Privacy
There is no server to trust.
Most privacy pages describe how carefully a company handles your data. This one describes an architecture in which the company never receives it.
What beatrax collects
Nothing. There is no analytics, no crash reporter, no update ping carrying a device identifier, no error aggregation service, and no account.
This isn't a policy that could be revised in a future version — there is no backend for the data to be sent to. The application has no server component at all.
Where your data actually lives
- The ledger — A SQLite database in your operating system's application-support directory. One file. Yours to copy, move, back up or delete.
- OAuth tokens — If you connect a mailbox for receipt scanning, the tokens are stored on disk with restrictive file permissions — never transmitted anywhere but the provider they belong to.
- Cached receipts — Email receipts beatrax has matched are cached locally so it doesn't refetch them.
- Nothing else — No shadow copy, no telemetry queue waiting to flush, no cloud backup you didn't ask for.
When devices sync, what moves
Sync is peer-to-peer. Your devices talk to each other; nothing accumulates in the middle.
- Pairing is deliberate — A new device joins by scanning a QR code or typing a word-code, and both ends confirm a matching safety number before anything flows.
- Directly over your own network — When two paired devices are awake on the same network they find each other and sync directly. Nothing leaves your house.
- The relay only sees ciphertext — When one device is offline, changes wait in a store-and-forward relay. The relay holds encrypted bytes it has no key for, and forgets them once delivered.
- Encrypted at rest too — Each device encrypts its own copy with a key derived from your passphrase, released only when you unlock the app.
- Removing a device revokes it — Removing a device rotates the shared key and re-wraps it to the devices you kept, so the removed one cannot read anything sent afterwards.
The parts that do touch the network
Being honest about this matters more than claiming a clean sweep. Three features reach outside your machine, all of them optional and all of them under your control:
| Feature | What it contacts | Default |
|---|---|---|
| Email receipt scanning | Your mail provider (Gmail or Microsoft), directly, read-only | Off until you connect it |
| Open-banking import | An aggregator, with your own API key, from your machine | Off |
| Exchange rates | A public rate source, or a bundled offline set | Bundled rates work fully offline |
Each is off or offline-capable by default, and none of them route through a beatrax-operated service, because none exists.
What this costs you
Local-first is a trade, not a free win. There is no password reset, because there is no account. If you lose every device and every backup, the data is gone — nobody can restore it for you, which is the same property that means nobody can hand it to anyone else either.
beatrax can produce an encrypted backup and reminds you to. Where you keep it is your decision.