What is stored, what is not, and how to take it all back. Written from the code rather than from a template, so every sentence here can be checked against a file.
2026-09-16
4 Envelopes is a personal budgeting service: four weekly envelopes, accounts in several currencies, planned and one-off payments, goals. It is run by the person who wrote it, and the address for anything on this page — a question, a correction, a request to delete something — is info@4envelopes.app.
There is no other way to reach us and no other address that matters. A reply comes from a person, not a queue.
Your email address, the name you gave (or the part of the address before the @, if you gave none), the language you read in, the currency you total in, and the order you like your lists in.
The money you enter yourself: accounts and their balances, payments and receipts, transfers, recurring rules, goals, and the notes you write on them. This is the whole point of the service and it is kept until you delete it.
A password is never stored. What is stored is a scrypt hash of it, which the password cannot be read back out of. Signing in with Google or Apple stores no password at all — we never see one. A signed-in session is a random token; the links sent by email are kept as SHA-256 hashes, so a copy of that table is a list of hashes rather than a set of working links.
A photographed receipt is read on the device. The photograph is never uploaded, never stored and never seen by us — only the recognised text is sent, and only so it can be turned into a draft payment you then confirm yourself.
A pasted bank message is read and forgotten in the same request. No column holds it, no log line carries it. A bank notice names a shop, a card and a balance, and none of that is ours to keep.
No analytics, no tracking, no advertising identifiers, no profiling. Not "anonymised" analytics — none at all.
No location, no contacts, no photo library, no device identifiers. The camera is used only when you point it at a receipt.
This site sets no cookies and makes no third-party request of any kind — no fonts, no scripts, no beacons. The app keeps your session token in the browser or on the phone, which is what keeps you signed in, and nothing else.
Everything is kept until you delete it. There is no automatic expiry, because a budget is worth more the longer it runs.
Deleting the account removes all of it in one step — accounts, payments, recurring rules, goals, settings, sessions and the subscription record — and it cannot be undone. It is in Settings, in the app and in the browser, and it works even when the trial has run out.
Two things survive deletion and are not ours to remove: the record Apple or Google holds of a purchase, and whatever your mail provider kept of messages we sent you. Cancel a subscription in the store — deleting the account here does not cancel it.
There is no data export yet. If you want a copy of your records before deleting, write to us and we will send one.
This page changes when the code does, and the date at the top is when it last did. There is no archive of earlier versions; the history is in the repository this site is built from.