Local-first by default
On the web, Cashflow Pilot keeps app records in local browser storage. On iOS, app records are kept locally on the device. Clearing local storage or uninstalling without a backup can remove that local copy.
Security & data control
Financial software should explain where your data lives.
Cashflow Pilot is local-first by default, does not require online-banking credentials, and treats authentication, backups, exports and deletion as separate controls you can understand.
Security model
Keep the default simple: your financial records stay local.
Cashflow Pilot is designed so you can use the product without handing over bank credentials or creating a cloud account first.
No online-banking credentials required
Cashflow Pilot works from supported statements and exports you choose to import. It does not need your bank password for manual imports. Optional provider connections use separate access tokens or API keys; these credentials should be treated as sensitive.
Authentication is separate from provider data
Where Google or Apple sign-in is used, the provider is used for authentication. Cashflow Pilot does not request Gmail, Google Drive, Calendar or Contacts access just to sign you in.
Passwordless email avoids stored passwords
Email sign-in is designed around short-lived one-time codes or links rather than a Cashflow Pilot password that must be stored and protected.
Encryption in transit and at rest
Cashflow Pilot uses HTTPS/TLS for hosted website and cloud traffic. When supported cloud database features are enabled, Cloudflare D1 encrypts stored database objects at rest using AES-256 and protects Worker-to-D1 and API traffic with TLS. Local browser and device copies rely on the safeguards provided by the device, operating system and browser unless a feature specifically states that it adds another encryption layer.
Your control
Portability and deletion are part of security too.
Backups and exports
Use Cashflow Pilot's backup and export tools before clearing browser data, reinstalling, moving devices or making major changes. Exported files are yours to store and protect.
Cloud features are opt-in
Cashflow Pilot is usable locally without enabling Cloud Sync. Turning on an account feature is a separate choice from starting to use the financial workspace.
Delete account & cloud data
Where a Cashflow cloud account is enabled, the account settings include a server-side deletion path. Keeping or erasing the local device copy is treated as a separate choice.
Support does not need your raw files by default
Do not email statements or financial exports unless support specifically asks for them and you are comfortable sharing the information they contain.
Your privacy rights
Where PIPEDA applies, you can request access to personal information Cashflow Pilot holds about you, ask how it has been used or disclosed, request appropriate corrections, and challenge our privacy compliance. Read your privacy rights under PIPEDA →
Security also depends on the device and browser you use. Protect device passcodes, browser profiles, backups, downloaded statements and exported Cashflow files just as you would other financial records.
Have a security or privacy question?
Contact Cashflow Pilot directly rather than sending sensitive records unprompted.