Privacy & Encryption

CaliMoney protects your cloud data with AES-256-GCM end-to-end encryption, on by default. The key is derived from your passphrase via PBKDF2 (600,000 iterations, SHA-256) and never leaves your device.

For protection from people looking at your screen, use Hidden mode.

Hidden mode

Hidden mode hides your amounts on screen, which is useful when you use the app in public. The app keeps working as usual: you can still browse, add and edit movements.

Tap the eye icon in the header to turn it on, and tap it again to show amounts. When it is on:

Every amount shows the currency symbol with dots instead of the number (for example €•••). All amounts have the same length and no minus sign, so the number itself tells nobody how large it is or whether it is positive or negative.
The net balance card turns neutral grey and drops its positive/negative label and month-over-month arrow.
The labels on the dashboard trend chart are hidden too. The bars and the cashflow chart are still drawn, so relative sizes — and whether a month ended in surplus or deficit — are still visible. Colours showing whether a movement is income or an expense stay as well.
The Spending Insight card on the dashboard is not shown, because its sentence can contain amounts.

The setting is saved on this device, so the app opens with amounts still hidden next time. It is not synced to your other devices.

Hidden mode only affects what is on screen. It does not apply to the AI Assistant's answers, the Excel export, a movement copied as text or notifications. It does not encrypt anything — for that, use the encryption below.

How it works

The amount, description, type, category, account and tags of every movement and recurring movement, every account's name, kind, opening balance, savings goal, interest rate and investment holdings, and every budget amount, are encrypted locally before being uploaded to Firestore.
Only someone who knows the passphrase can read those details. Firebase and anyone with database access sees them only as unreadable ciphertext.
Some data stays readable so sync and security rules can work: your email and account ID, each record's date, the schedule of recurring movements and your category names.
AI features you use work on data decrypted on your device, and send what they need to the AI provider (see AI Assistant and Tags).
The key is kept in memory for the session; closing the tab or app clears it.

Enabling encryption

Encryption is set up the first time you open the app: choose a passphrase, enter it twice to confirm, and you're done — all new movements are encrypted. The same passphrase unlocks your data on every device.

You can turn encryption off (and back on) at any time in Settings → Privacy.

Save your passphrase somewhere safe. If you lose it, data in the cloud becomes unrecoverable. CaliMoney cannot reset the passphrase for you.

If the app detects encrypted cloud data but no passphrase has ever reached this device (for example an account created before encryption settings synced across devices), it shows a recovery screen instead of asking for a new passphrase: open CaliMoney once on your original device to sync the settings, then reload.

Unlocking the app

When you open CaliMoney with encryption enabled, you will see the unlock screen. Enter your passphrase to decrypt data and access the app.

Biometric unlock

On a phone or computer with Face ID, Touch ID, a fingerprint reader, Windows Hello or a device PIN, you can unlock with that instead of typing your passphrase.

Go to Settings → Privacy and, under Biometric unlock, tap Turn on.
Enter your passphrase once, then confirm with your face, fingerprint or PIN when your device asks.
If a password manager (Bitwarden, 1Password…) offers to save the passkey, choose your device's own option instead — iCloud Keychain, Google Password Manager or Windows Hello. Password managers often can't unlock encrypted data, and turning it on will tell you so.

From then on the unlock screen shows Unlock with Face ID / fingerprint. Your passphrase still works, and the app never starts the prompt by itself.

What is stored, and where. Your encryption key, sealed under a second key that only this device's passkey can release after Face ID, fingerprint or PIN, stays in this browser's storage on this device. Nothing is sent to CaliMoney or anywhere else, and your face or fingerprint never leaves your device.

If the prompt is cancelled the app tells you to use your passphrase. If you deleted the CaliMoney passkey from your device, turn biometric unlock off and on again in Settings → Privacy.

When it turns itself off. It works only on the device where you turned it on — each phone or computer turns it on separately, even if your passkeys sync between them. Changing your passphrase, turning encryption off or resetting it, and logging out all switch it off; turn it on again afterwards if you like.

Turning it off leaves a "CaliMoney – unlock" passkey in your device's passkey manager (the web can't delete it). Remove it there: the Passwords app on iPhone and Mac, Google Password Manager on Android, or Settings → Accounts → Passkeys on Windows.

Auto-lock

When encryption is active, the app automatically locks after 15 minutes of inactivity to protect your data if you leave the device unattended. Any interaction (tap, scroll, keypress) resets the timer. When the timer expires, the encryption key is cleared from memory and you will be prompted for your passphrase again.

Changing your passphrase

Go to Settings → Privacy and tap Change passphrase.

Enter your current passphrase, then the new one twice.

Every encrypted movement in the cloud is re-encrypted with the new passphrase. Stay online and keep the page open until it finishes.

The new passphrase applies on every device the next time each one opens the app or comes back online. A device that was offline during the change asks for the new passphrase when it reconnects, before syncing anything it recorded meanwhile — so nothing is saved to the cloud under the old one.

Keep both passphrases until the change completes. If it is interrupted, the old one stays in force and you can simply retry with the same new passphrase — but you need both to do so.

Disabling encryption

Go to Settings → Privacy.

Tap Disable encryption.

Enter your current passphrase to confirm.

Movements are re-synced to the cloud in plaintext.

Usage statistics

The CaliMoney website and app count anonymous page views with Umami, a privacy-focused analytics service. It sets no cookies and uses no identifier that could recognize you across days or sites. It sees the page path (without anything after ?), the referring site, your browser, operating system, device type, screen size, language and country — never your account, email or movements.

Umami also measures page-load speed. It honours your browser's Do Not Track setting, and it is not used while developing the app. CaliMoney uses no tracking or advertising cookies — only a technical sign-in cookie. See the Privacy Policy for details.

Exchange rates

If you hold an account in another currency, CaliMoney needs exchange rates to add it to your totals. The app asks our own server for the European Central Bank's public reference rates, at most twice a day. The request carries nothing about you — no account, no amount, not even which currencies you hold — and our server, not your device, fetches the rates from the ECB. The latest rates are kept on your device so totals still work offline. Users with every account in one currency never make the request.

Files shared from other apps

A statement or photo you share into CaliMoney from another app waits in the app's offline cache on your device only until the import screen picks it up, then is deleted — and it is deleted at logout if it was never picked up. It leaves your device only the way any import does (see Import).

The Android and iOS apps

The apps open the same CaliMoney web app inside your phone, so your data, encryption and settings work exactly as they do in the browser. A few things are specific to them:

Sign-in with Google or Apple runs in your phone's own sign-in screen; only the result reaches CaliMoney, and the app signs you in exactly as the website does. With Apple you can hide your email behind an Apple relay address.
Notifications reach your phone through Google's Firebase Cloud Messaging and, on iPhone, Apple's push service. The app asks for no token until you turn notifications on.
Files you share into the app from another app are held in the app's memory until the import screen takes them, then go through the same steps as an import.
Android backups: the app tells Android not to copy its data into Google's device backup or to a new phone — your data is restored by signing in, from your own (encrypted) cloud copy.

Files you export in the apps

In the CaliMoney apps for Android and iOS, a file you export or back up opens the share sheet instead of downloading. To hand it over, the app writes it to its own private cache on your device, where only the last one is kept: the next export replaces it, and logging out deletes it.

Backup to your cloud

If you turn on Back up to your cloud, an encrypted copy of your account goes where you send it — a folder your Drive, OneDrive or iCloud Drive app syncs, or the app you pick from the share sheet. CaliMoney never connects to that storage and never receives the file. This device keeps the backup key (it can seal new backups, not open old ones), the folder you picked and the date and outcome of the last backup; logging out or turning it off removes them.

Satisfaction survey and invitations

After your first 30 days the dashboard asks once how likely you are to recommend CaliMoney (0–10). Answering is optional: the score, the reason you choose to write, your language and your account ID are sent — never your email — and kept for 12 months. Not now asks again a month later; Don't ask again stops it on that device.
Invite friends shows your personal invite link. If someone creates an account with it, their profile records that you invited them. You only ever see how many accounts joined with your link, never who. An invite code you arrive with stays in the page's memory until you sign up — it is never saved on your device.

Your data and your rights

Export: download any month as Excel from Download, or your whole account — movements, categories, accounts, recurring templates and settings — as JSON, an encrypted backup, or CSV from Settings → Account → Export your data. See Export.
Delete: delete single records, all your cloud data, or your whole account from Settings → Account — see Account.
AI: every AI request uses zero data retention — the AI providers store nothing and train on nothing.
For any other privacy request, email support@calimoney.it. The Privacy Policy lists every provider, retention period and right.

Encryption indicators

Icon	Meaning
🔒 green (header)	Encryption active in this session
🔓 red (header)	Encryption disabled
🔒 per movement	That movement is saved encrypted in the cloud
👁 eye / crossed-out eye (header)	Amounts visible / hidden (Hidden mode)

Encryption requires a secure context (HTTPS or localhost). In HTTP development, the feature shows a notice instead of crashing.