Why the tools you have fail
Most personal-finance software assumes a frictionless world: one bank feed that never breaks, a federal-only tax code, and a server that holds your data in the clear. When that meets a real household — two spouses, an IRA, a California return, a brokerage that reports splits as blank rows — it fails quietly. Three of those failures are the reason this product exists. Each claim below is about behaviour that is built and tested today, not a roadmap.
Wash sales are checked across every account you hold, not one. Under IRC §1091 a loss is disallowed if substantially identical shares are bought within 61 days in any account you or your spouse control — and if that purchase lands in an IRA, the loss is gone for good (Rev. Rul. 2008-5). Tools that scan one brokerage account cannot see the dividend that reinvested in your retirement plan. Wealth Navigator scans the whole household ledger — taxable, IRA, Roth, a spouse's accounts on a joint return — and writes the disallowance onto Form 8949 as code W. It also tells you which declared retirement accounts have no holdings on file, because a scan that cannot see an account is not a clean result.
State tax is computed, not approximated. California has no preferential capital-gains rate: gains are ordinary income at up to 12.3 %, plus the 1 % surcharge above $1 million, and the federal SALT cap phases down with income. A planner that adds "15 % plus NIIT" to a federal estimate is wrong by double digits for a California household. The California and New York modules run beside the federal one on the same ledger facts, with each state's own conformity rules and underpayment penalty forms.
Double-entry, so transfers and splits cannot double count. A transfer between your own accounts is one balanced entry, not an expense and an income. A loan payment is a balance-sheet move, not spending. A stock split changes share counts, not basis. Imports are idempotent — re-uploading a statement or re-syncing a bank feed adds nothing twice — and the same bank transaction imported from two sources is paired, never merged silently.
And the server cannot read any of it. Your vault is encrypted on your devices; the sync server stores an opaque blob and refuses to be a place where a breach, a subpoena or a curious employee can see a balance. That is why there is no "free" dashboard funded by selling what it learns about you.
What is not built is listed just as plainly: no portfolio optimiser, no retirement projection, no estate packet yet. The principles page says how we decide what to build; the pricing page says what costs money.