PlannedOutYour money data is yours. We built it so we can't read it.
Most finance apps ask for your bank login, read your SMS, and store every transaction where their staff, partners and advertisers can reach it. PlannedOut works the other way round: everything you type is encrypted on your device before it leaves, and only you hold the key.
No bank linking · No SMS reading · No ads · No selling data, because we have nothing readable to sell.
What we can and can't see
We can't see encrypted
- Amounts and balances
- Account and bank names
- Descriptions and notes
- Categories and budgets
- Salary, EMIs, investments
- Projections and what-ifs
We can see needed to run the service
- Your email address
- When you sign in
- How many records you have
- Each record's type (e.g. "transaction")
- The month a record belongs to
- When a record last changed
How your data travels
What one saved record looks like to us
How this compares
| Typical expense apps | Cloud spreadsheets | PlannedOut | |
|---|---|---|---|
| Provider can read your amounts | Yes | Yes | No |
| Asks for bank login or SMS | Often | No | Never |
| Shows ads or shares data | Often | Varies | Never |
| Analytics & projections built in | Some | Build yourself | Yes |
| Delete everything instantly | Varies | Manual | One click |
Why it's worth staying
Privacy that doesn't depend on trust
You don't have to believe our promises. Even if our server were breached or subpoenaed, there's nothing readable to hand over.
Spreadsheet speed
Type, paste from Excel, use formulas, or import .xlsx, CSV and bank statements. No one-form-per-expense tedium.
Answers, not just records
Every month shows surplus or shortfall, where the money went, and what's creeping up.
See the future
Project savings year by year, plan yearly bills ahead, and see how long your savings last with what-ifs.
Your data on every device
Encrypted sync means you get the same plan on phone and laptop, unlocked with your passphrase.
Free, with no catch
No ads and no data deals. Your finances aren't the product.
The technical details
- Each vault has a random AES-256-GCM data key that encrypts every record.
- That key is wrapped with a key derived from your passphrase using PBKDF2-SHA256 with 600,000 iterations.
- Recovery keys wrap the same data key independently, so any one of them can unlock your vault.
- All encryption uses your browser's built-in Web Crypto API. Your passphrase and unwrapped key never leave your device.
You stay in control
If you lose your passphrase
Any one of your recovery keys unlocks your data. Keep them somewhere safe and offline. If you lose your passphrase and every recovery key, nobody can recover your data, including us. That's the trade-off that makes it private.
Deleting your data
Settings → Delete account removes your account and every record immediately.