You choose where your numbers can be read.

The three modes side by side

Where your data can be read

Each row is a mode. Each box says what that place can read.

What works in each mode

Features that run on your device work in every mode. Features that need our servers to read your data are off in the encrypted modes.

What we can still see

Encrypting your data does not make us blind to everything. In both encrypted modes we can see:

• Your account email and user id
• Your plan tier and subscription status
• Which mode you are in
• How many records you have, how large they are, and when they were written
• For transactions, which months they fall in (the number of transactions per month, not what they are)
• Which months have a budget
• The names of the institutions you connect and whether each connection is healthy
• Whether you use the AI or MCP calculators

We cannot read amounts, balances, descriptions, categories, names, plan inputs, results, transfer pairings, rules or notes. In short: we can see that you are a subscriber and roughly how much you use the app, not your finances.

Plaid and your bank data

In Encrypted sync, your device holds the Plaid access token, encrypted in your vault. We keep no usable token, so we cannot reach your bank unless your device asks. When it asks, the data passes through our server on its way to your device. We do not store it or log it in readable form.

Plaid keeps its own copy of what it pulls from your bank. Its privacy policy lets it use that data for its own purposes, such as fraud prevention, product improvement and de-identified use. “Plaid keeps a copy” understates it. You can see and manage what Plaid holds, and remove connections, at my.plaid.com.

Private mode has no bank connection, so Plaid never holds anything on your behalf.

Your key, and what happens if you lose it

In both encrypted modes your data is locked with a key made on your device. We never hold a key that opens it. That is the point, and it has one consequence.

• Setup: your device makes the keys, then shows you a recovery code once. You save it before encryption turns on.
• Everyday unlock: Face ID or Touch ID on the app. On the web, you can choose “remember this browser” so you do not retype the code. That is off by default, and anyone who can use that browser profile could then open your data.
• Optional passphrase: a second way to unlock on a new device.
• New device: sign in, then unlock with your recovery code, your passphrase or a device you already enrolled.

If you lose your key, your data is gone

If you lose your recovery code, your passphrase and every enrolled device, nobody can recover your data, including us. There is no back door and no recovery by email.

If you reset anyway, we keep the encrypted copy for a grace period, so finding your recovery code later still unlocks it. After that the account is emptied.

If you had a bank connected, only your device holds the token, so we cannot disconnect the bank for you. Revoke the connection at my.plaid.com so it is closed on Plaid’s side too.

The honest limit

We ship the app’s code. A malicious future release could, in principle, send data off your device. So the claim we can defend is this: your data is encrypted on your device, and we store ciphertext we can’t decrypt. We are not claiming it would be impossible for anyone at cinder.fi to ever see it.

In Encrypted sync, readable bank data does pass through our server during a sync your device requested. A malicious server release could copy it then. To see it, we would have to change the app, which is different from being unable to.

Your device keeps a readable working copy so the app runs. Anyone who can use your unlocked device and browser profile can see it.

How you can check, not just trust

You don’t have to take our word for it. Here is what you can check today, and what is still to come.

• Open source. The encryption code that runs on your device is public at github.com/cinderfi/vault. Anyone can read it, run its tests, and use the offline verifier to check that what we store for them is ciphertext.
• Reviewed with AI. In October 2026 the whole feature was reviewed with AI, including Anthropic’s Claude Fable model: the encryption, our server code, and switching between modes. Every finding was checked against the code and fixed before launch. Read the summary of findings.
• External review: planned. An independent review of the server side is planned. Until it’s done, the parts you can’t check yourself are the ones that run on our servers, and this page says so.

Switching modes

• You can switch an existing account between modes in either direction, from Settings. Your plans and history move with you.
• Moving to an encrypted mode: your device encrypts your data and uploads it, and only then do we delete the readable copy.
• Moving back to Full-featured: your device decrypts and uploads your data, after you confirm that cinder.fi will be able to read it again.
• Older readable copies, such as backups and analytics or error-tracking history, do not disappear when you switch. We remove what we can, and the switch screen says what remains.