Security & architecture

The architecture is the privacy policy

TLDR Money never connects to your bank, your SMS or your mail. Everything in your ledger is something you typed or said. This page sets out exactly what leaves your phone when you use voice entry, chat entry and Ask, what is kept, and what the design makes impossible — and it is exact about what it does not.

What TLDR Money cannot do

These aren’t policies we could quietly revise in a changelog. They’re consequences of what the app is connected to, and they were settled before anything was built — by a founder who is an architect by training.

Cannot move money

The app is not connected to any bank, card or brokerage account, so transfers, trades and account opening are not things it could do. There is no switch to flip.

Cannot reach your bank

We never hold your online banking credentials, so there is no path to your accounts even in principle.

Cannot see your passcodes

No SMS permission is requested, so one-time passcodes and personal messages are never in scope.

Cannot let a model do your sums

Ask never shows a model your transactions. The app computes every figure from your ledger itself, so a model cannot invent one.

What leaves your phone, feature by feature

What each way of adding or asking sends, and what is kept afterwards.
FeatureWhat is sentWhat is kept
Manual entryThe entry you typed, to your ledgerThe entry
Voice entryThe recording, with your category names as spelling hints, to a speech-to-text model; the text that comes back is read for the amount, merchant and categoryOnly the transaction you confirm. The recording is deleted as soon as it has been transcribed
Chat entryThe sentence you typed, with your category names, to a language model that turns it into transactionsOnly the transactions you confirm on the review sheet
AskYour question, your category names and your currency, to a language model that turns it into a query. Never your transactionsNothing is added to your ledger. Ask is read-only

Ask: why the model never does the maths

Most apps that answer questions about your money hand your transactions to a model and hope it adds them up correctly. A model asked to total two hundred transactions will get it wrong, confidently. So Ask works the other way round.

  1. The model sees your question, not your money. It receives the question, your list of categories and your currency, and returns a structured query: which categories, which dates, what to total.
  2. The app runs the query. Our code runs it against your ledger and computes the number. The model is not involved in that step.
  3. The sentence is filled in from a template. The figure you read was calculated, not written by a model.
  4. The working is shown. Under every answer is the filter that produced it — “Food & Dining · 1–30 Sep · 23 transactions” — and tapping it opens exactly those transactions.

Two things follow from that design. The figure is right whenever your ledger is right, because no model touches the arithmetic. And your transactions are never sent to a model, whatever you ask.

Voice and chat: nothing saves without you

Anything that turns speech or a sentence into a transaction will sometimes get it wrong — “fifteen” and “fifty” sound alike. So every voice entry opens a confirm card, and every chat message opens a review sheet, with each field editable. There is no setting that skips them. Nothing is written to your ledger until you confirm it, and the recording behind a voice entry is deleted as soon as it has been turned into text.

Where your ledger lives

Your ledger — the transactions you confirmed, your categories and budgets — is stored on our servers, so it survives a lost phone and so a shared ledger can work. On the free plan, entries older than last month are hidden from view but not deleted, and they come back when you subscribe. The full download in Settings covers everything, on every plan.

In a shared ledger, both people see every entry in that ledger and who added it. Neither person can see the other’s personal ledger: the shared one is a separate space, not a merge.

Why we don’t read your texts

Some trackers on Android are built on the bank alerts that arrive as text messages. We aren’t. Android cannot give an app only your bank’s texts — the permission covers the entire inbox, including every one-time passcode you receive — and iOS has never let apps read messages at all. Typing or saying an entry needs neither, and works the same on both platforms.

Your data, on request

Everything you have logged can be downloaded from Settings, on any plan, and you can delete your account and the data in it at any time from the delete account page. For anything else about your data, email hello@tldrmoney.app. How your personal data is handled is set out in the privacy policy.

Never sold, never shared

No third-party data brokers, no ad networks, no anonymised-and-resold loophole. This is easier for us to hold to than it is for most of the category, and not because we are better people: our revenue is a subscription, so there is no advertising business or distribution arm whose economics depend on knowing what you spend. An app funded by placing loans or selling funds has a commercial reason to profile you. We don’t have one. See how we make money.

What we will never ask you for

Nobody from TLDR Money will ever ask for your online banking password, card PIN, security code or a one-time passcode — not by email, not by phone, not in the app. There is no legitimate situation in which we would need any of them. If someone claiming to be us asks, it isn’t us; tell us at hello@tldrmoney.app.

No system is perfectly secure, and we won’t claim otherwise. The load-bearing decisions are architectural: the app holds no route into your accounts, a model never sees your transactions, and recordings are not kept. Those limits do not depend on anyone keeping a promise.

Questions worth asking

Can TLDR Money move money out of my account?

No, and not as a matter of policy — as a matter of what the app is connected to, which is nothing. There is no link to your bank, card or brokerage, so there is no route through which money could move, a trade could be placed or an account could be opened. We also never hold your banking credentials.

Does TLDR Money store my financial data on its servers?

Yes — your ledger: the transactions you confirmed, your categories and your budgets. It is stored on our servers so it survives a lost phone and so a shared ledger can work. What is never stored is a voice recording, which is deleted as soon as it has been transcribed. You can download everything in Settings on any plan, or delete it with your account.

Do you need my SMS permission or my bank password?

Neither. TLDR Money does not request SMS access, so it does not see your one-time passcodes or your personal messages, and it never asks for an online banking username, password, PIN or passcode. Nobody from TLDR Money will ever ask you for any of those — if someone claiming to be us does, it isn’t us.

Can I turn off microphone access?

Yes. Voice entry is the only feature that uses the microphone, and you can switch that permission off in your phone’s settings at any time. Typing an entry or a sentence keeps working without it.

Does this website track me?

No. This site runs no analytics, sets no cookies and loads no third-party scripts, so there is nothing to consent to. If you join the waitlist, the email address you enter is kept in a Google Sheet and used once, to tell you when the app is available.

What happens to my data if I delete my account?

Deleting your account deletes the personal data associated with it, except where law requires specific records to be retained — invoices and tax records being the usual case. Download everything from Settings first if you want a copy. A Pro subscription is billed by the App Store or Google Play, so cancel it there as well.

Know exactly what it cannot do

No bank connection, no SMS, no recordings kept, and no model doing your sums. On iPhone and Android, with 30 days of Pro on every new account.

Join the waitlist

We’ll email you when it’s ready. No spam, ever.

This page describes the product’s architecture and the access it holds. The binding statements about how your personal data is handled are in the privacy policy.