Privacy
Last changed 14 October 2026
Your spending stays on your phone. Nobody else can read it, us included.
There's no sign-up and no account. We don't know your name, email or phone number.
What Coffer keeps, and where
Things that stay on your phone
- Widgets. The app leaves a small summary for them on your phone: this month's totals, the next few repeats and your category names. Never an entry.
- Siri and Shortcuts. What you tell Siri is handed to the app on your phone. Apple handles the listening, as it does for any app.
- Spotlight. The names of shops and people you've paid can be searched on your phone, with no amounts, since search works from a locked phone too.
- Reminders. Set on your phone. There's no server sending them.
- Face ID. Handled by iOS. The app only learns yes or no.
Splitting with friends
A group is a shared, locked log in the vault. Its key travels inside the invite link, after
the #, which never reaches any server. Only people with the link can read the
group, and we can't. Anyone you send the link to can join, so share it only with the group.
App updates
When it opens, the app asks Expo, the service that delivers its updates, whether there's a newer version. That request carries the app and iOS versions and a random number made on install, which Expo uses to count how many phones it updated. Nothing you've logged is part of it.
What we never get
- Anything you've logged, in a form we can read
- Your name, email, phone number or contacts
- Analytics, ads or trackers. Coffer has none
We have nothing to sell and nobody to share it with.
The vault
The vault stores locked bytes under a random ID, plus a fingerprint of the key that wrote them, so only your phone can change them. Like any website, it sees your internet address when your phone backs up. It uses that for a minute to stop floods of requests, and keeps no logs.
Reading bank emails
This isn't in the app yet. When it arrives and you switch on automatic tracking, Coffer connects to your Gmail on your phone and reads only alert emails from banks and card companies. It reads them on the phone. Nothing from your mail is sent to us or anyone else, and you can disconnect at any time.
Coffer's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Deleting it
Delete the app and everything on your phone goes with it. To delete the locked backup too, open Settings, then Backup, and choose Delete backup, before you delete the app. If the app is already gone, install it, restore with your 12 words, then delete the backup.
If this changes
This page changes first, and the date at the top moves.
Support
Something not working, or a question? Write to us.
design@haxsh.inPlease don't send screenshots of your spending. We'd rather not see it.
I got a new phone
Install Coffer, open Settings, then Backup, and choose to restore from your recovery code. Type the 12 words and everything comes back.
I lost my recovery code
If you still have your phone, Settings, then Backup, shows it again. Write it down somewhere safe.
I lost my phone and the code
Then nobody can bring your entries back, us included. That's the price of nobody else being able to read them, and it's why the app asks you to keep the code.
The widget looks out of date
Widgets refresh when you open the app or add an entry. iOS decides the rest, so open Coffer once and it catches up.
A bank isn't showing up
Coffer can only read alerts your bank emails. Many banks email alerts only once you switch them on. The app shows how for each bank.