Floor 2 · The Vault

Security you can check

Each protection on this floor is described the way it works in the app today, with its limits said plainly. No adjectives to take on trust: just the mechanism, and where to find it.

At a glance

Auto-Lock, out of the box: Immediately
Other Auto-Lock choices: 5 min, 15 min, 30 min, 45 min, 1 h or 24 h
Keys on a security-key account: 2 keys to 6 keys
One-time recovery codes: 10 codes
Safety wait before new keys after a recovery: 72 h
Ads, trackers and third-party analytics in the app: None
Website sign-in or web dashboard: None

As described for SI Money Tracker 5.0, checked 12 Oct 2026.

When you leave

Covered when you leave, locked when you return

The app is covered whenever you leave it, and asks for your key or code when you come back.

The privacy cover

While you’re signed in, an opaque screen with the app’s name covers everything the moment the app stops being in front: in the app switcher, behind Control Center and the notification shade, and over system sheets. There is no blur to see through, and the picture iOS keeps for the app switcher shows no figures.

Auto-Lock

Come back after the time you chose and the app says “App locked”. It asks for your second lock: a touch of your security key, or the 6-digit code from your code app. Our server checks it, and that check does one thing only: it lifts the lock. Unlocking with Face ID, Touch ID or your iPhone passcode is an option you can turn on.

The setting belongs to this iPhone, and the time counts from the moment you left the app. Moving the iPhone’s clock backwards locks the app too, so it can’t stretch the wait.

When it asks again

Immediately (default)
After 5 min
After 15 min
After 30 min
After 45 min
After 1 h
After 24 h

There is no Off. Lock now, in Account settings › Auto-Lock, locks the app on the spot before you hand someone your phone.

The cover and Auto-Lock run while you’re signed in. The budget also works with no account; then your plan is guarded by your iPhone’s own lock and iOS Data Protection.

No signal

If our server can’t be reached, Face ID, Touch ID or your iPhone passcode can unlock the app that one time. A refusal from the server is never treated as “offline”. So anyone who knows your iPhone passcode can unlock the app by taking the iPhone offline, for example with Airplane Mode: keep your passcode private.

No phone passcode

If your iPhone has no passcode, the app locks only when it can ask for your key or code. Otherwise it is only hidden in the app switcher, and it tells you so. Setting a passcode fixes that.

Never stuck

Every message on the lock screen offers “Try again”, and “Sign out” is always there. Signing out removes bank data from this iPhone and keeps your budget.

Pulling out a key

Does nothing by itself. iOS tells apps nothing when a key is unplugged or moved away, so the app makes no promise about key removal. What protects you is the cover when you leave and the lock when you come back.

The keys

Hardware security keys

A small physical key you tap or plug in, built on the open FIDO2 and WebAuthn standards. When security-key sign-up is open, you can choose keys as your second lock at your first sign-in, or switch to them later from a code app.

Tap or plug in

Hold the key flat against the top of your iPhone (NFC), or plug it into the USB-C or Lightning port.

PIN or fingerprint, every time

The key must confirm its PIN or your fingerprint at every use, so a found key alone can’t sign in. Too many wrong PINs lock a key, and resetting it erases it: one more reason to have two.

Two keys, up to six

Setup adds a main key and a backup key, so losing one never locks you out. You can remove a key only while 2 keys stay active, and an account holds at most 6 keys.

Certified models only

When you add a key, its model is checked against the FIDO Alliance Metadata Service. Uncertified, revoked or compromised models are refused. If a model you already use is later reported compromised, your key is paused for review.

Cloned-key detection

Our server compares each key’s signature counter. A key that acts like a copy is paused, and you review it with your other key. This works with keys that report a counter; many do, not all.

Made for this app alone

The key makes its sign-in inside its own hardware, tied to SI Money Tracker’s sign-in address, so a look-alike page can’t use it. Synced passkeys are refused. With the recommended Automatic setup, nothing about your account is stored on the key.

To change a key, you touch a different key from the one you’re changing. A lost key? In Account settings › Sign-in security, choose it, tap “This key is lost or stolen” and confirm with your other key: it stops working at once. Removing a key from your account, or reporting one lost, also signs out your other devices.

Two locks

Two locks on every account

You sign in with Apple, then prove it’s you a second time: a 6-digit code from a code app (like Apple’s Passwords) or a tap of one of your two hardware security keys. Every real account needs that second step.

Lock one: Sign in with Apple

New accounts use Sign in with Apple. The app asks Apple for no name, email address or phone number, and our server keeps an opaque account code from Apple (not your Apple ID or email), our own account number and, encrypted, a token Apple gives us so that deleting your account can also revoke Sign in with Apple.

Lock two: your code app or your keys

A code app shows a new code every 30 seconds, and each code is accepted only once. The app walks you through setting one up in Apple’s Passwords app. Or, when security-key sign-up is open, choose two security keys. You can switch between the two later; switching to keys also needs sign-up to be open.

After 8 wrong codes, trying again pauses for 15 min, and each further pause doubles, up to 24 h. Unlocking Auto-Lock with a code follows the same limits.

Recovery codes

At setup you get 10 one-time recovery codes, shown only once, and protection turns on only after you confirm you saved them. Each code works once, and our server keeps only a one-way hash of each. You can make a new set at any time in Account settings › Sign-in security; the old codes stop working at once. Wrong guesses pause recovery codes too.

On a code-app account, signing in with a recovery code signs out every other device, and for the next 30 min the app helps you set up your code app again, which gives you a fresh set of codes. Skip that, and the session can’t change sign-in security or unlock Auto-Lock with a code (the Face ID, Touch ID or passcode option still works if you turned it on); sign out and sign in again with your code app.

The safety wait (security-key accounts)

You sign in with a recovery code. Every device is signed out, and a recovery starts.
You wait 72 hours. If you find a key and sign in with it, the recovery is cancelled.
Within 7 days after the wait, you sign in again and enter another unused recovery code.
You add two new keys. The old keys stop working, and your other devices are signed out.

The wait means someone who steals a recovery code can’t take over a key account on the spot.

The guest list

Who can see your data

In Account settings › Sign-in security you can see who can see what you share, remove them, and sign out your other devices.

Who can see your data

Lists, by role, everyone who holds a seat on your account’s shared items, such as a shared wish list, with Remove beside each one.

Sign out on all other devices

One button, confirmed with your key or code, ends every other session.

Security activity

The last 50 events on your account: sign-ins, failed checks, keys added or removed, recoveries and new recovery codes. It stores no IP address and is deleted with your account.

Changes need your key or code

Changing sign-in security asks for fresh proof first: a key account touches one of its keys (a different one, if the change is to a key); a code-app account signs in with Apple again and enters its code.

The bank’s own window

Plaid handles bank logins

Your bank username and password go only to your bank or to Plaid’s secure window, never to us. We receive an encrypted access token, never your password.

Connecting a bank is part of Plus and needs a signed-in account. Plaid’s window opens in English and works with U.S. banks. The access token is stored encrypted on our server, and you can unlink a bank at any time in the app.

When you link a bank, your balances and transactions come from Plaid and are stored on our server, and the app gets them from there. We keep a working copy of transactions for about 90 days, and a monthly history until you delete your account. The Privacy Policy has the details.

In your pocket

Your plan is stored on your iPhone

Your full spending plan is stored on your iPhone and in your own iPhone backups; the app doesn’t send the plan itself to our server. While “Keep my plan’s monthly totals” is on, each month’s plan totals are saved, encrypted, with your account’s monthly history. When you create an account, “Keep my plan’s monthly totals” starts on; you can turn it off in Account settings › Monthly history. That stops new totals; a month that has already closed keeps its totals until you delete your account. We don’t sell your personal data. No ads, no trackers, no analytics SDKs in the app.

iOS Data Protection

Your plan can’t be opened while your iPhone is locked; the app says so instead of showing an empty plan. Monthly history, saved snapshots and plan exports use the strictest class. Synced bank transactions stay readable after the first unlock since restart, so a background sync can run; they are kept out of device backups and securely deleted when you sign out. Your plan is included in your own iPhone backup on purpose.

Your sign-in is tied to this iPhone

It is kept in the iPhone’s Keychain with “this device only” protection, so it never moves to another phone, even through a backup restore. Our server keeps only a one-way hash of it.

No hidden copies

The app keeps no web cache of bank responses. Signing out wipes synced transactions and caches from this iPhone, and your budget stays.

No ads, no tracking

The app has no advertising, no tracking and no third-party analytics or crash-reporting software. The one outside code library in it is Plaid’s bank-linking kit. The app saves its own crash diagnostics on this iPhone, keeps them out of backups and doesn’t send them to our server. If you turn on iPhone Analytics in iOS Settings, iOS shares crash reports with Apple, and with app developers too if you also choose that.

The exit

Leaving, on your terms

Delete your account in the app

Delete your account in the app at any time. It revokes your bank connections and deletes your account, sessions, bank connection records, monthly history and the content you saved. If a bank can’t be released, nothing is deleted and you can try again. Your budget is still stored on this iPhone.

See the Privacy Policy for the records the law or our logs still keep

Sign out

Ends the session on our server, removes synced bank data and caches from this iPhone, and keeps your budget. Your monthly history stays on our server until you delete your account.

Unlink a bank

Unlink any connected bank at any time from within the app. Unlinking stops new data from that bank. It doesn’t erase the last balance in your plan or the months already in your account’s history; deleting your account removes that history.

Take a copy

Export your plan as a PDF, spreadsheet, CSV or JSON file whenever you like.

The roof

Your plan, covered when you leave

Turn your paycheck into a plan on your iPhone. While you’re signed in, the app is covered whenever you leave it, and asks for your key or code when you come back.

Get SI Money Tracker Coming soon

The budget comes with the app, no account needed. Plus adds bank connection and automatic import: 7 days free when Apple says you're eligible, then $9.99/month, billed through your Apple Account. Cancel anytime in Settings.