Privacy and security

A fresh desktop install talks to the network only for a license check and an update check. Price download, bank connections, and sync stay off until you choose them. See License → Network activity for the list.

What stays on your machine

• The SQLite ledger file
• Attachments
• The Ed25519 public key used to verify your license
• Private sync keys, if you chose that mode

What the web app stores

Household membership, the plan, bank connection metadata, and the cloud copy of the ledger. Row-level security keeps one household from reading another. Aggregator tokens are not stored in this checkout because live aggregators are disabled.

Encryption

SQLCipher at rest is the target for a signed release. This development build uses ordinary SQLite so contributors can open the file. Passphrase-plus-recovery-key is documented and not wired in this unsigned tree.

If this goes wrong

If the network panel shows any host other than whatdoyouwant.io (license check) or updates.finance-clean-room.test (update check), that is a bug. The update host name is the update identity. It is not the product name. Turn the computer offline — the desktop app keeps working, including help, for the bundled docs version.