Sign-in and account isolation
Casharchy signs you in through Supabase Auth, with Google or with an email address and password. Casharchy never sees your Google password. Email passwords must be at least 12 characters, are kept by Supabase Auth only as one-way hashes (never in Casharchy’s own tables), and a new email address must be confirmed before it can sign in. Application tables in our Supabase PostgreSQL database enforce row-level security (RLS) policies scoped to the authenticated user ID (auth.uid() = user_id), isolating each account’s records. The API routes the app calls verify your Supabase sign-in token before reading or writing your account data.
Transport, storage, and backups
Traffic between your browser, Casharchy on Vercel, and upstream service providers is encrypted in transit over HTTPS, and our hosting and database providers encrypt stored data at rest. When you download a household disaster backup from Settings, your browser encrypts the archive on your device using AES-256-GCM with PBKDF2-SHA-256 key derivation before download.
Institution access
On paid accounts, Casharchy uses Plaid to read data from the financial accounts you select. Institution credentials are entered directly in Plaid Link; Casharchy never sees or stores your bank or brokerage password. Plaid access tokens stay on the server, are excluded from browser database column grants, and are never sent to the browser. Casharchy has read-only access through Plaid and cannot move money or place trades.
Data and connection controls
Paid accounts can disconnect any connected institution in Settings, which revokes Casharchy’s Plaid access token (/item/remove) while preserving saved history. Disabling an account’s visibility in the app is separate from revoking access. Deleting your account in Settings > Backup > Delete account removes every connected institution at Plaid and deletes all Casharchy records and your sign-in account in one step. See Privacy and Delete account for details.
Report a security issue
Email security@casharchy.com with the affected page and steps to reproduce the issue. Do not include passwords, backup passphrases, or access tokens.