← Wealth Navigator · Docs

Privacy & security

Your financial life lives in a vault — one encrypted file on your device. Opening it takes two independent secrets: your account password retrieves the sealed vault from the server, and a separate device key, which never leaves your device, decrypts it. Either alone is useless: the server can hand out the locked box, but nothing we store can open it.

We don't ask for an email address or phone number — an account is a username and a password. Because there is nothing to "reset by email", you get recovery codes when you create your vault; household members can also help each other recover. Guard the codes: the same property that locks us out locks out anyone who has only breached our servers.

What our server actually stores: your username, a salted password hash, opaque household and device identifiers, and the encrypted blob with a version counter. Sync history is signed and append-only, so a tampering server cannot silently rewrite your past. The cryptography uses modern authenticated encryption with a post-quantum hybrid key exchange — sealed data is meant to stay sealed even against future computers.

Bank connections (optional, per-account) fetch transactions only through a relay that cannot store, parse, or log their content — your bank credentials are entered with your bank or Plaid, never with us. Investment holdings, lots, and cost basis are never fetched through aggregators; you import those directly and privately. The full details are in the privacy policy and data retention policy.