Security and privacy

Your money data stays on your computer.

Flittly runs on your device, with no account needed. This page says exactly where your data lives, what is encrypted, and what the app does on the network.

Everything is stored on your device

Your statements, transactions, accounts, budgets, rules, receipts and attachments live in a database on your computer. We do not receive them. There is no sign-up step, and no advertising or analytics tools in the app or on this site.

The AI that categorizes transactions and reads receipts runs on your computer too, through Ollama, which you install separately for now. Nothing is sent to an AI provider unless you set one up yourself.

Where your data goes

The solid arrows stay inside your computer. The dashed arrows only exist if you choose to turn on Flittly Cloud (coming soon).

Data-flow diagram On your laptop, statements are read by Flittly and saved to your data on the same laptop. Dashed arrows lead from Flittly to Flittly Cloud and to Plaid, labelled only if you turn on Cloud. Your laptop Everything below stays here Statements PDF, CSV, OFX Flittly app and local AI Your data on this device Flittly Cloud optional Plaid bank connections only if you turn on Cloud only if you turn on Cloud

What is encrypted

  • Receipts and attachments, and the original statement files the app keeps so you can open them later (a setting, on by default), are encrypted on disk.
  • The database file is protected by your operating system's account security, such as FileVault or BitLocker. The app's Security page shows whether database encryption is active.
  • Backups (.flittly files) and device-to-device sync through a folder you choose, such as iCloud Drive or Dropbox, are encrypted before they leave the app. Your storage provider only sees ciphertext.
  • An optional app lock passcode keeps others from opening Flittly on your computer. It is stored only as a salted hash.

What the app contacts when Cloud is off

  • Update checks. The app asks our update server whether a newer version exists. The request carries the app version, your operating system and processor type, and the network information every internet request carries, such as your IP address. No financial data.
  • Model downloads. When you pick a local AI model, Ollama downloads it.

That is all. Merchant names are recognized from data shipped with the app, so no transaction details go anywhere. If you choose a hosted AI provider with your own key, after turning on consent in Settings, the text needed for the feature you use goes directly from your device to that provider. Leave it off and nothing is sent.

If you turn on Flittly Cloud

Flittly Cloud is optional and coming soon. It adds bank connections, the web app and sync across your devices. Only then does your data reach our servers.

  • Sign in with an email and password, or with Google or Apple. Sign-in is handled by Amazon Cognito. We never see or store your password.
  • You can add an authenticator app (two-step verification) or a passkey to your account.
  • Before you can connect a bank, the account must have two-step verification, a passkey, or a Google or Apple sign-in.
  • Bank connections go through Plaid, which collects your bank credentials on its own screen. Flittly never sees them. We ask Plaid for transaction data only, and the access token is stored encrypted.
  • Each cloud record is tied to your account and kept separate from other users' data.

The details are in the privacy policy.

Check it yourself, and take it with you

The app has its own Security page that lists what can leave your device and when: your statements, AI clean-up, update checks, and anything that only happens if you choose it. You do not have to take this page's word for it.

You can export all of your data at any time (Settings, Data, Export everything). If you create a cloud account, you can delete it yourself in Settings, Account, Delete cloud account. That cancels subscriptions, revokes bank connections and deletes your cloud records and sign-in. Data on your own devices is not affected.

Found a security problem?

Email support@flittly.com and put "Security" in the subject. Flittly is built by one independent developer, so please include enough detail to reproduce it.