Your data and privacy

What is encrypted. Every amount, payee, note, category name, account name, goal name, and journal entry is encrypted using AES-256-GCM before it is stored. Carlo cannot read any of it without your key.

Where your key lives. Your encryption key is derived from your 12-word recovery key, which lives in your own iCloud or Google account, under your account, not Carlo's. It's kept in a private app area — a hidden app folder in your Google Drive on Android, a private app container in iCloud on iPhone — so you won't see a file to manage on either platform. That's intentional, so it can't be deleted by accident. It's also cached in your device's keystore for speed. Neither Carlo nor Supabase holds your key in plaintext.

Protecting the account that holds your key. Because your key lives in your iCloud or Google account so it can sync to your devices, anyone who can sign into that account can unlock your Carlo data — the same way they could reach your photos or email. The strongest thing you can do to protect your finances is protect that account: a strong, unique password and two-factor authentication. On iPhone, turning on Advanced Data Protection for iCloud goes further. It makes your key end-to-end encrypted to Apple too, so not even Apple can be compelled to hand it over. To turn it on: Settings → [your name] → iCloud → Advanced Data Protection. "End-to-end encrypted" doesn't mean a stranger with your Apple or Google password is locked out. It means Carlo is. Lock down the account that holds the key.

What Carlo can see. Some structure stays readable because the app needs it to work: the dates on your entries, when you created or edited them, the ID numbers linking your records, and flags like whether something is archived or is income versus an expense. Carlo cannot see the amounts, payees, notes, or any other content. Those are encrypted, and as of the latest version their encrypted size is padded to coarse buckets so their length doesn't leak either. Someone with database access could tell that you recorded something on a given day and roughly how much data your account holds, but not what any of it was or what it was worth.

When something leaves your phone. A few features send data off your device, always because you chose to use them. Voice entry sends that one recording out, along with your list of payee and account names so the models can recognize them: the audio goes to Groq to transcribe, and the transcript goes to Anthropic to read it into an entry. Groq is set to keep nothing; Anthropic doesn't train on what it sees and keeps nothing either. Ask Carlo (the help chat) sends the questions you type to Anthropic to answer them; it has no access to your financial data, only the text you type into the chat. And feedback you send, including any screenshot you attach, can be read by the developer, because you chose to send it. Typed entries and everything else leave your phone encrypted and stay sealed.

What can and can't be compelled. A subpoena served to Carlo produces ciphertext Carlo cannot decrypt. If you have connected a bank the standard way, there is one exception: the credential that keeps that connection open is held on Carlo's servers and is not encrypted with your key, and Carlo can also see which bank it is and the dates of the charges. (Connecting with SimpleFIN keeps that credential on your phone instead.) Your recovery key is backed up in your own iCloud Drive (iOS) or Google Drive (Android), so Apple or Google could in principle be compelled to disclose it — and anyone who breaks into that cloud account could reach it too. Carlo cannot. (See "Protecting the account that holds your key" above.)

Photos. Receipt photos are encrypted before uploading. Carlo cannot view your attachments.

Your recovery code. Carlo generates a 12-word recovery code and stores it in your cloud storage (iCloud Drive or Google Drive). If you ever lose access to that cloud account, you can use the recovery code to restore your data. Find it under the More menu → Settings → Security → Recovery code.

Two closing points. Encryption is on by default and there is nothing for you to turn on. And Carlo has no bank connection unless you set one up; if you do, it is read-only and limited to transactions, so Carlo cannot move money and never sees your banking password.