Is it safe to put your spending in a budgeting app?
Your ledger is a detailed record of where you go and what you do. What the different kinds of budgeting app actually hold, the questions worth asking before you commit, and honest answers for this one.
A household ledger is a more revealing document than most people realise while they are creating one. Read a year of it and you can reconstruct where someone lives, where they work, when they travel, which pharmacy they use, what they eat, whether they drink, whether they gamble, when they were ill, when a relationship started and when it ended. A payment history is a location history with prices attached.
That does not mean you should not use one. It means the question "is this safe" deserves a real answer rather than a reassuring adjective, and that the answer differs a great deal between kinds of app.
The three kinds, and what each actually holds
Bank-connected apps
These link to your accounts, usually through an aggregator, and import transactions automatically. It is the most convenient category and the one that concentrates the most risk, because the connection is a standing arrangement rather than a one-off.
What to understand about them: there is usually a third party in the middle that you did not choose and whose name may not be prominent. Depending on the country and the connection method, access may be granted through a regulated open-banking flow with a defined scope, or through credential-based access where a service holds something that can read your accounts. Both exist. The regulated versions are considerably better defined, and it is worth knowing which you are agreeing to. It is also worth asking what happens to the imported data if the aggregator changes ownership, and whether the app’s business model involves anything beyond your subscription.
Cloud-synced manual apps
You enter transactions yourself; the app stores them on its server so they reach your other devices and other household members. There is no bank access at all, so nothing about your accounts is ever handed over, and the worst case is limited to the entries you chose to type in.
The trade-off is real but narrower: the data is on someone’s server, and you are relying on that server being competently run and on the operator being straightforward about who can read it. Fambook is in this category and there is no point pretending otherwise.
Local-only apps
Everything stays on the device. The privacy position is the strongest available and the cost is concrete: no sharing with a partner, no second device, and if you lose your phone without a backup you lose the ledger. For a single person tracking alone, this is often the right answer. For a household where two people need the same book, it is not an option at all — sharing requires a server somewhere by definition.
Questions worth asking before you commit
- Where is my data, in one sentence? An app that cannot answer this plainly on its own site is telling you something.
- What can I get out, in what format, without paying? Export is the difference between a service and a trap. If exporting your own records requires a subscription, that is a design decision about leverage, not about cost.
- Can I delete the account and its data myself, in the app? "Email support to request deletion" is a friction mechanism, and it is one you can evaluate before you sign up rather than after.
- Does the app connect to my bank, and if so, through what? Regulated open banking with a defined scope and a credential-based screen scrape are not the same thing.
- What does the App Store privacy label say, and does it match the marketing? The labels are declared by developers rather than verified in detail, but a mismatch between the label and the front page is informative.
- Is there an advertising or analytics business? An app with no subscription and no ads is being paid by someone, and it is reasonable to want to know who.
- What happens when it shuts down? Small apps close. An app whose data you can export is one you can survive the closure of.
The extra question a shared ledger raises
Sharing is the feature that makes a household ledger worth keeping, and it introduces a risk that has nothing to do with servers: the other people in it can see what you record.
This sounds obvious and is regularly forgotten, usually in the specific case of a gift. It matters more in situations that are not hypothetical — someone leaving a controlling relationship, an adult child sharing a book with a parent, a separation in progress. If you are in one of those, treat a shared ledger as visible by default and keep out of it anything that needs to stay out.
It is worth checking how an app handles joining and leaving. In Fambook, joining a household requires a code that someone creates and that expires, both sides have to act, and — this is the part that surprises people — your existing entries are not merged into the shared book. Entries you made before joining stay attached to you. Leaving a household does not take your history away either. That behaviour is deliberate: quietly pouring somebody’s hundreds of private entries into a shared ledger is not a feature.
How Fambook handles it, plainly
A straight account, since the point of this page is that vagueness is the problem.
- Every entry is written to a database on your own phone first, then uploaded to our server, which runs on Supabase. The upload is what makes sharing and device recovery work.
- Access to rows is enforced by the database, not by the app being well behaved: a row can be read by the account that created it and by the household it belongs to. Operations that cross between accounts happen on the server, and the app on your phone is not given the ability to write into another household.
- There is no bank connection and no card link. Nothing about your accounts is ever handed over, because it is never asked for.
- The AI features are the only path to a company other than us, and they run only when you press the button. A receipt photo, a pasted bank message, or the text of what you said is forwarded to a model provider to have the amount and category read out of it. The photo is not stored — there is no image column anywhere in the app’s database. Speech is converted to text by iOS on your phone; the audio is not uploaded. Never press those buttons and nothing goes to a model provider.
- Location, if allowed, suggests a place name for the entry you are writing at that moment. It is a suggestion until you tap it, and what is stored is a name attached to that entry.
- Export to CSV is free and will stay free. So is import. An app you cannot leave is a trap, and putting export behind a subscription is a way of making one.
- Deleting your account and its data is one step, inside the app.
- There are no adverts and no data-selling business. The subscription is the business model, and it buys features that save typing rather than access to your own records.
What we cannot honestly claim is that the data never leaves your phone. It does — that is what makes a shared household ledger possible at all. Anyone marketing a syncing app as if the data stayed local is either confused or hoping you are.
Practical steps regardless of which app you pick
- Export a copy every few months and keep it somewhere you control. This protects you against the app closing, an account problem, and your own mistakes at once.
- Use a distinct password and turn on whatever second factor is available on the account.
- Decide deliberately what goes into a shared book, before you need to have decided.
- Look at what permissions the app requests and when. An app that asks for location on first launch, before you have recorded anything, is asking for something it has not yet earned a use for.
- If you are in the EU, UK or a similar jurisdiction, you have a legal right to a copy of your data in a portable format — GDPR Article 20 among others. Any app that makes exercising that hard is worth leaving on those grounds alone.
The realistic conclusion is not that budgeting apps are unsafe. It is that "safe" is not a property an app has, but a set of specific answers about storage, access, export and business model. Those answers exist for every app you might use; the difference is whether they are written down where you can read them.
Frequently asked questions
Is it safe to link a budgeting app to my bank?
It depends heavily on how the link is made. A regulated open-banking connection with a defined scope you can revoke is a much better position than credential-based access held by a third party. Ask which one you are agreeing to, and who the aggregator in the middle is. Fambook has no bank connection at all.
Where does Fambook store my data?
On your phone first, then on our server, which runs on Supabase. Rows are readable by the account that created them and by the household they belong to, enforced by the database rather than by the app. Sharing between two phones is exactly why the server exists.
Can I use it without an account?
No. The ledger is shared and has to reach a second phone, which requires an account. If you want a genuinely local-only tracker, use one that says so and accept that sharing and device recovery are not available.
Are my receipt photos uploaded and kept?
A photo is sent to be read for the amount and category if you press that button, and it is not stored — there is no image column in the app’s database. If you never use the feature, no photo is sent anywhere.
What can my partner see?
Everything recorded into the shared household. Entries you made before joining are not merged into it and remain yours. Treat a shared ledger as visible by default, and keep anything that must stay private outside the shared scope.
How do I get my data out or delete it?
Export the whole ledger to CSV from inside the app, free, at any time. Deleting the account and its data is one step in the app. Export first if you want a copy, because deletion is not reversible from our side.
Try it for one month
Fambook gives a household one shared ledger: anyone can add an entry in seconds, every entry says who spent it, and the month adds up in one place instead of two. Records with no signal and syncs afterwards. Recording, categories, budgets, statistics, CSV import and export, sync and sharing for two people are free — the subscription only buys you less typing.