How we protect your money data

Your data is encrypted on your device

When you set a password, your device uses it to create an encryption key. That key never leaves your device and is never sent to us. Your financial values — amounts, balances, account and asset names, transaction descriptions, notes and merchants, along with your budgets and forecasts — are locked with that key before they are saved to our servers.

For those values, what we store is unreadable ciphertext, and we don't have the key to unlock it. If someone stole our database, they would get ciphertext for those values, plus the limited information listed under “What we can see” below.

This is called zero-knowledge encryption: we have no knowledge of your amounts, balances, or the names and notes you write.

What this means in plain terms

• Your amounts, balances, names and notes are stored as ciphertext. We can't read them from our database, and neither can anyone else who gets access to it.
• Some information is not encrypted. We can see the items listed under “What we can see”, and a few features process data in readable form on our servers or send it to an AI provider (explained below).
• Your password is the key. We never see it, and we cannot recover it for you (see “If you forget your password” below).

The technical details

This section explains exactly what cryptographic operations run on your device. If you prefer plain language, skip to the next section.

Your password is processed using Argon2id(a memory-hard, deliberately slow key-derivation function) with a random per-account salt stored on our servers. Argon2id is the gold standard for password-based key derivation. The output is a 256-bit Master Key that exists only in your device's memory for the duration of a session.

Two subkeys are derived from the Master Key using HKDF-SHA-256 with domain-separated labels:

• Auth Key — its SHA-256 hash is stored on our server as a login verifier. Even with this hash, neither we nor an attacker can derive the Wrapping Key or your data.
• Wrapping Key — used to encrypt a random 256-bit Data Encryption Key (DEK). The wrapped DEK is stored on our server.

All data records are encrypted with the DEK using XChaCha20-Poly1305, an authenticated cipher with a 192-bit random nonce per record. The authentication tag protects against tampering — any modification to the stored data is detected and rejected.

On the rare browser where the primary library's WebAssembly module can't load, records are encrypted with AES-256-GCM instead — a 256-bit authenticated cipher from the browser's built-in Web Crypto. Every record is self-describing, so it is always decrypted with the exact algorithm it was written with.

The primary cryptographic library is libsodium(via libsodium-wrappers-sumo), with the browser's native Web Crypto as the fallback. We do not hand-roll any cryptography — both are standard, audited implementations.

What we can see

To run the app, our servers can see the following, which is not encrypted:

• your email address, name and profile photo;
• your country, language and currency settings;
• the types of your accounts and assets, and the names of your categories;
• the dates and types of your transactions (for example, income, expense or transfer) and your recurrence settings;
• the links between records (for example, which account or category a transaction belongs to, or which month a budget is for), and when records were created or updated;
• your subscription status;
• the circles you belong to, their type and your role in them;
• support tickets you send us and their attachments;
• AI replies you choose to flag for review, with numbers removed; and
• the web domains of banks and merchants that we look up to show their logos. These domains are also sent to logo services.

In plain terms: we can see that you recorded an expense on a given day and which category it belongs to, but not its amount, description, merchant or notes.

Accounts created before encryption launched were migrated to it. Some of their older records may still be stored in readable form until our clean-up is complete. We never sell your information.

Features that process data on our servers

A few features need to read data in readable form on our servers to work. When you use them, the data is sent over an encrypted connection, processed in memory and not stored in readable form:

• importing bank statements from the iPhone and Android apps;
• reading bank alerts you share with the app; and
• estimating the value of an asset from the details you enter.

AI features

AI features are optional and work only after you give consent in the app. With your consent, these features send the minimum they need to an AI provider:

• AI assistant: your question and a summary of your data relevant to it;
• Chat titles: your question and the reply, to name the chat;
• Statement-format learning:an excerpt of a statement's text, when you import a bank format we don't yet recognise;
• Asset-readiness insights: the asset information needed for the insight;
• AI asset valuation: the details of an asset that our own price tables cannot value;
• Bank-alert reading: the text of a bank alert you share with the app.

These requests go to the AI provider you use, set in Settings → AI Provider & Model (Anthropic by default). AI asset valuation currently uses OpenAI. You can turn AI data sharing off at any time in the same settings.

Refer to the current terms of the AI provider for their data handling practices.

If you forget your password

Because only you hold the key, we cannot reset your password and recover your data — we have no way to unlock it. That's the trade-off that keeps your data private even from us.

When you sign up, we give you a one-time Recovery Code. Save it somewhere safe. If you forget your password, that code — or a passkey you have set up to unlock your data — is the way back in. If you lose both your password and your Recovery Code, and have no such passkey, your encrypted data cannot be recovered by anyone, including us — you would have to start again.

On your iPhone

On iOS, your keys are kept in the iOS Keychain on this device only. They are never synced to iCloud or other devices. When App Lock is on, the app asks for Face ID or Touch ID before showing your data. Figures you have recently viewed are cached on the device so the app opens quickly; this cache is excluded from backups and removed when you sign out.

On Android

On Android, your keys are kept in encrypted storage protected by the Android Keystore, on this device only. This storage is excluded from cloud backups and device-to-device transfers.

Google and Apple sign-in accounts

Accounts that sign in with Google or Apple are encrypted in exactly the same way. Because there is no Welfi password, you protect your encryption key with a passkey (Face ID, Touch ID or your device's screen lock, where supported) or a vault passphrase, and you receive a Recovery Code. As with any zero-knowledge key, we can't recover these for you — keep your Recovery Code safe.

Honest limits

No system is magic. Our encryption protects your data on our servers, but it cannot protect:

• A compromised device. If someone has access to your unlocked phone or computer, they can see your data while the app is open.
• A phished or guessed password. Keep your password private and make it strong.
• A malicious client build.The encryption only works honestly if the code running on your device is trustworthy. Welfi's official channels are the App Store, Google Play and welfi-app.com. A backdoored build could undermine these guarantees — this is a known limitation of all client-side encryption systems.
• Features that need readable data. When you use the server-side features or AI features described above, the data they need is readable while it is processed, by us or by the AI provider.