Security and Reliability Notice

1. Security Measures We Currently Use

We use commercially reasonable technical and organizational measures intended to reduce risk and support day-to-day security, including measures such as:

• Encryption in transit over HTTPS/TLS for supported production traffic
• Password hashing and standard authentication controls for local-password accounts
• Email verification and password-reset workflows
• Supported social authentication through Apple and Google
• Session rotation, CSRF protection, a two-hour idle limit, and a 12-hour absolute lifetime for web sessions
• Fresh reauthentication for sensitive actions and self-service revocation of browser access
• Family-scoped authorization and owner/member role separation inside shared workspaces
• Rate limiting on sensitive endpoints such as authentication and exports
• Token revocation and self-serve account deletion workflows
• Read-only public API tokens stored as hashes, displayed once, bound to the issuing user and family, limited to explicitly allowlisted routes, and automatically expired after one year
• Immediate public API invalidation after token revocation, family-membership removal, or a credential-version reset, plus per-IP and per-token throttling
• Operational logging and audit history for important family data changes

These controls reduce risk, but they do not eliminate risk.

2. Web, Mobile, and Widget Storage Differences

Security characteristics differ by platform:

• Web app: authentication uses server-backed sessions whose secrets are kept in Secure HttpOnly cookies, with CSRF protection and session rotation. Web sessions end after two hours of inactivity or 12 hours in total. If you explicitly select the unchecked Trust this browser for 30 days option on a private browser, an additional encrypted-cookie credential can restore an expired session until its fixed 30-day expiry; restoration does not count as fresh authentication for sensitive actions. Trusted browsers can be reviewed and revoked in Settings.
• Mobile app: mobile authentication credentials are separate from browser cookies and are stored in platform secure storage; offline cache or queued changes are stored in encrypted app storage.
• iOS widgets: limited widget snapshot data is encrypted before it is written to shared app-group storage for the widget extension.

3. What We Do Not Promise

We do not represent that the Service is bank-grade, certified to any specific security framework, free from vulnerabilities, or appropriate for every sensitive use case.

We do not promise:

• Perfect prevention of unauthorized access, malware, or phishing
• Recovery of all data after bugs, user mistakes, outages, provider failures, or account compromise
• Any specific uptime, recovery time, or incident response time
• That every browser, device, or email account used by you or your family members is secure

4. Your Responsibilities

You play an important role in protecting your own data and devices. You should:

• Use a strong, unique password for any local-password account
• Protect the email inboxes used for login, invitations, and recovery
• Invite only trusted people into shared family workspaces
• Keep your operating system, browser, and mobile devices reasonably up to date
• Sign out and clear browser data on shared or lost devices
• Review exported files, screenshots, and widget visibility carefully because they may expose sensitive budgeting information outside the app
• Treat public API bearer tokens as sensitive credentials: store them in a protected secret store and never put them in URLs, screenshots, repositories, logs, or public dashboards
• Secure Home Assistant and other connected systems, and consider whether transaction notes or balances are appropriate for a shared household display
• Review, rotate, and revoke public API tokens in Settings, especially after device loss or suspected exposure
• Contact us promptly if you suspect account misuse or a security issue

5. Availability and Incident Response

Service downtime can happen for maintenance, upgrades, abuse prevention, infrastructure problems, or security incidents. If necessary, we may temporarily limit access, rotate credentials, revoke sessions, block requests, or require re-authentication to protect users and the service.

If you believe you found a security issue, email [email protected]. Please do not perform destructive testing, data exfiltration, social engineering, or public disclosure without giving us a reasonable opportunity to investigate first.

We do not currently offer a bug bounty program or contractual security-response SLA unless we separately agree to one in writing.

6. No Warranty and Limitation of Liability

To the maximum extent permitted by applicable law, the Service is provided without warranties of any kind, whether express, implied, or statutory, including warranties of merchantability, fitness for a particular purpose, non-infringement, availability, or security.

To the maximum extent permitted by law, we are not liable for indirect, incidental, consequential, special, or punitive damages arising from or related to security incidents, outages, data loss, inaccurate outputs, or software defects. Please also review the limitation-of-liability language in our Terms of Service.

7. Related Information

For complete information about using Simply Family Budget, also review:

• Terms of Service - Terms and conditions for using the Service.
• Privacy Policy - How we collect, use, and protect personal information.