Privacy in Cashfulness: encrypted documents, hidden amounts and two-factor sign-in
In short
Privacy in Cashfulness works on two levels. The first is who you are: to us you're a nickname and an email, no first name or surname. The second is your documents: their content is encrypted on your device, with a key we don't have. In between are your accounts and transactions, on servers in Europe, used to work out your reports and yours to export whenever you like. Then there are the switches in your hands: hidden amounts, app lock, two-factor sign-in.
This page goes with lesson 9 of the free video course "Cashfulness step by step". The steps are in the same order as the video.
Watch the lesson
The lesson lasts about six minutes.
A nickname, not a name
When you sign up, the app asks for an email, a nickname and a password. No first name or surname. If your email doesn't contain your name, even better. You can change your nickname whenever you like: Settings, User Profile, Nickname field.
Your data stays yours
Your accounts and transactions are on servers in Europe: they're protected in transit and at rest, and they stay yours. In Settings, Backup and data, Export data takes them away in three CSV files: accounts, transactions and transaction lines. They open in any spreadsheet. The export is done by the owner of the space.
And if one day you decide to leave, Account Management has Delete Account. A space you share with others doesn't disappear for them: it passes to another member.
Documents, encrypted end-to-end
Receipts, invoices, contracts, insurance policies: you'll find them under Tools, Document Management, with the Inbox, All and Archived tabs, and you can attach them to a transaction. They're the most protected part of the whole app, because they can hold very private information, like your bank account's IBAN.
End-to-end encryption means something simple: the file leaves your device already locked and reaches the server unreadable. Not even we can open it. Each document has its own key; the keys are protected by a master key, which opens only with your document code or your Recovery Key.
To be precise, it's the content that's locked, thumbnail included. These stay readable, so you can search and sort:
- the title, the notes and the dates;
- the type and size of the file;
- any tax details you fill in, amount included;
- the link to the transaction.
The title the app suggests is the file name. If the name gives too much away, change it: a confidential detail belongs in the file, not in the title.
The document code and the Recovery Key
The first time you upload a document, the app asks you to Set up encryption. Set up now opens Configure Document Encryption, in four steps:
- Create the document code: a secret phrase of at least twelve characters, typed in Document code and in Confirm the code. It isn't your app password, and it mustn't be. A long phrase you remember is worth more than a complicated word.
- Save Recovery Key: twenty-four words generated for you. They're the only way to recover your documents if you forget the code. Write them down on paper, or keep them in your password manager.
- Verify: the app asks you to type three of the twenty-four words back, to make sure you've saved them.
- Activation: Encryption Enabled! appears.
An honest word, because this is a choice and not a flaw: if you lose both the code and the twenty-four words, nobody can recover your documents. Not even us. That's exactly what stops anyone else from reading them. While encryption is unlocked, you can see the words again from the padlock at the top of the Documents screen, with Show Recovery Key. Do it before you need them.
Hiding amounts
The eye in the sidebar hides amounts (Hide amounts) and shows them again (Show amounts). On a computer there's also the shortcut Ctrl+Shift+H: on a Mac too it's Control, not Command. The same switch, Hide amounts, is in Settings, Security & Privacy.
Locking the app
In Security & Privacy you'll find Device quick login, with your fingerprint, your face or your device passcode, and Require authentication, which asks you to unlock every time you open the app. Useful if the phone gets passed around the family. Device unlock is available on iPhone, iPad, Android, Mac and Windows; not on Linux, where you sign in with your account password.
Two-factor sign-in
With two-factor sign-in, your password alone isn't enough: you also need a six-digit code that changes every thirty seconds, generated by an authenticator app on your phone.
- Security & Privacy, Two-factor sign-in, then Turn on two-factor sign-in.
- Add Cashfulness to your authenticator app: scan the QR code.
- Enter the code shown in the app, in the Six-digit code field.
- Your backup codes appear: ten of them, shown only once. Copy the codes, save them, then tick I have saved the codes somewhere safe.
When you turn it on, the other devices signed in to your account are signed out: to get back in they'll ask for your password and a code. Backup codes are for when you lose your phone: keep them in a password manager, not in a photo on your phone, or you'd lose them along with it.
Usage data, only if you want
Security & Privacy also has the Improvement Programme, which starts switched on. If you leave it on, the app tells us which sections you use and sends us a report when something goes wrong, linked to a code and not to your name. If you turn it off, we stop collecting anything new, and the app works exactly the same.
Common mistakes
- Using your app password as your document code. They should be two different things.
- Keeping the 24 words in a photo on your phone. Lose the phone, and you lose them too.
- Putting a confidential detail in a document's title. The title stays readable; the content doesn't.
- Keeping your backup codes on the same phone as the authenticator app.
Frequently asked questions
If I lose my document code and my Recovery Key, can you recover my documents?
No. The content of your documents opens only with a key protected by your code and your 24 words, and we don't have it. It's the same reason nobody else can read them. While encryption is unlocked, you can see the 24 words again from the padlock at the top, with Show Recovery Key.
What stays readable in an encrypted document?
The content of the file is encrypted. What stays readable, so you can search and sort, is the title, the notes, the dates, the type and size of the file, any tax details you fill in and the link to the transaction. A confidential detail belongs in the file, not in the title.
I've lost the phone with my authenticator app: how do I get back in?
With one of your ten backup codes. Each code works once, and using it turns two-factor sign-in off: you turn it back on from Security & Privacy once you have your new phone.
In the manual
In the user manual, documents are in The Tools chapter, Documents section; profile, security and export are in the Settings chapter. How your data is handled is set out in the privacy policy.
The previous lesson
Lesson 8 · Importing into Cashfulness from CSV and GnuCash. Your bank statement and your GnuCash file, without retyping a thing.
The next lesson
Lesson 10 · Sharing with your family, plans and subscription. The three routes for an account that isn't only yours, how to invite someone, and the plans.
Vittorio Giusti is an economist and psychologist, and he built Cashfulness.