Monee
Privacy Policy
Last updated 15 October 2026
1. What this covers
This policy covers the Monee mobile and web application and the site at monee.smr.et. It explains what is collected, why, who it is shared with, and how to get rid of it.
2. What we collect
| Data | Why |
|---|---|
| Email address | Identifies your account and is how you sign in. |
| Password, as a derived secret | Your password is stretched on your device and only the derived value is sent, where it is hashed again before storage. The password itself never leaves your device. |
| A copy of your encryption key, unless you turn end-to-end encryption on | Held on our server, encrypted under a key that is not in the database, so that losing every device does not lose your ledger. Turning on end-to-end encryption destroys this copy. See section 4. |
| Your devices | A name you would recognise, the platform, and a public key. Each device's copy of the encryption key is sealed to that public key, which is how a new device is let in by one you already have. Removing a device signs it out as well as taking away its key. |
| Your ledger, encrypted | Accounts, transactions, budgets, categories and the settings that describe them, stored as a single encrypted blob so you can restore it on another device. |
| A random device label | Generated by the app, tied to nothing about you or your hardware, so the app can show which device last saved. |
| Timestamps and a revision number | To show when the ledger was last saved and to stop two devices overwriting each other. |
| Your name, and your profile picture if you have one | What Google returns for the scopes below, or the name you type into the app. Held against your account alongside your email address, and shown to you in the app. Unlike your ledger, these are not encrypted: they identify the account, so the server has to be able to read them. |
Anonymous usage data
Unless you turn it off, the app sends us a few anonymous facts about how it is used, so we can see which banks' alerts it fails to read and which screens people use. Each one is a fixed name with a value from a fixed list, for example: the app was opened (app version, language, iPhone or Android); a first-run step was reached; an alert from a given bank was read, was a repeat, or could not be read and why; a screen was used.
They never contain amounts, payees, account names or numbers, message text, or anything else you enter. They are tied to a random number the app makes up and replaces every year, not to your account, your email or your device, and we do not keep the address they come from. Our server drops anything not on the fixed list. We keep them for 90 days, after which only daily totals remain. They stay on our own server; no third-party analytics or advertising SDK is involved, there is no advertising identifier, and no profile is built about you.
To stop it, turn off More → Share anonymous usage data. Nothing more is sent from that moment, and anything waiting to be sent is deleted.
3. What never leaves your device
- The contents of bank and wallet messages. Where you turn on message capture, messages are read on the device. Anything not from an institution you added is discarded before it is written down. Message text is never uploaded.
- Receipt photographs. Read on the device. The photo stays there and is not included in what is uploaded.
- Your passcode and biometric setting. These belong to the device.
- Your password. Only a value derived from it is transmitted. It signs you in and nothing else; it is not what decrypts your ledger.
- Your recovery code, and your devices’ secret keys. Generated on the device and never uploaded, in either mode.
4. Encryption
Your ledger is encrypted on your device before upload, using XChaCha20-Poly1305 under a random key. Only the sealed form is stored, and it is sealed the same way whichever of the two modes below your account is in. The difference is who else can get at the key.
Recoverable (the default). A copy of the key is kept on our server, encrypted under a root key held outside the database. Signing in is enough to get your account back on any device. It also means we could technically decrypt your ledger, and we are saying so rather than implying otherwise. We do so only in the one case below, at your request, and nothing in the app or our systems does it automatically.
If you lose access. Our support can help a recoverable account in two ways, and only the account’s owner on our side can start either, with a recorded reason. We can move your account to a new email address once you confirm from that address; nothing is decrypted, and your device opens the ledger as usual. Or, if you cannot use the app at all, we can decrypt your ledger and email the address on your account a download link that works once, for a day. The file goes only to you; our staff never see what is in it. You are told by email and every step is logged. An end-to-end encrypted account cannot be recovered this way by anyone.
End-to-end encrypted (Account → End-to-end encryption). Turning it on destroys the escrowed copy. From then on the key exists only on your own devices and inside a recovery code shown to you once and stored nowhere. Neither we nor our hosting provider can open the ledger. Lose every device and the recovery code and it is gone. There is no reset. That is what end-to-end means, and it is the reason it is a choice rather than the default.
A key never moves between devices in the clear in either mode: a device you already use seals a copy to the new device’s public key, which only that device can open. Your password is not part of any of this: it signs you in, and changing or resetting it cannot cost you your ledger.
What is not encrypted, in either mode, is your account itself: your email address, your name and your profile picture. Those are how the account is identified and signed in, so they are stored in readable form. Nothing you record (no amount, wallet, category or note) is among them. You can export a backup file at any time.
5. Google sign-in
If you choose to sign in with Google, Monee requests only the email and profile scopes. That data is used solely to create and identify your account. It is not sold, not shared with third parties, not used for advertising, and not used to build a profile.
Monee’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect Monee from your Google account at any time at myaccount.google.com/permissions. Doing so stops you signing in that way; to remove your data, delete your account as described below.
6. Who else touches it
- Hetzner rents us the server that runs Monee's API and database. The server holds your email address, your name, your profile picture, your devices and your encrypted ledger, and, unless you have turned end-to-end encryption on, the escrowed copy of your key.
- Cloudflare carries traffic between the app and the server. It sees connection data, such as your IP address, but not what is inside the encrypted ledger.
- RevenueCat, only if you buy Monee Pro in the iOS or Android app. It receives your Monee account id and the purchase details from the App Store or Google Play, so the purchase unlocks Pro on your account. Apple or Google handle the payment itself.
- Verify Checkout, only if you buy Monee Pro in the web app. It handles the payment and tells us when it is paid; we keep the payment reference and amount, never your card or wallet details.
- Google, only if you choose to sign in with it, and only to authenticate you.
- open.er-api.com, for exchange rates, only if you switch that on under Main currency. That request carries a single currency code and nothing else (no account, no identifier, no ledger content), and it asks for every currency rather than the ones you hold, so the answer says nothing about you either. Left off, which is how it starts, Monee uses the rate table it was built with and the rates you enter.
Nothing is sold. Nothing is shared for advertising. Data may be disclosed if the law requires it, but the ledger would be handed over as ciphertext we cannot decrypt.
7. How long it is kept
Your account (email address, name, picture, devices, encrypted ledger and any escrowed key) is kept until you delete it. Deleting your account removes all of it immediately and permanently. Anonymous usage data is kept for 90 days and then reduced to daily totals; it is not linked to your account, so there is nothing of yours in it to delete.
8. Your choices
- Stop anonymous usage data. More → Share anonymous usage data. See Anonymous usage data.
- Turn on end-to-end encryption. Account → End-to-end encryption destroys our copy of your key, permanently. Read the warning on that screen first.
- Delete everything. Account → Delete account removes your encrypted ledger, your devices, any escrowed key and your account from our systems, and clears the data on the device.
- Take a copy. Export writes every transaction to a CSV, and a backup file holds the whole ledger in a form that restores whole. Both are free.
- Correct it. Everything in the ledger is editable in the app.
- Ask us. Write to privacy@smr.et for access, correction, deletion or a copy of your data. Depending on where you live you may have further rights, including to object to processing or to complain to a supervisory authority.
9. Security
Traffic is encrypted in transit with TLS. Rows are protected by row-level security, so a signed-in account can reach its own row and no other. The ledger is encrypted end to end as described above. No system is perfectly secure, but the design means a breach of our database yields ciphertext rather than anybody’s finances.
10. Children
Monee is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has created an account, write to us and we will remove it.
11. International transfers
Data is stored on a server rented from Hetzner, which may be located outside your country. What is stored about you is your email address and ciphertext.
12. Changes
If this policy changes, the date at the top changes with it. Material changes will be surfaced in the app before they take effect.