Your data and privacy

Where your plan is stored, what our servers hold, and how to back up, move or delete your plan.

Pennykite is local-first: your plan is stored in your browser, not on our servers. If you turn on encrypted sync, we also keep a copy that only you can unlock. Preferences in the app shows the same summary under What is stored where.

What is stored where

Where	What
In this browser	Your balance, paychecks, bills, one-time items, debts, payoff plan, check-ins, imported transactions, currency and cushion
On our servers	Your account (name, email, sign-in methods), your subscription and billing state, the weekly check-in email schedule (on or off, weekday, hour, time zone and the last week sent) and, if you turn on sync, an encrypted copy of your plan that we can't read
Never	Bank logins, statement files or any amount from your plan in a form we can read

The plan is kept in your browser's IndexedDB storage, separately for each account that signs in there. Two people who share a computer but use different accounts don't see each other's plans.

We don't use AI to read your finances, and we never sell your data. See the privacy policy for the full details.

What this means for you

Without encrypted sync, we don't keep a copy:

Your plan is per browser and per device. Your phone and your laptop each have their own copy. Changes on one don't appear on the other.
Clearing your browser data deletes your plan, unless you have a backup. So can some "clean up" or privacy tools.
Private or incognito windows may not save your plan, or may forget it when you close them. Use a normal window.
We can't recover it for you. If your plan is gone and you have no backup, it's gone.

With sync on, clearing your browser or switching devices doesn't lose your plan: sign in and unlock it with your sync passphrase or recovery key. We still can't read it, and we can't reset the passphrase.

Backups

A backup is a JSON file with your whole plan and your imported transactions.

Download backup: in Preferences, under Your data. Keep the file somewhere safe. It contains your financial numbers in readable form.
Restore from backup: choose the file. This replaces the plan in this browser with the one in the file.

Download a backup now and then, and after big changes. The overview reminds you when your plan has changed and your last backup is more than two weeks old, unless sync is on.

Move to another device

The easiest way is encrypted sync: turn it on, then sign in on the new device and unlock. Without sync:

On the old device, open Preferences and choose Download backup.
Copy the file to the new device.
Sign in on the new device, open Preferences and choose Restore from backup.

The new device now has a separate copy. It doesn't stay in sync with the old one, so pick one device as your main one, or move a fresh backup each time.

Delete your plan

In Preferences, choose Delete my plan from this browser. This removes your plan and imported transactions from this browser only. Download a backup first if you want to keep them. Repeat on every device where you used the planner.

With sync on, deleting the plan from a browser also locks sync there; the encrypted copy stays, and unlocking brings the plan back. To delete the copy on our servers, choose Turn off sync.

Deleting your account removes what's on our servers, including the encrypted copy, but it can't reach into your browser. To remove everything, delete your plan in the browser too. Account deletion is covered in Settings.

Free calculators

The free calculators run in your browser. They send only anonymous counts (a view per session, a click on "Save this plan" and a sign-up at onboarding) with no identifier or cookie. "Save this plan" keeps your numbers in your browser's local storage for up to seven days so your new account can pick them up. They aren't uploaded.