The files you import and the copies you open stay in this browser tab. They are not sent anywhere, not to us either: the site is built so that it cannot send anything. Closing or reloading the tab, or 15 minutes without use, clears them.
If you install the app on your own computer, it also reads files from a folder there, and does not send them anywhere either.
So your data is not lost when the tab closes, you can save a copy. The app locks it with your password before saving, so without the password the file cannot be read. If you keep it on OneDrive or Google Drive, they see only the locked file.
Your password and recovery code are never saved or sent. If you lose both, no one can open the copy, the author of this app included.
Your settings: language, theme, how the menu and tables look, and the persona picked in the demo.
The folder picked for the copy, so you do not have to pick it every time.
Until the tab closes: that the counters have already turned in from zero, so they do not do it on every page.
No financial data and no cookies. Clearing this site's data in your browser removes all of the above.
The site is delivered by Cloudflare. Like any company that hosts websites, it sees that someone opened it (the IP address and the kind of browser), under its own privacy policy. There are no visitor statistics, no ads, and nothing that tracks you across websites.
The figures are computed from your data, for your own analysis. They are not investment or tax advice.
A question about your privacy, or a security flaw found in the site: write to security@fin-stats.com.
You do not have to take our word for it. Open your browser's developer tools (F12):
Network: import a file or open your copy. The most the list gains is more of the app's code, from this site's own address, and your copy's logos, read from memory (data:). None of it sends your data.
Network, after a reload: the first entry, the page itself, carries the header Content-Security-Policy with connect-src 'none'. By that rule the browser refuses any request the page tries to make.
Application (Storage in Firefox): local storage holds settings, session storage one mark for the counters, IndexedDB the folder picked for the copy, and there are no cookies.
A weak password. Whoever gets the file can try passwords as fast as their hardware allows: a common one of 12 characters falls within hours, a long and unusual one holds.
An open tab. Anyone at your computer sees what it shows, until it closes or 15 minutes pass without use.
Your own device. A virus, or a browser extension allowed to read every site, can read what the tab shows.
A changed site. The page that opens your copy can read it, so it is only as safe as its code. Changing that code takes the author's accounts, which are guarded by two-step sign-in.