Orangenoise Finance privacy

Sign-in and workspace access

Google sign-in supplies your email address and a stable Google account identifier (sub). The app uses them to verify your Google Workspace domain, identify your account and authorize access to your workspace. Session cookies keep you signed in for at most 12 hours. After 13 minutes of inactivity the app warns you; at 15 minutes it signs you out and hides the register. Background updates do not count as activity. Google manages its own sign-in and consent screens.

Your workspace can contain account details, balances, transactions, categories, notes, schedules and reconciliation records that you enter or import. These records are stored in AWS. Access controls separate users’ workspaces; the app operator has administrative access to stored records for operating and supporting the service.

App color, light/dark preferences, register layout, account order, sidebar layout, and chart height are saved with your account in AWS. Browser copies display your last settings while sign-in loads the saved account preferences.

Unfinished edits

Unsaved edits can be encrypted in this tab’s session storage so you can resume after signing back in with the same Google identity. The encryption key stays in browser memory while signed in; a separate, identity-scoped copy in AWS expires after 24 hours. Financial draft contents are not uploaded. Drafts use temporary tab storage, are limited by the 24-hour key expiry and are not backups. Recovery does not automatically save transactions.

Bank transaction downloads

Where a bank connection is configured, Plaid provides account and transaction information. Bank downloads are read-only and start when you choose to sync bank transactions. Entries, schedules and transfers recorded in the register are bookkeeping records: the app does not initiate electronic payments or move money.

Bank access credentials are kept separately from financial records and are excluded from portable financial backup archives.

Merchant assistance

Merchant memory uses your reviewed transactions and corrections to suggest payee names and categories. It is part of your finance workspace. The ChatGPT connection shown in Settings is not yet enabled: the hosted app does not send financial records to OpenAI or use a ChatGPT subscription. A separate local demonstration uses invented data and simulated authorization only.

Downloads and backups

Choose Download CSV in Settings to export your workspace’s accounts, transactions, split allocations, bank downloads awaiting review and recurring schedule definitions. CSV files are unencrypted. Save them somewhere private. Different record types are labeled; schedule definitions and split allocations are not additional payments.

CSV is a financial export, not a full app restore file. The owner can also download a full encrypted archive using the configured recovery key. Exports are manual; the app does not connect to Google Drive or upload backups there. Previously created Drive files remain in your account.

Encryption and recovery material

Portable archives are encrypted using the configured public recovery key. The hosted app does not request, receive or upload your private recovery key or recovery passphrase. Keep the matching recovery-key file and its passphrase separately protected; both are needed to restore an archive.

Workspace access controls and backup encryption serve different purposes. The running app processes financial records to display the register, calculate balances and create backups; portable archive encryption does not remove the operator’s administrative access to the live service.

Retention and removal

Portable backup retention keeps up to 30 daily and 12 monthly recovery points. Archives are created only when you request a full backup. Separate AWS recovery history can also retain up to 10 points from before significant changes.

Changing or removing a live financial record does not immediately remove it from previous backups. Earlier copies can retain those records until their retention period ends or the copies are manually removed. Signing out or losing workspace access does not erase saved records or backups.