How your data is protected.

Signing in

• Passkeys. You can sign in with your device's own unlock. A passkey you have verified counts as your second factor.
• Two-factor for owners. Anyone who owns a household, and every administrator, uses an authenticator app as well as a password. There is no way to turn that off for those accounts.
• Limits on guessing. After five wrong passwords an account pauses for five minutes. Too many sign-in attempts from one place in a short time are paused as well, and the page tells you how long to wait. The same applies to the second step, password resets and invitation links.
• Sessions. Your session ends after 30 minutes without activity and after 12 hours in any case. Session cookies are marked Secure and HttpOnly, with SameSite set to Lax.
• Invitation links look the same to everyone. Opening one does not reveal whether an address already has an account.

Who can see what

• A household and a trip are two separate rooms. Someone invited to your trip never sees your household's books.
• Every page checks your access on every request, on the server. If you are not entitled to something, the page does not exist for you: you see the same "not found" as for a page that was never there.
• History is for everyone in the room. Who joined, who left, whose role changed, and every financial entry are listed in the household's or trip's history, readable by every member, including people who can only view. Nobody, including us, can change a member's access quietly.

Receipts

• Receipt files are stored outside the application's own folder and are never served as plain files. Every time a receipt is shown, the application checks again that you are allowed to see it.
• Location data and camera metadata are removed from photos before they are stored.
• A file is checked by inspecting its contents, not by trusting the name it arrived with.
• Deleting a receipt removes the file; the record that it existed stays in the audit trail.

Records that do not change

• Money is never stored as a floating-point number. Every amount is exact to the minor unit of its currency.
• Financial records are never edited. A mistake is voided and a corrected record is added; both stay visible.
• Exchange rates are recorded when they are used, and a stored total never changes when a rate changes later.
• Every write is recorded with who did it, when, and from which address. The audit trail is append-only, enforced by the database's own permissions, and never holds a password, a code or a secret.
• Submitting the same expense twice, by a double tap or a lost connection, records it once.

Backups

• Backups are taken every day, encrypted before they are written, and kept for 14 days. The key that decrypts them is not stored with them.
• A copy of each backup off the host is planned and not yet in place. This sentence will change when it is.

Cookies

Closestify sets only the cookies it needs to keep you signed in. There are no advertising or analytics cookies, in the app or on this site, so there is no cookie banner.

Reporting a vulnerability

If you believe you have found a security problem, write to [email protected] [step 02]. Tell us what you found and how to reproduce it. We reply to every report, we do not pursue people who report in good faith, and we ask that you give us reasonable time to fix a problem before describing it publicly. The same contact is published at /.well-known/security.txt.

Last reviewed: 2026-10-13. This page is updated when the controls change.