Data minimisation
The product is designed to collect and transmit as little as possible. Financial records remain on your device; exchange-rate requests contain currency codes only.
Credential handling
Connection tokens are stored in the secure credential system provided by your operating system. Tokens are separated from ledger data and excluded from backups and transfer files.
On-device processing
Transaction parsing and standard receipt OCR happen locally. Optional enhanced receipt processing is clearly separated, off by default and uses a key you provide directly.
Your role
Protect your device with current software, a strong unlock method and secure storage for exported files. Never share exported ledgers or API keys with anyone you do not trust.
Report a concern
Send security concerns to hello@arash.digital with enough detail for investigation, but do not attach personal financial data or secrets.