Skip to content
Sign in

Legal

Security

Last updated: 28 October 2026 · version 2026-10-28

How HomesWallet protects data: end-to-end encryption, keys only with you, sign-in without passwords, confirmation of important actions and protected servers.

Every account has its own keys created on the device; the household has a shared key that the owner shares with each member after they compare their safety codes. Records and files are encrypted with AES-256-GCM on the device before they are sent. The household key is changed when a member is removed or ownership is transferred.

IMPORTANT: YOUR DATA IS ENCRYPTED WITH KEYS THAT ONLY YOU HOLD. IF YOU LOSE EVERY WAY TO UNLOCK YOUR KEYS — THE 12 RECOVERY WORDS, FACE OR FINGERPRINT SIGN-IN (PASSKEY), YOUR REMEMBERED DEVICES AND THE APP PIN — NOBODY CAN RECOVER YOUR DATA: NOT YOU, NOT US, NOT ANYONE ELSE. ACCESS TO YOUR E-MAIL IS NOT ENOUGH. KEEP THE 12 WORDS IN A SAFE PLACE.

There are no passwords: you sign in with a one-time code by e-mail or with face or fingerprint (passkey). For important actions — inviting, removing a member, transferring ownership, deleting an account, downloading all data — the app asks for your key and your face, fingerprint, PIN or the 12 words, and the server checks the signature. A sign-in from a new device sends you an e-mail; in Settings → Devices you can sign out or erase the data on another device.

Connections are HTTPS only. The servers are protected by Cloudflare's network; the admin panel is reachable only through Cloudflare Access, with separate administrator accounts using a password and two-factor confirmation, and it does not show the households' content. Database backups are encrypted with a key that is not on the server. The code that receives the bill e-mails is checked daily for changes.

Found a vulnerability? Write to legal@homeswallet.com with a description and the steps. Please do not access other people's data and give us reasonable time to fix it before disclosing it.