Privacy, terms & disclaimer

• Bank and card transactions, pulled by your own household's own SimpleFIN token (or imported from a CSV you export yourself).
• Categories and decisions - every tap you make on a transaction, and the notes that go with a fairness proposal.
• Budget configuration - the caps and rules in your household's own household.py.
• Fairness proposals - kept in your household's own Rules/fairness.json, never shown outside the fairness console itself.
• Amazon and Walmart order matches, used to give a card charge a real item name instead of just a merchant string.
• Feedback you send from inside the app, if any - it opens your own email app to send it, and only what you typed (plus the app version) travels; nothing is logged to this server beyond that same text.

All of it lives per household: your own container and its own data volume on one server, never shared with any other household's files. Backups are encrypted on this machine before they leave it, sent nightly to Cloudflare R2, with a monthly restore drill to make sure they actually come back.

• Only the people signed in to your own household. The front door (the one sign-in page for every hosted household) routes each signed-in email to its household and never reads what's inside one.
• The operator (Dan) can reach the server and the backups to keep the lights on, and does not read a household's ledger, categories or notes as a matter of course.
• The demo household is shared and public on purpose - its numbers are invented, nothing in it is real.

Ask Handshake answers plain-English questions about your own numbers using Claude, a model run by Anthropic. It is off by default. When your household turns it on:

• Each question you ask, and the transactions and figures the app looks up to answer it, are sent to Anthropic's API. Nothing else of your household's goes, and nothing goes until someone asks.
• Anthropic does not train its models on data sent through its API by default. See Anthropic's privacy policy.
• It uses your household's own Anthropic API key, never one shared with another household, and it never runs on an install that has no sign-in.
• The server keeps a running total of what the questions cost and how many were asked today, for the spending cap. The operator's log records that a question was answered and how many lookups it took, never the question or an amount.
• Recent (added 2026-10-17): each question you ask and the answer you got are kept on your household's server for 90 days, so you can open them again. Only you can see your own Recent - not the other person in your household - and only when the app knows for certain who you are (signed in); otherwise nothing is kept. Delete one, or all of them, from Recent in the search sheet at any time.
• Improvement log (added 2026-10-17): each question's text, how it turned out (answered, or why not), which lookups it used, how long it took and what it cost are kept on the same server for 180 days, so the app can be improved. It holds no answer, no amount the app looked up, and no name. The person who runs the server can read it there; it is never sent anywhere. A household that wants it gone can ask them to delete it.

• No selling your data, no ads, no third-party analytics.
• No AI or model calls on your household's figures in the shared engine - categorisation is deterministic code, not a model (see docs/SELF_LEARNING.md). Two exceptions, each only if your household sets it up: Ask Handshake, above; and the nightly category suggestions, which send only the names of merchants still waiting for a category and the list of your category names - no amounts, dates, people or notes - to a model (your own computer's, if you run one, otherwise Anthropic's API). A suggestion is shown as "Suggested" on the card and never files anything by itself.
• No live rate or price lookups - any rate reference shown was checked by hand on a stated date, not fetched live.

Inside the app, under Your data (next to the feedback box), you can:

• Export my data - download everything the app holds for your household as a zip, any time.
• Delete my household - type the confirmation phrase and the household's files are moved aside on the server. This is not a full erase: it's reversible only by an operator with file access to that server, and a copy still exists in that day's encrypted backup until it ages out of retention.

For a full, permanent erase (server copy and backups both), ask the operator directly. Separately, revoke your own SimpleFIN token at SimpleFIN whenever you like - that's your account, not this app's.

• Handshake is a personal, free hobby project built and run by one person - not a company, a bank, an adviser, or a fiduciary.
• It's informational only - not financial, tax, or legal advice.
• Verify any rate, bill, or bundle claim with the actual supplier, bank, or card issuer before acting on it.
• Provided as-is, with no warranty of any kind.
• To the fullest extent the law allows, the operator is not liable for losses or decisions made using this app.
• Your data is kept with reasonable care and backed up - but keep your own records too.
• The service may change, move, or stop running at any time.
• Abusive use of a shared install (the demo included) may be removed without notice.
• Continuing to use Handshake means you accept these terms.