How Ninepence keeps your data
Ninepence keeps your household's budget on your household's own server, at home. This page says what it stores, where, and which outside services see a part of it.
What is stored
- Your account: your username, your first and last name, your email address and whether you verified it, and your password, kept only as a hash.
- Your profile: the display name the other members see, the palette you chose, and the household you last worked in.
- Each household you are a member of: its name and currency, its members and their roles, and the invitations sent for it, each with the invited email address.
- Its budget: categories, what is planned for each month, transactions with their merchants, accounts, recurring transactions, the rows of every file imported, and the connections to a bank.
Where it is kept
All of it is in the databases of the household's own server, which is reachable on the home network only. A bank connection's secret is kept there encrypted.
Every night a backup is made on the server, encrypted there, and stored with a provider of storage in the European Union. The provider holds no key, and cannot read it.
Who else sees what
- Brevo, which sends the emails
- Ninepence's emails are sent from [email protected] through Brevo, a company in the European Union: the email that verifies your address, the one that resets a password, and an invitation to a household. Brevo sees the address each is sent to and what it says, which for an invitation is the household's name and the display name of the member who invited you.
- Enable Banking, when a bank is linked
- When an Owner links a household's account at a bank, Ninepence reaches the bank through Enable Banking, which passes on the account's balance and its transactions, with your consent at the bank and for as long as it lasts.
- Anthropic, for a category the household's history cannot suggest
- When rows of an import or a bank sync are like nothing the household recorded before, and the server is set up for it, the text of each row and the names of the household's categories are sent to Anthropic, a company in the United States, whose model suggests a category. Account and card numbers and other long numbers are taken out of the text first. No amount, date, account or member is sent.
- Grafana Cloud, which watches the server
- The server sends how it is running, its timings, counts and errors, to Grafana Cloud, with identifiers and not names: email addresses, amounts, merchants and account numbers are taken out before anything leaves.
- Cloudflare, which serves this site
- Cloudflare holds the domain's addresses and serves these pages, and sees the requests for them, as any host would. These pages set no cookie and run no script.
Who to ask
Ask the person who runs the Ninepence server on your home network what is stored about you, and to correct or remove it. Within the app, you can leave a household at any time from its Members page.