Why your budgeting app should not own your financial data

Denne artikel er endnu ikke fuldt oversat — visse afsnit er stadig på engelsk.

I am not allergic to the cloud. I am allergic to pretending that “export CSV” equals ownership. If a budgeting app requires your bank login and a cloud account before it will work, it is designed to hold a copy of your financial life. That can be fine. It should never be invisible. Below is the ownership definition I use, the bank-sync privilege framing, the Mint lesson, a household threat model, how optional Plus sync fits without becoming mandatory, and a checklist you can apply to any vendor before you paste a password.

What “owning your data” actually means

Ownership is not a button buried in settings. Ownership is: the canonical ledger lives where you choose; you can use the product offline; leaving the vendor does not strand five years of history in a proprietary silo; sync is opt-in rather than the front door.

Cloud-first finance apps optimize for engagement and recovery across devices. The trade is continuous third-party custody of transaction history — aggregators included. Breaches, policy changes, and shutdowns are part of that trade’s risk register. Remember Mint. Convenience products can disappear; your need for a ledger does not.

An export button is a courtesy. A local canonical copy is a power structure.

The Mint lesson (and why it still matters)

When Mint shut down, millions of people discovered that convenience products can vanish on a corporate calendar. Budgets are not social feeds. They are multi-year memory.

You do not need to become a survivalist about every SaaS tool. You do need a higher bar for the system of record for money. Prefer tools that keep a canonical copy you can hold, export, and reopen without begging a sunset FAQ.

Bank sync is a privilege you grant — not a feature you owe the vendor

Open banking and aggregators make magical dashboards. They also create standing access to accounts, failure modes when credentials expire, and a data exhaust you cannot fully map. Wanting a budget without that access is a product preference, not a conspiracy theory.

Viridel will not add bank login. Manual entry is the capture path. That keeps the threat model small and the method loud. You should feel the trade-off: less automation, more custody.

A practical threat model for household finance

Threats worth naming: vendor breach, aggregator breach, phishing against bank-link emails, quiet policy changes, account lockouts, and product shutdowns. Also: a shared laptop, a curious roommate, a stolen phone without a passcode.

Local-first does not magically solve device theft — use OS encryption and screen locks. It does shrink the number of companies holding a continuous map of your merchants, payday, and debt. Optional Plus sync reintroduces a vendor on purpose, with authentication and row-level security — a conscious trade, not a default.

Local-first with optional Plus sync

Viridel stores budgets, accounts, and transactions on your device by default. Viridel Plus sync is authenticated and optional. Merges are record-level with tombstones — not a silent whole-file overwrite — so two devices do not casually destroy each other’s edits.

Sign-in unlocks sync and purchases. It does not convert your money history into a mandatory cloud product. That sentence is the product.

A checklist before you paste a bank password into a budgeting app

Where is the canonical copy — your device or their servers? Does budgeting work offline? Is bank sync required for core features? Can you export everything in portable formats? What happens if the company pivots, raises prices, or dies?

If the answers are vague, you already know the power balance. Premium software can still be cloud-first. It just should say so without euphemism.

Premium does not require custody

There is a marketing habit that equates polish with cloud custody. Stripe-level craft can live on a local-first product. Linear-level sharpness can live in an offline register. Premium is attention to detail, honest pricing, and respect for the user’s agency — not a requirement that your ledger rent space on someone else’s laptop farm.

Viridel’s bet is that private finance can look and feel expensive while remaining device-first. Free web and €39 Lifetime are part of that bet. If the industry trains you to believe ownership is a hobbyist compromise, ignore the training.

Exports, portability, and the five-year test

Ask any finance app to show you a portable export before you invest a year of habits. CSV that opens in a spreadsheet is a minimum. Better is a structure you can re-import elsewhere without archaeology.

Then apply the five-year test: if this company doubles prices, ships a worse privacy policy, or shuts down, can you continue budgeting next Monday? Local-first with optional sync is one answer. Self-host open source is another. Sync-first SaaS can still pass if exports are excellent and you keep offline backups — but many do not make that easy, because lock-in is a business model.

Viridel’s stance is blunt: device-first by default, Plus if you want sync, no bank login ever. That is the five-year posture we are willing to defend in public.

How to talk about privacy without sounding paranoid

You do not need to believe every vendor is malicious. Incentives are enough. Aggregators monetize access and reliability contracts. Cloud apps monetize retention. Those incentives can produce good products. They also produce standing copies of sensitive graphs.

Wanting a smaller blast radius is ordinary risk management — the same instinct that uses a password manager and avoids SMS codes. Framing privacy as niche activism is how the industry shames careful people into bad defaults.