Security
How Money Tracker keeps your data secure
Where Money Tracker stores your transactions, how they're encrypted, what our server keeps when bank sync is on, and what runs on your phone.
Last updated
The short version
- Your financial data lives on your phone, in an encrypted database. We don't keep a server copy of your transactions, balances, or budgets.
- No email or password. The app creates a random ID on first launch, so there's no account tied to your name.
- Bank sync is optional. With it on, our server stores an encrypted Plaid access token and passes new transactions straight through to your phone without saving them.
- The smart features run on your device. On iPhone, receipt scanning, categorization, and the Assistant use Apple's on-device models. On Android, receipts are read on the phone with Google's ML Kit and categorization runs on your rules and bank data. Your transactions are never sent to a cloud AI service.
- No ads and no cross-app tracking. The app doesn't use the advertising identifier.
On your phone
Accounts, transactions, budgets, rules, goals, imported CSV files, and receipt photos are stored in a SQLite database encrypted with SQLCipher. The encryption key is generated on your phone and never leaves it. On iPhone it is kept in the iOS Keychain as a this-device-only item, so it is never included in iCloud or iTunes backups. On Android it is protected by the Android Keystore, and the app opts out of Android backups.
You can also lock the app with Face ID, Touch ID, your fingerprint, or your passcode. That check is handled by the phone's operating system; we never receive biometric data.
One consequence: because the key can't leave the device, there is no cloud copy to restore on a new phone. Export your transactions to CSV from the app before switching phones and import them on the new one.
When you turn on bank sync
Bank sync is available on the Sync and Pro plans for banks in the US, through Plaid. You sign in to your bank inside Plaid's own screen, so Money Tracker never sees your bank username or password.
| What | Where | How it's protected |
|---|---|---|
| Plaid access token | Our database (Supabase) | Encrypted with AES-256-GCM before it is stored |
| Bank name, connection status, sync cursor | Our database (Supabase) | Tied only to your random install ID |
| New transactions and balances | Our server, in memory only | Fetched from Plaid, sent to your phone, never written to server storage |
| Your transaction history | Your phone | SQLCipher-encrypted database |
Disconnecting a bank in Settings revokes the token at Plaid and deletes the stored connection. You can also review connected apps at my.plaid.com. Tokens, secrets, and transaction details are never written to our logs.
What else leaves your phone
A few things do leave the device, none of which contain amounts, merchants, or account details: anonymous usage events (PostHog), crash reports with personal data stripped (Sentry), subscription status (RevenueCat and the App Store), and a push token if you turn on notifications. The privacy policy lists every one, with retention periods.
Deleting everything
Delete Account in Settings revokes every bank connection at Plaid, deletes our server-side records, and wipes the database on your phone. Deleting the app also destroys the database and its key. If you can't open the app, email support@macaroni-studios.com.
Reporting a security issue
If you think you've found a vulnerability, email support@macaroni-studios.com with “Security” in the subject and steps to reproduce it.