Security

finvue has no live connection to any bank or brokerage, so there's nothing to steal on that front. It never asks for, receives, or stores a bank password, brokerage login, or API key belonging to a real financial account. Transactions arrive one of two ways: you forward a notification email your bank already sent you, or a device-local automation reads your own phone's notifications. Neither path touches a login screen.

Sign-in runs entirely through Supabase Auth, by email and password. Supabase's own authentication service hashes the password; finvue's application code never receives or stores it in plaintext.

Every table that holds personal data has row-level security enabled at the database layer: expenses, holdings, debts, CPF balances, savings goals, and the rest. Postgres itself scopes a query to rows owned by the signed-in user, not application logic that could have a bug in it. Even a request that reached the database directly, bypassing the app entirely, couldn't read another user's rows.

• Receipt photos live in a private bucket. Nobody reads one by guessing its URL: every read goes through a signed URL that expires after an hour, and storage-level policy restricts both reads and writes to the owning user.
• Avatar images live in a public bucket, since a profile picture is meant to be seen by people you connect with in the app. If you'd rather not have a public image, an icon avatar works instead of uploading a photo.

Every connection between your browser, finvue, and its data store runs over HTTPS/TLS.

• Privacy Mode masks every balance and amount on screen, for using the app around other people. Toggle it from the sidebar or Settings → Privacy & Security.
• PIN lock requires a 4-digit PIN before opening the more sensitive pages: bank accounts, debts, salary, savings goals, on top of being signed in.

Settings → Privacy & Security → Delete Account removes your auth record and, through cascading database rules, every row tied to it, plus your receipt files and avatar from storage. It's immediate and permanent. There's no recovery window.