Password rules that stop the obvious
At least ten characters, not a common password and not your email address. Passwords are stored only as salted hashes.
Security
Built so the wrong person never sees your figures
Moneva holds the plans and records of households, groups and projects. These are the protections you get by default, written for the people who use the app rather than for auditors. Questions are welcome through the contact page.
Signing in
Your account, with a second step when you want one
Authenticator app (two-step sign-in)
Turn it on from Settings → Security: scan a QR code with Google Authenticator, Microsoft Authenticator or any TOTP app and enter a six-digit code when you sign in. You receive recovery codes for the day the phone is lost; turning two-step off again asks for a code first.
Sign-in attempts are limited
Too many attempts pause sign-in for a short while, per address and per account, so a guessed password cannot be brute-forced.
Sessions you can see and end
Every sign-in is listed under Settings → Security with its device, IP address and last activity, and you can end the others with one tap; changing your password signs out every other session.
Permissions
Checked on the server, every time
Object-level authorisation
Each budget, transaction, receipt and goal belongs to a space. A view loads it through your membership and checks the capability your role grants before anything is shown or saved. Hiding a button is never the only protection.
Not found, not forbidden
If you are not a member, the page answers 404 — the same as for a budget that does not exist — so nobody can confirm what others have.
Per-budget access levels
A contributor can be limited to income, expenses, transactions or view only, and the owner decides whether they see other members' names and entries, category totals or balances.
An audit trail that cannot be edited
Consequential actions — activating a budget, approving spending, reversing a transaction, changing security settings — are written to an append-only log. Financial records are never deleted; mistakes are reversed, so shared budgets stay explainable.
Privacy
Private by default
Personal spaces are yours alone
Nobody else can see a personal space's budgets, income or transactions. Shared spaces show members only what their role and the owner's settings allow; activity feeds show actions, not amounts, unless the space turns amounts on.
Only what you enter
Income and expenses are recorded by hand or imported from a CSV file, so the only financial data we hold is what you chose to enter.
No ads, no trackers, no AI reading your data
No third-party script loads on any page — a strict content security policy makes sure of it. Insights are computed on our servers from your own figures with rules the page explains.
Receipts stay private
Uploads are checked by content, stored privately and served only to people allowed to see that record, never from a public link.
Your data
Take it with you, or take it down
Export any time
Settings → Data gives you a download of your own records whenever you want it.
Deletion with a grace period
Request deletion and the account is anonymised after seven days, during which you can change your mind. Records in shared spaces stay with the space, without your personal identifiers, because other members' balances depend on them.
Encrypted in transit and at rest where it matters
Connections use HTTPS; authenticator secrets are encrypted in the database; cookies are HttpOnly and same-site.
Found a security problem?
Tell us through the contact page before you tell anyone else, with enough detail to reproduce it. We read every message and reply to the address you give. Please do not test against other people's accounts or data.
Related: Privacy policy · Terms of service · FAQ
Your figures, your rules
Create a free account, turn on two-step sign-in from Settings and invite only the people you choose.