What is stored, what is not, and how to take it all back. Written from the code rather than from a template, so every sentence here can be checked against a file.
2026-10-12
4 Envelopes is a personal budgeting service: four weekly envelopes, accounts in several currencies, planned and one-off payments, goals. It is run by the person who wrote it, and the address for anything on this page — a question, a correction, a request to delete something — is info@4envelopes.app.
There is no other way to reach us and no other address that matters. A reply comes from a person, not a queue.
Your email address, the name you gave (or the part of the address before the @, if you gave none), the language you read in, the currency you total in, and the order you like your lists in.
The money you enter yourself: accounts and their balances, payments and receipts, transfers, planned payments, goals, and the notes you write on them. This is the whole point of the service and it is kept until you delete it.
A password is never stored. What is stored is a scrypt hash of it, which the password cannot be read back out of. Signing in with Google or Apple stores no password at all — we never see one. A signed-in session is a random token; the links sent by email are kept as SHA-256 hashes, so a copy of that table is a list of hashes rather than a set of working links.
A photographed receipt is read on the device. The photograph is never uploaded, never stored and never seen by us — only the recognised text is sent, and only so it can be turned into a draft payment you then confirm yourself.
A pasted bank message is read and forgotten in the same request. No column holds it, no log line carries it. A bank notice names a shop, a card and a balance, and none of that is ours to keep.
Speaking an expense is optional and happens only in the phone app, only after you press the microphone, and only while that window is open. Your phone’s own speech service turns what you say into text, and only that text is sent to us — to be read into a draft payment you then confirm yourself. The text is read and forgotten in the same request: no column holds it and no log line carries it. We never receive the audio.
Where the speech service does its work is the platform’s, not ours. On an iPhone, Apple’s recognition stays on the phone for the languages the iPhone can recognise on its own; for the others Apple processes the audio on its servers, under Apple’s privacy policy. On Android the system’s speech service — on nearly every phone Google’s — may process the audio on Google’s servers, under Google’s privacy policy.
To help it recognise them, the names of your accounts are given to the speech service on the iPhone along with the recording. Nothing else about your money is.
The bot is optional. Nothing reaches Telegram unless you connect it yourself, from Settings in the phone app.
Once it is connected, what you send the bot and what it answers — entries, balances, envelopes, recent payments — travels through Telegram’s servers and is covered by Telegram’s own privacy policy. It answers only in a private chat.
We store the chat’s number linked to your account, the account and currency you chose for entering, and — until you confirm, cancel or replace it — the amount, note and date read from your last line. The text of your messages is not stored. The one-time link that connects a chat is kept as a hash and lives fifteen minutes.
Disconnecting — /unlink in the chat, or the Telegram card in Settings — removes the link. Deleting the account removes it with everything else.
On our side, no analytics, no tracking, no advertising identifiers, no profiling. Not "anonymised" analytics — none at all. The only diagnostics that leave the phone are ML Kit’s, on Android, and they go to Google, not to us — see above.
No location, no contacts, no photo library, and no device identifier ever reaches us. The camera is used only when you point it at a receipt.
This site sets no cookies and makes no third-party request of any kind — no fonts, no scripts, no beacons. The app keeps your session token in the browser or on the phone, which is what keeps you signed in, and nothing else.
Everything is kept until you delete it. There is no automatic expiry, because a budget is worth more the longer it runs.
Deleting the account removes all of it in one step — accounts, payments, planned payments, goals, settings, sessions and the subscription record — and it cannot be undone. It is in Settings, in the app and in the browser, and it works even when the trial has run out.
Two things survive deletion and are not ours to remove: the record Apple or Google holds of a purchase, and whatever your mail provider kept of messages we sent you. Cancel a subscription in the store — deleting the account here does not cancel it.
There is no data export yet. If you want a copy of your records before deleting, write to us and we will send one.
This page changes when the code does, and the date at the top is when it last did. There is no archive of earlier versions; the history is in the repository this site is built from.