Privacy
The ledger belongs on your devices.
This page records the release contract. Downloads remain unavailable until the implementation and final legal review both pass.
Local ledger
Budget data, merchant text, and notes stay on the device. A downloadable build will not be published until its encrypted database and secure-vault binding are verified. Receipt photos are processed on-device, are never uploaded, and are never put into sync.
Encrypted sync
If you buy sync, the service receives ciphertext, routing identifiers, operation order, and quota metadata. It never receives a plaintext or readable ledger key; during an explicit device-pairing session it relays one single-use sealed key blob until that blob is consumed, canceled, or expires.
Optional AI
Remote AI is optional. Entry parsing sends only the editable text excerpt you confirm. A monthly review sends per-currency and per-envelope aggregate totals, comparison amounts, anomaly flags, and the envelope labels shown in that review—never individual entries. These requests are processed transiently and are not persisted or logged by Upwardo.
Telemetry
Analytics is allowlisted and never includes amounts, merchants, notes, envelope names, transcripts, receipts, or a stable sync-group identifier.
Delete
You can delete the local ledger and request deletion of encrypted sync blobs. Export remains available before deletion.