No sign-up or hosted profile is required. Your working data stays yours.
Your budget isn’t
an audience.
A record of your life deserves a clear boundary. Start locally. Decide what to move. Know what each optional feature shares.
Your transactions do not become product analytics.
Cloud or folder sync runs only when you configure and initiate it.
Flow Intelligence runs locally and makes no network request. Ask Budget Flow is a separate feature, and it is off until you turn it on.
Exports, archives, reports, and restore tools are part of the product.
Keep it. Move it. It’s yours.
Budget Flow gives you multiple ways to protect and move information without turning ownership over to the app.
Created locally
Transactions, plans, goals, debts, people, settings, and model state begin in the on-device database.
Protected locally
App lock and supported biometrics protect access. Privacy Center can clear local learned state and financial records.
Backed up safely
Daily full safety snapshots retain the latest 30 copies. Destructive reset creates a safety backup first.
Moved explicitly
You can export CSV, PDF, complete archives, encrypted archives, and receipt bundles, or choose a folder for sync.
Restored atomically
Archive imports validate before committing, so unresolved references are handled by policy rather than guessed.
Encrypted archives
Portable backups use password-based key derivation, AES-256-CTR encryption, and integrity authentication before decryption.
PBKDF2 · AES-256 · HMACReceipt bundles
Receipts travel beside the archive in a checksum manifest. Binary files stay out of financial JSON and corruption can be detected.
Content-addressed attachmentsFolder sync
Choose a folder you control. Newer records win, deletion tombstones travel, and receipt sidecars are verified by checksum.
A location you chooseActivity and undo
See important changes and reverse supported operations. Import records are tracked so an import can be undone as a set.
Auditable changesPatterns without a private diary.
The learned transaction model stores category labels, version information, training count, and hashed feature weights. It excludes raw merchant strings, exact amounts, dates, notes, receipts, accounts, and credentials.
How local prediction works →Kept locallyCategory labelsHashed feature weightsModel versionTraining count
ExcludedRaw merchant textExact amount and dateNotes and receiptsAccount credentials
Know what your device can do.
| Capability | iPhone & iPad | Android | macOS |
|---|---|---|---|
| Local database and archive | Yes | Yes | Yes |
| Receipt attachments | Yes | Yes | Yes |
| On-device receipt OCR | Apple Vision | ML Kit on the device | Apple Vision |
| Folder sync | Security-scoped folder | Android folder access | Folder picker |
| App lock / biometrics | Supported | Supported | Supported |
| Home-screen widget | — | Yes | — |
| Hardware keyboard commands | iPad keyboard | Supported | Yes |
Clear answers. No small-print maze.
Does Flow Intelligence send transactions to a machine-learning service?
No. Flow Intelligence — category suggestions, natural entry, and forecasting — runs locally and makes no network request. The local category model learns from confirmed choices stored on the device.
What does Ask Budget Flow send, and when?
Ask Budget Flow is an optional feature and it is off until you turn it on in Settings. While it is off, questions are answered on the device from your own figures, or not at all. While it is on, a question the device cannot answer by itself is sent to Budget Flow’s own hosted service, which asks Google’s Gemini model for the wording. What travels is your question, a page of totals your question needs — amounts, dates and a currency — the part of Budget Flow’s own documentation your question is about, and the last few turns of the conversation. Before any of it leaves the device, the names you have saved in Budget Flow — people, accounts, cards, goals and merchants — are replaced with numbered placeholders, and email addresses, phone numbers, card- and account-length digit runs, street addresses, links and long opaque tokens are removed. Which placeholder stood for which name never leaves the device and is discarded with the request. Your transaction list, notes and receipts are not sent. One thing this cannot cover: a name Budget Flow has never been told about is not a name it can recognise, so it travels with your question like any other word.
Does an answer from Ask Budget Flow do the arithmetic?
No. Every figure is worked out on your device before anything is sent, and an answer quoting a number the device did not supply is discarded rather than shown. Ask Budget Flow cannot read your database, add a transaction, or change anything.
Can I take my data out?
Yes. Budget Flow supports transaction CSV, reports, full archives, encrypted archives, receipt bundles, and restore tools.
What happens before a destructive reset?
Budget Flow creates a local safety backup before disconnecting sync or clearing data, providing a recovery path for accidental actions.
Does folder sync mean Budget Flow owns a cloud account?
No. Folder sync uses a location you select and control. Platform-specific access is handled by Android folder permissions or Apple folder access.