Finance Tracker Privacy: 15 Tools Compared

The documented boundaries at a glance

This is a summary of vendor documentation checked on 15 October 2026, not a safety score or independent security test. We build Exitmargin. Follow each tool name to the detailed notes and first-party sources below. “Not established here” means the cited material does not settle the question; it does not mean a feature is absent.

What this comparison establishes

We reviewed the linked first-party pages on 15 October 2026. This is a documentation comparison of 15 tools, including our own Exitmargin. We have a direct interest in Exitmargin. We did not perform a security audit or test every competitor. There are no paid placements or affiliate links in this article.

Vendor statements are attributed below. A feature page that does not mention encryption does not prove that encryption is absent. Encryption at rest protects stored data; end-to-end encryption also limits who has the keys. Those are different claims. A read-only bank connection can still disclose balances and transactions.

These tools serve different purposes: budgeting, accounting, investment analysis, planning, and balance checkpoints. The descriptions are not a security ranking. Check the current plan, settings, platform, and policy before entering private data.

1. Exitmargin: manual browser-local checkpoints

Exitmargin stores journal records in this browser profile. The calculator and journal do not upload entered financial values, require an account, or connect to banks. The database and exported backup files are not encrypted by the app. Clearing site data can remove the journal; recovery depends on a private backup.

The website host still receives technical requests and document URLs. Optional cookieless PostHog analytics measures only allowlisted usage events. Financial content, form values, local IDs, automatic DOM capture, and session replay are excluded. Cloudflare Web Analytics and Network Error Logging are disabled. Choose this model for manual asset-and-debt checkpoints when you can manage backups. It does not provide automatic sync, bank imports, or portfolio-return analysis.

Exitmargin storage and hosting limits →

2. Actual Budget: local data with optional encrypted sync

Actual’s privacy policy says financial data is stored locally. Optional sync uses a server you set up, and optional end-to-end encryption encrypts data on the device before transmission. Its policy also describes data export.

Check that encryption is enabled for the setup you choose. Running your own server gives you responsibility for its access and backups. This is a budgeting option with a different workflow from a small balance journal.

Actual Budget privacy policy →

3. GnuCash: file-based accounting

GnuCash describes XML storage by default, alternative database storage, balance-sheet reports, statement imports, and optional online quotes. It is a double-entry accounting tool, which records equal amounts on both sides of a transaction.

Its cited feature page does not establish a file-encryption guarantee. Check the storage choice and any online services you enable. This model fits detailed books and reconciliation when you want more accounting structure than periodic balance entry.

GnuCash features and storage formats →

4. Wealthfolio: local app with optional Connect services

Wealthfolio describes a local database and no account requirement for its standalone app. Its current feature list includes investments, net worth, spending, and planning. Optional Wealthfolio Connect adds automatic brokerage imports, encrypted device sync, and household sharing.

The local-only app and Connect are different privacy choices. The cited homepage’s encrypted-sync wording alone does not establish who holds the keys. Check the Connect documentation before enabling those services.

Wealthfolio features and Connect boundary →

5. HomeBank: a portable account-data file

HomeBank describes a single XML account-data file, asset and liability account types, statement imports, and QIF/CSV exports. It also provides transaction reports and budgets.

The cited feature page does not establish encryption of that file. Keep the file and its backups private. Consider it for a transaction-based personal-finance record rather than assuming every local app has the same storage protection.

HomeBank features and file portability →

6. Money Manager EX: local records and encryption support

Money Manager EX’s security page says financial records are local by default. It documents AES-256 database encryption support across specified desktop, Android, and iOS/iPad versions.

Confirm the version and that your database uses encryption. Support for encrypted databases is not proof that every existing file is encrypted. Its separate website privacy policy explicitly covers website collection, so do not use that policy alone to describe the app.

Money Manager EX safety and security →

Money Manager EX website privacy policy →

7. Portfolio Performance: investment records in XML

Portfolio Performance describes XML storage, CSV/JSON exports, transaction history, and investment-return calculations. It can obtain prices and exchange rates from external sources.

Its cited overview does not establish file encryption. Local records and online price requests are separate boundaries. This is a candidate for investment analysis; a portfolio return is not the same measure as change in total household net worth.

Portfolio Performance storage and features →

8. Ghostfolio: hosted or self-hosted portfolio software

Ghostfolio’s official repository describes a hosted Premium service and a self-hosted option. The self-hosted application uses a server-side PostgreSQL database and Redis. Its features include portfolio analysis and transaction import/export.

Self-hosted does not mean browser-only. The server and its operator remain part of the data boundary. The README does not establish end-to-end encryption. Check hosting access, backups, and enabled integrations for the deployment you use.

Ghostfolio official repository and self-hosting contract →

9. Microsoft Excel: protect the file you actually keep

Microsoft documents file-level protection using Encrypt with Password. It explicitly distinguishes file protection from workbook or worksheet protection.

Decide where the workbook and copies will be stored. A local file and a file uploaded to a cloud service have different sharing boundaries. Do not treat locked worksheet cells as encryption. Keep the password recoverable through your own secure method; Microsoft says it cannot retrieve forgotten passwords.

Microsoft: Protect an Excel file →

10. Google Sheets: hosted collaboration and sharing controls

Google’s Drive sharing guide distinguishes Restricted access from Anyone with the link. It describes viewer, commenter, and editor roles, download controls, and permissions inherited from a parent folder.

Manual entry into Sheets still puts the workbook in a hosted service. Check the file and parent-folder permissions before storing balances. Restricted sharing limits recipients; the cited sharing guide does not establish an end-to-end encryption claim. This model can suit household collaboration when hosted storage is acceptable.

Google Drive sharing and permission controls →

11. Lunch Money: a web-first budget with several import paths

Lunch Money lists bank sync, CSV imports, an API, and manual transaction entry. Its features include net worth tracking, collaboration, two-factor authentication, and encryption at rest.

Choosing manual entry avoids using its bank-sync path, but does not establish local-only storage. The cited feature page does not establish end-to-end encryption. Check its current security and privacy terms if you want hosted budgeting and reporting.

Lunch Money feature and security overview →

12. YNAB: hosted budgeting with read-only bank imports

YNAB’s security page describes encryption in transit and at rest. Direct Import uses aggregators including Plaid and MX; YNAB says it does not store bank credentials. Its access section describes limited cases where staff access customer data.

Read-only means the connection cannot move money through YNAB. It does not mean that financial data stays on your device. Review the aggregator boundary, retention, and account-deletion rules when choosing this budgeting model. The cited page does not establish end-to-end encryption.

YNAB security, access, and retention →

13. Monarch: connected financial tracking

Monarch’s security page describes read-only connections through third-party data providers, encryption at rest and in transit, and multi-factor authentication. It says Monarch does not see or store bank login credentials.

Its connection providers are still part of the data boundary. The page’s encryption wording does not establish end-to-end encryption. Compare the current provider and privacy terms when deciding whether connected tracking serves your needs.

Monarch security and provider boundary →

14. Kubera: server-side wealth tracking

Kubera explicitly states that data is encrypted at rest and in transit, but not end-to-end. Its security page explains that background sync and other features need server-side computation. It also describes read-only aggregator feeds and limited staff-access conditions.

This is a clear example of why encrypted storage and provider inability to read records are different properties. Check optional AI connections separately: Kubera says exported or connected portfolio data then falls under the receiving service’s policy.

Kubera encryption, access, and integration limits →

15. ProjectionLab: hosted financial planning without required bank linking

ProjectionLab’s security page says linked accounts are not required. It describes application data in Google Cloud Firestore, encryption at rest and in transit, multi-factor authentication, exports, and account deletion.

Its privacy policy covers financial-planning, technical, and usage data. Avoiding bank linking is therefore distinct from keeping planning numbers off a server. Its cited pages do not establish end-to-end encryption. Consider it for projections and scenarios rather than treating planning software as a balance-only journal.

ProjectionLab security and infrastructure →

ProjectionLab privacy policy →

Choose the boundary you can maintain

Start with the work you need to do. For a few monthly asset-and-debt checkpoints, a manual worksheet or journal may be enough. For transaction reconciliation, investment returns, or planning scenarios, choose a tool that actually supports that work.

Then check where records live, who holds encryption keys, which optional services receive data, and how you can export and restore it. Try synthetic balances first. Preserve a backup and test recovery before relying on the tool for an important record. Ask a provider when its documentation leaves a material question unanswered.

Try a manual net worth calculation →

Download the worksheet →

Review and correction log

15 October 2026: published the 15-tool documentation comparison with first-party links, creator disclosure, and explicit unknowns. Sources describe the versions and services checked on that date.

We recheck affected claims when a provider changes its storage, connections, encryption, or recovery documentation, or when a reader reports a correction. Material changes will be recorded here and in the article’s updated date. A new build alone does not count as a fresh vendor review.

Report a source change or correction →