How your data stays private

The short, plain-language version. For the full detail, see the Privacy Policy.

Klaro is built so your money stays yours. Your personal finances never leave your phone, and the one thing that does sync — Shared Spaces — is end-to-end encrypted, so even we can't read it. Here's how that works.

Your ledger lives on your device

Everything in your Personal ledger is stored in an encrypted database on your phone. There's no account to sign up for, no copy sitting on our servers, and nothing for us to read, sell, or lose. If you never turn on a single optional feature, your data simply never leaves your device.

Shared Spaces are end-to-end encrypted

When you share a household or couple's ledger, that data has to travel between phones — so we encrypt it end to end. "End to end" means it's scrambled on your device before it's sent and only unscrambled on the phones of the people you share with. It passes through a small relay we run to shuttle it between you, but the relay only ever sees scrambled data it holds no key to open. That's what lets us say we can't read your shared money either.

How the encryption works, plainly

A few specifics, without the jargon:

• Each shared space gets its own random 256-bit key — the kind that isn't guessable in any practical amount of time.
• That key is created on your device and held in your phone's hardware-backed secure storage (the Android Keystore). We never receive it.
• When you invite someone, the key travels inside the invite you hand them directly — best of all by scanning a QR code in person. It never passes through our servers.
• Every change is encrypted with that key — using NaCl, a widely used and well-studied encryption library, not something we invented — and authenticated, so any tampering is detected and rejected.
• Our relay stores only the encrypted result. It knows who is in a space and when they last synced, but never what's inside.

Treat your invite like a password

Because the space's key travels inside the invite, the invite is a secret. Share it directly with the person joining — a QR scan in person is safest — rather than posting it somewhere public or forwarding it through a channel you don't trust. Anyone who sees the invite can read that space.

Backups stay in your Google Drive

If you turn on backup, an encrypted copy of your data goes to a private folder inside your own Google Drive that only this app can open. We run no servers for it and never receive a copy — the backup lives under your Google account, not ours, and you can delete it whenever you like.

What we don't do

No ads. No trackers or analytics SDKs building a profile of you. No selling or sharing your data with anyone. No account required to start. The business model is a simple subscription — you pay for the app, so your data doesn't have to.