Security

All traffic between your device and PocketTreasury travels over HTTPS (TLS). That includes your password when you sign in, every forecast you open, and any AI question you ask. Connections are never sent in plain text, and the app is served only over encrypted connections at pockettreasury.com.

Your financial data — ledger entries, balances, goals, scenarios, forecasts, and household messages — is stored in a managed cloud database that encrypts data on disk. Backups are encrypted the same way. Nobody reads your data from storage directly: every access goes through the authenticated application, which checks who you are before returning a single row.

Row-level security is a database-level rule that isolates accounts from each other. It is enforced inside the database itself, not just in app code — so even a bug in the application cannot show you another person's rows.

• Every table that holds your data is tagged with an owner.
• Every query runs as you, identified by a signed session token.
• The database only returns rows whose owner is you.
• Requests without a valid session can read nothing.

Privileged operations (such as permanently deleting an account at your request) run through narrowly-scoped server functions that verify your identity first — including your role and household permissions, which are resolved server-side, never from your browser.

You can enable two-factor authentication with any authenticator app (Settings → Security), which adds a rotating 6-digit code to sign-in. Passwords are hashed and are never visible to anyone, including us. You can sign out of every session, and delete your account permanently from the same page.

Households let partners plan together. The rules are built so sharing only ever happens on purpose:

• Both must accept. No one can join or view your data by link alone — both people accept the invite before anything is shared.
• Aggregated by default. Shared views start with combined totals only — never your individual line items. Line-by-line visibility stays off until every member explicitly opts in.
• Leave anytime, no approval. Either member can unlink at any moment, immediately and without the other person's agreement. Shared access ends with it.
• Clear labelling. Screens always mark what is "Shared" versus "Individual", so it's obvious which numbers the other person can see.
• Chat stays private. Household messages are visible only to household members, and only the author can delete their own messages.

Your bank statements are analysed on your device. When you upload a CSV, the raw file and its rows stay in your browser unless you choose to add derived entries to your ledger. Optional AI analysis sends only aggregate summaries — totals, category and merchant trends — and sensitive merchant names (for example healthcare, religious, union, political, or recovery-related payees) are generalised before anything leaves your device. If you connect a bank instead of uploading, the connection is read-only through Enable Banking, a regulated Open Banking provider — you sign in on your bank's own page, and only balances and transactions for the accounts you link are received. We never send credentials, and we do not use your financial inputs to train third-party AI models.

Automated security scans review the database rules and access configuration, and the results are visible to you in Settings → Security. Audit-log entries record significant actions on your account so you can review your own history.

Deleting your account (Settings → Security → Danger Zone) removes your profile, ledger, forecasts, scenarios, goals, alerts, and audit log. See the Privacy Policy for the full retention and rights picture.

If our security architecture changes materially, this page will be updated and the "Last updated" date above will reflect the revision.