Getting everything out, and having it erased

The product promise is no lock-in. That closes the loop the landing page opens: statements go in as files you control, and they come out the same way.

What is stored

Specifically, rather than as a category. A vague inventory reads as evasion on a product that asks for complete bank statements.

• Entities you create, and the accounts mapped to them.
• Transactions imported from statements: date, description, counterparty, amount, category, and whether the line was recognized as an internal transfer.
• Loans, leases and invoices, with the payments recorded against them.
• Goal inputs: age, invested capital, target withdrawal rate, logged deposits.
• Account details: email address, and a password hash where email sign-in is used.

What is not stored

The statement files themselves. A CSV is read, the transactions in it are written to your account, and the file is discarded. It is not archived, not kept for a retention period, and not held in a second storage service - so the list above is the whole of what exists, rather than the part of it we chose to describe.

That matters more than it sounds. A bank export usually carries more than the transactions: the full account number, the account holder’s name and address, sometimes a balance history the parser never looks at. Keeping the file would mean holding the richest version of your data indefinitely to save ourselves occasional work.

The cost is ours to state: if an import goes wrong because we read your bank’s format badly, we cannot re-run it from our side. We will ask you to upload the file again. Duplicates are detected, so doing that is harmless.

Export

Two formats, because they are for two different things.

• CSV, one file per entity. Transactions with their dates, descriptions, counterparties, amounts, categories and internal-transfer flags. This is the one that opens in Excel or Numbers, which is where most people go to check our arithmetic against their own.
• JSON, one file for the whole account. Everything, with the structure intact: entities and the accounts mapped to them, every transaction, loans and leases with their recorded payments, invoices, and the Goal inputs - your age, invested capital, target withdrawal rate and the full deposit ledger.

The Goal inputs are named on purpose. They are the part of your account that is your work rather than your bank’s, they are what another tool would make you re-enter, and they are the first thing an export usually drops. If you leave, you leave with all of it, in a format you can open.

Export still works after you cancel, for the whole 30-day window before the account is deleted. One caveat worth knowing: asking us to delete everything outright skips that window, so export first if you want a copy.

Deletion

Delete your account from your account settings. It does not go through us, it does not need a reason, and there is no retention conversation - the same way cancelling is one click. If you would rather ask a person, email [email protected] and we will do it.

Deletion happens when you ask. The live data is gone that day, not at the end of a window.

The one lag is backups, and here is the arithmetic rather than a reassuring adjective. Azure keeps encrypted automated backups for 30 days. Deleting your account removes the live record immediately; the backups that still contain it then age out over the following 30 days. After that nothing remains anywhere.

If you simply cancel rather than asking for deletion, the account is kept for 30 days first - so an accidental cancellation is recoverable and you can still export - and is then deleted. Left to run its course that is up to 60 days from cancelling to nothing remaining: the grace period, then the backup window. Asking for deletion outright skips the first 30 of those days.