How we protect your money and data

Signing in

We store your password only as a scrambled, one-way value, never the password itself, and never anything that could be turned back into it. When you choose a password, we also check it against lists of passwords known to have leaked in breaches (without your actual password ever leaving your device in readable form) and ask you to pick another if it shows up.

Two-factor authentication is built in. Once you turn it on, a 6-digit code from your authenticator app is required at every sign-in, alongside backup recovery codes you can keep somewhere safe. We deliberately don't offer text-message codes; they're vulnerable to phone-number hijacking.

Passkeys (biometric sign-in) are available on paid plans. You can sign in with Face ID, Touch ID, or Windows Hello instead of a password. The secret stays locked in your device; we only ever keep the part needed to check it, which on its own can't be used to sign in as you.

Sessions and devices

When you sign in, your browser holds a random sign-in token, and we keep only a scrambled version of it, so even a leaked database couldn't be used to take over your session. You're signed out automatically after a period of inactivity, and you choose how long that is, anywhere from 5 minutes to 8 hours, in your account settings (handy on a shared computer). You can review and sign out individual sessions any time.

Account activity (sign-ins, password changes, two-factor and passkey changes, sign-outs) is logged with the time, IP address, and approximate location, and kept for as long as you have an account. Your activity view shows the most recent 20 entries on the Free plan and 50 on paid plans.

Your data is isolated

Your records are walled off from every other household at the database itself, not just in our app code. By default a request can only ever reach its own household's data, so even a bug or a stray query can't wander into someone else's records. The only data that crosses that line is what you deliberately share, for example inviting a relative to chip in on your child's savings goal, and even then only that one shared item is visible to them. Everything else stays isolated. It's protection in depth.

Bank linking

When you connect a bank account, the sign-in happens entirely inside Plaid's secure connection flow; your bank username and password never touch our servers. Plaid hands us a secure access token, which we encrypt before storing.

You can disconnect any bank from your accounts page at any time, and the connection is revoked on Plaid's side too.

What we don't do with your data

We collect what's needed to make MoMoFi work and nothing more. We do not:

• Sell or share your financial data with third parties
• Use your transaction history to target advertising
• Embed third-party trackers, analytics pixels, or session-replay tools
• Send your email address to marketing networks

See the Privacy page for the full picture.

Export and deletion

From your data settings you can:

• Export: download a copy of everything you've entered (accounts, transactions, budgets, goals, and more) as plain spreadsheet files anyone can open. Your password and security secrets aren't included.
• Delete: there's a 30-day grace period during which you can change your mind. After that your data is permanently deleted; the only thing we keep is internal security-log entries that contain no personal information.

Receipts and attachments

Receipt photos are stored separately from your financial records, and they're only handed back after we confirm the file belongs to your household. There's no way to reach someone else's receipt by guessing at a link.

Connection security

Every page is served over a secure HTTPS connection. The app is locked down to run only its own code and to talk only to the services we list here (like Stripe and Plaid), and every action that changes your data is protected against forged requests from other sites.

Reporting a vulnerability