never asks for bank details, never connects to a bank and never moves money. A payment link on a bill just opens the page you saved.

Back up and restore#

Even with an account, you can keep your own copy. In More → Data and backup:

• Download backup (JSON) saves your wallets, transactions, bills, budgets, goals and income schedules.
• Restore a backup reads such a file and replaces the current data after you confirm. This is also how you move data from the guest mode of one browser to another.
• Transactions as CSV exports your history for a spreadsheet.

Without an account, clearing the site's data (or losing the device) removes your data, so back up regularly.

Delete everything#

• Delete all my data (More → Data and backup) is shown only when you are not signed in. It removes everything from this browser, and because there is no account, it is gone for good.
• Reset account (More → Account and sync) is the version for an account. It deletes all your data on every device, asks for your passkey, and keeps your account so you can start over. Use Download a backup first on the same card if you might need your data.
• Delete my account (More → Account and sync) deletes your account and everything stored on the server. It asks for your passkey and cannot be undone. Wallets you own and share are deleted for everyone.

Notifications while the app is open#

The in-app option shows them locally. Nothing is sent anywhere.

The calendar file#

The calendar file you download contains your bill names, amounts and notes. When you import it into Google, Apple or Outlook calendar, it is stored by that service under its own privacy rules. Avoid sensitive details in notes if that matters to you.

Open source#

The app and the server are public, so you can check all of this: github.com/expenity/expenity.

Photos and saved names#

Saved names are optional account settings and sync with your financial data. Photos are compressed separately, stored in D1, and never cached by the app for offline viewing. They follow current wallet access. Delete your uploads in Account; other members’ uploads remain. JSON backups contain image references rather than the files.

Security#

We reviewed the app and its server end to end before sharing it. There are no secrets in the code or its history, and the dependencies are audited with no known vulnerabilities. The server limits how often anything can be tried, checks every input strictly, sends security headers, and only talks to genuine push services. The app was tested with hostile text in every place you can type, so what you enter is only ever shown as plain text. A content security policy limits what the app can load, and the app refuses to run inside another page. Sign-in uses passkeys, so there is no password to steal.

This was our own thorough review, not an independent audit, and no software is ever perfectly safe. If you find a problem, please tell us through Contact us in the app.