Information we keep
When you sign up for and use RealRate, the following information is stored on the server:
- Your email and name, and your profile photo if you sign in with Google
- A hash of your password (the password itself is not stored), and your sign-in sessions
- Your sign-up date, number of sign-ins, days of use, and the app version and type (web or Android), for overall usage statistics
- Your financial records (portfolio, loans, cheques, income, expenses, accounts and budgets) only in encrypted form; next to each record, only its type and date remain in plain text so that lists open quickly
- If you turn on email reminders: the date and type of the due item (without the title, amount or counterparty name)
End-to-end encryption
Financial records are encrypted in your browser or phone with a key derived from your "encryption password". This password and key never reach the server, so neither administrators nor the server can see your amounts, titles or names. Reports and totals are also calculated on your own device. If you forget the encryption password, the data cannot be recovered.
Services we work with
The following services are used to run the app, and no readable financial data is given to any of them:
- Cloudflare: hosting of the website, the server and your encrypted database
- Google: signing in with a Google account (we receive your name, email and profile photo)
- Email delivery service (Resend): verification emails, password recovery and due-date reminders
- Cheque scanning (optional): only when you yourself provide a cheque photo, that photo is sent to Google's Gemini to read the text, and it is not stored
- The daily news and AI analysis (Workers AI) is built only from public news and contains no user information
Android app permissions
The store version (without SMS) has no access to your text messages. It requests these permissions: internet; notifications (for due-date reminders and important news); and fingerprint (only to unlock the encryption on this same phone; the app never sees your fingerprint and it goes nowhere).
Android reminders and the home-screen widget are created on the phone itself. In the full version installed from GitHub (not from the store), and only with your own permission, bank text messages are read and processed on the phone itself; the text of the message is not stored and does not leave the phone.
Selling and sharing
Your information is not sold, is not used for advertising or tracking, and is not shared with any third party other than the services above that are needed to run the app. Portfolio sharing happens only when you turn it on yourself.
Account deletion and data retention
At any time, from the "Settings" tab in the app or on the website, you can permanently delete your account and all your data; the details are on the account deletion page. Data that does not require deleting the account can also be exported beforehand with "Backup".
Children and changes to this policy
RealRate is not built for children under 13 and does not knowingly collect information from them. If this policy changes, the date at the top of this page will be updated. The app's code is public, and anyone can verify in it what we have said.
Contact
Do you have a question or request about your data? Write on GitHub (github.com/nos486/realrate/issues); please do not put any personal or financial information in it.