Privacy & security
Your financial data is encrypted before it leaves your browser
WalletCalm is end-to-end encrypted. Your accounts, transactions, budgets, goals, investments and receipts are encrypted on your device with keys only you hold, so the people running WalletCalm can't read them.
Your browser
{ "merchant": "REWE Berlin",
"amount": -42.18,
"category": "Groceries" }Encrypted with your key
WalletCalm's server
All it stores is this:
x9F3kQ2v…H7wa71cP0mZr4Ls8uB1yTt6NqE5dJ
Encrypted in your browser
Every record is encrypted with XChaCha20-Poly1305 before it's saved. The server stores only ciphertext.
Your password never leaves
Sign-in uses OPAQUE: the server can check your password without ever receiving it.
No ads, no trackers
No analytics, no third-party scripts and no data selling. Even the font is served by us.
Yours to take or delete
Export everything as CSV, or delete your account and all its data at once.
How the encryption works
When you sign up, your browser creates a random key for your data and locks it twice: with a key derived from your password (OPAQUE and Argon2id) and with a recovery key that's shown to you once. Records are encrypted with that key before they're synced, and every calculation (balances, reports, forecasts, rules, search) runs in your browser.
- XChaCha20-Poly1305 for every record and file
- OPAQUE (RFC 9807) and Argon2id for sign-in
- A recovery key only you have
- Calculations on your device, not on a server
Households without giving up privacy
A shared household has its own key, sealed for each member with their public key (X25519). Members compare a short fingerprint before a key is shared, so the server can't slip in a key of its own.
- One key per household, sealed per member
- Fingerprints you can compare
- Personal data stays personal
- A new key when someone leaves
Prices without revealing your holdings
Investment prices come from one shared daily file that every user downloads in full. Your browser picks out the prices it needs, so the server never learns which stocks, ETFs or coins you own.
- The same file for everyone
- Matched in your browser
- Your holdings stay encrypted
Payments and e-mail
Pro subscriptions are handled by Lemon Squeezy, our merchant of record. It receives your e-mail address and billing details, never your transactions, balances or budgets. WalletCalm never sees your card.
- No card details at WalletCalm
- No financial data at the payment provider
- E-mail only for sign-in, invitations and resets
What the server can see
- Your e-mail address and optional display name
- Your plan and settings that aren't financial, such as theme and time zone
- How many encrypted records of each type you have, their sizes and when they changed
- Household names, members and roles
- IP addresses at Cloudflare's network edge
What it can't see
- Account names, balances and transactions
- Amounts, merchants, categories and notes
- Budgets, goals, loans and scenarios
- Investments and the prices you paid
- Receipts and backups
- Your password and recovery key
The honest limits
Like any encrypted web app, WalletCalm runs the code its website serves, so you trust that code. It comes from one origin with a strict Content Security Policy and no third-party scripts. And because nobody else holds your keys, losing both your password and your recovery key means your data can't be recovered — not even by us.
- One origin, no third-party scripts
- A strict Content Security Policy
- Keep your recovery key somewhere safe
- The demo's fictional data isn't encrypted and is deleted within a day
Questions & answers
Can WalletCalm read my transactions?
No. They're encrypted in your browser with keys the server never receives. Admins can see how many records an account has and how large they are, but not what they say.
What happens if I forget my password?
Your recovery key unlocks your data and lets you choose a new password. If you've lost both, the e-mailed reset link gives you your account back with an empty vault: the old data stays encrypted and nobody can open it.
Do you sell or share my data?
No. There are no ads, analytics or trackers, and nothing is sent to AI services. The only third party is Lemon Squeezy, and only if you buy Pro.
Where is my data stored?
Encrypted records live in Cloudflare's D1 database and receipts in Cloudflare R2, both as ciphertext. The website and API run on Cloudflare Workers.
Can I export or delete my data?
Yes. You can export your data as CSV at any time, and deleting your account removes it and everything in it immediately.