How we protect your data

Your passcode never leaves your device. On your device, it is turned into the key that locks your data.

Only locked data is stored on our servers. We cannot read your balances or personal details — and neither can anyone who breaks into our servers, because the key never reaches them.

When you sign in, your device locks and unlocks the data locally. The server only ever sees the locked version.

Honesty matters more than a tidy slogan. A small amount of bookkeeping stays readable so the service can run:

• The country you live in.
• The types of accounts, holdings and debts you have added — never the amounts.
• Whether your subscription is free or paid.
• When your records were last saved.
• Where the app records which features you use — first-party usage events carrying the event name and grouped details only, never your figures, and only from a signed-in session.
• If you have asked us to be able to tell you about a security incident, the email address you sign in with — held in the clear so we can write to you, used for nothing else, and deleted the moment you withdraw it.

Everything else — balances, names, notes, wishes — is locked before it leaves your device.

Everything above is true and we would rather you also knew where it stops.

We keep a copy of your key that has been locked with your recovery phrase. We cannot open it — but it is on our servers, and if someone stole everything we hold, that copy is what they would attack. They would do it on their own machines, at their own pace, guessing your phrase.

Guessing is made deliberately slow: unlocking takes real time and memory on purpose, so a machine that could try billions of passwords a second against an ordinary website manages far fewer here. It is a cost, not a wall. A short or reused phrase is guessable and a long, random one is not, which is why the phrase is the one thing worth taking seriously when you set it up.

We would rather write this down than let you find it yourself and wonder what else went unmentioned.

If we were lawfully ordered to hand over everything we hold about you, this is what that would actually be.

Your balances, holdings, debts, goals, wishes and notes would arrive as locked files that nobody at KinnWealth can open. We do not hold the key, and we cannot be made to produce one we do not have.

Readable, without your key: the country you live in, the currency you think in, the kinds of accounts, holdings and debts you have recorded and which countries they sit in, when each record was last saved, and when you signed in. If you asked us to be able to tell you about a security incident, your email address is readable too. If you pay for a plan, the payment processor holds your name, email and card details in the ordinary way.

That second list carries no amounts. It is still a description of where a household keeps its money, and for some people that is the more sensitive of the two. It is why we would rather set it out here than let a privacy page imply the locked files are the whole story.

If an advisory firm uses KinnWealth, an adviser can keep notes about their work with you in a workspace of their own. That workspace is the firm’s record, not part of your plan, and nothing links it to your account — so we cannot tell you whether one exists or show you what is in it.

Adviser notes are encrypted with a key the platform holds, so unlike your own records they are readable by the platform. By policy they contain no personal details about you, and that policy is kept by human review, not by the encryption itself.

Because nothing links a workspace to your account, adviser notes are not part of the copy of your data you can download, and closing your account does not remove them. The firm holds those notes; ask the firm.

Everything you enter yourself stays exactly as described above — locked on your device, unreadable to us.

• We never read your balances or personal details.
• We never show ads, and we never make money from your data.
• We never hold, move or invest your money — there is no way to pay in or take out investments here.
• We never contact you to offer investment products.

The only money that changes hands is the subscription payment.

Because only you hold the key, only you can unlock your data. During setup you choose a recovery phrase and download a recovery file — keep the phrase somewhere safe, because it can restore your account even without the file. You can also add a passkey, so your fingerprint or face signs you in; on devices that support it, it also opens your data when you cannot remember your passcode. A passkey is tied to that device, though, and after an account recovery you set it up again — the phrase stays your way back.

If you forget both your passcode and your recovery phrase, your data cannot be recovered by KinnWealth.

Any day you like, you can take a full copy of everything you have entered. You get two files: one a computer can read, and one a person can read — plain text, in plain words. Both are put together on your own device, so neither needs us to be running, and neither costs anything.

Keep them wherever you keep your other papers. Nothing in either file needs KinnWealth, an account, or an internet connection to open.

What we have not done: there is no arrangement with anyone else to keep this service running if the company does not. We would rather name that than let a page imply otherwise. It is a fair reason to take a copy now, and again whenever something changes.

No outside party has audited this. There is no independent security review, no certification, and no published test by anyone but us. We are not pursuing one at this stage, and we would rather write that here than let a padlock and a confident paragraph imply otherwise.

What there is instead: the design is written down in full, and the promises on this page are each tied to a test that fails our build if the promise stops being true. A check that runs on every change is a different kind of evidence from a certificate someone issued once — weaker in reputation, stronger in the thing you actually want, which is that it is still true this morning.

When that changes, this section is where it will say so.

Open your browser’s developer tools, choose the network tab, and reload this page. Almost everything you see is served from this site. Two exceptions, so you are not surprised by them: the two typefaces come from Google’s font service, which means Google sees the address you are connecting from. We would rather serve them ourselves and that is a change we have not made yet.

What you will not find: an advertising pixel, a tag manager, a session recorder, or an analytics script belonging to anyone else. Check the cookie list too — it is empty before you sign in.

This is not the most important thing on this page. It is the only part you can settle for yourself in a minute, without taking our word for anything, so it belongs here rather than in a footnote.

Your locked data is processed in Singapore, under PDPA in Singapore and PDPO in Hong Kong. These pages carry no trackers and no third-party analytics scripts.

KinnWealth is a planning tool. We never hold your money and never offer investment products.