Privacy Policy

Last updated: July 17, 2026

This policy covers the Hushold websites (hushold.app) and the hosted sync service (app.hushold.app) operated by Kyle Johnson (“we”). If you run a self-hosted Hushold server, its operator — not us — is responsible for that instance.

Hushold is built so that we hold as little of your data as technically possible. Your financial data is encrypted on your device with keys we never receive.

What the server stores

• Account data: your username and a salted, one-way hash of a value derived from your password on your device. We never receive or store the password itself.
• Encrypted key material: your data-encryption key, wrapped (encrypted) by keys derived from your password and from your recovery phrase — on your device. We cannot unwrap it.
• Encrypted ledger blobs: your financial data as opaque ciphertext (AES-256-GCM), plus the minimal metadata needed to sync: blob hashes, sizes, sequence numbers, and timestamps.
• Session records: refresh tokens so you can stay signed in, revoked when you sign out or change your password.
• Server logs: standard technical logs (IP address, user agent, timestamps, requested endpoints) kept for security, rate limiting, and abuse prevention, and deleted on rotation after a short retention period.

What the server can never see

Your transactions, balances, account names, payees, budgets, notes — everything inside your ledger — exist on the server only as ciphertext. The encryption keys are derived and used exclusively on your device. We cannot decrypt your data, and neither can anyone who compromises or seizes the server storage. The full design, including its trust boundaries and an audit of the implementation, is public: architecture & threat model, security audit.

What we don't do

• No analytics, no tracking pixels, no advertising, no fingerprinting.
• No cookies. Sign-in state lives in your browser's local storage, not in cookies.
• No third-party requests from our pages — fonts and all assets are served from our own domain.
• No selling, renting, or sharing of data with third parties. We could not sell your financial data even if we wanted to: we don't have it.

Optional Coinbase connection

If you connect a Coinbase account, your browser signs Coinbase API requests locally with your API secret and sends the pre-signed requests through our proxy to api.coinbase.com. Your API secret never reaches our server; the proxy sees only the request metadata it forwards. Coinbase's own privacy policy governs what Coinbase does with those requests. This feature is entirely opt-in.

Where your data lives

The hosted service runs on servers located in Germany and is subject to EU data protection law (GDPR). Encrypted backups of the server's storage are kept solely to protect against hardware failure; they contain the same ciphertext the server holds.

Legal bases

Under the GDPR, we process the data above to provide the service you signed up for (performance of a contract, Art. 6(1)(b)) and to keep the service secure (legitimate interest, Art. 6(1)(f), for server logs and rate limiting).

Your rights and your control

• Export: you can export your complete data at any time from Settings (GnuCash file or raw event log) — no request needed.
• Deletion: Settings → Delete Account permanently removes your account, key material, and all blobs from the server, immediately.
• GDPR rights: you also have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to complain to a supervisory authority. Because we cannot read your ledger, access/rectification of its contents is something only you can perform — in the app.

Data loss disclaimer

End-to-end encryption cuts both ways: if you lose both your password and your 24-word recovery phrase, your data is unrecoverable. We have no reset mechanism, by design.

Children

The service is not directed at children under 16.

Changes

If this policy changes materially, we will note it here with a new date and announce it in the project's release notes before it takes effect.

Contact

Questions or requests: kyle@kyle-p-johnson.com.