What is stored, and who can read it.

The app

Your CSV never leaves your device. The file is opened by your own browser, on the machine you opened it on, and it is never uploaded.

Everything Berm keeps is encrypted before it is written down, on your device, with a key that never leaves your devices — or, if you share a budget, the devices of the people you share it with. There is no unencrypted mode and no setting that turns this off.

Setting up Berm means creating an account, and an encrypted copy is kept on the server from then on. What gets sent is the same encrypted file already on your disk. Signing in says which stored copy is yours; it does not make it readable. If that database were stolen outright, what the thief would have is scrambled data and the times it was saved — and, if you switched notifications on, the days they are due.

An account made with an email address proves the address first. We send a six-digit code to it, and the account exists only once the code comes back — so nothing is ever imported under an address nobody has proved. The address is kept, because it is what you sign in with. The code is sent by Cloudflare, the company that already runs Berm's servers, so nobody new ever sees your address. One password signs you in and encrypts your budget, and it never leaves your device: the server is sent a key made from it there, and keeps only a scrambled form of that.

You can delete your account, and everything in it, from inside the app. It waits thirty days first, so that one mis-press — or somebody who gets at a device you are signed in on — cannot destroy years of records in a single action. Signing in again inside that window cancels it. After it, the rows are deleted. Because nothing here can read any of it, there is nothing to redact or argue about: the rows go.

You can share a budget with somebody — a partner, say — and each of you keeps your own sign-in and your own password. You send them a link; they sign in as themselves and choose a password of their own for it, and either of you can change anything in it, and see which of you added what. The key that opens the budget travels inside that link, sealed, in the part of an address a browser never sends to any server, so the server can let them in and still cannot read a thing. What it does learn is who shares a budget with whom, and since when. Treat the link like a key: it works once, for a week, and whoever has it can join, so send it to them alone.

Or you can each keep your own budget and plan together in a household: goals you each save a share of, the bills one of you pays for both, and what is owed between you. The household is locked with a key of its own, which travels in its invite link the same way, so the other person sees only what either of you puts in it and nothing else of your budget, and the server learns that the two of you plan together and can read none of it. When one of you pays the other back — by PayPal, Venmo or Apple Cash, say — and the payment is already in your own records, your app notices it there and asks; nothing from your records goes into the household until you say it was one.

Or, with a joint account as well as your own, you can keep a joint budget beside your own budget. It is shared the same way and has a password of its own. On your device and on the server it is kept apart from your own budget, and neither can see into the other. The server learns who shares a joint budget with whom, as it does for any shared budget.

Whoever you plan with can hear when your import finds something wrong — the balance going under, an envelope over, a paycheck missing from the file — if you both switch it on: you to tell, them to hear. It is sealed on your device for theirs and sent at once, so the server learns that one of you told the other, and when, and cannot read what. Somebody you keep a household with hears this way about your own budget, which is the only thing from it they ever see, and only while you leave it switched on.

Your good news goes the same way, on the same two switches: a goal within reach or sooner since your last import, a card paid off or paid down, a payment back recorded. Most of it rides with what an import finds. A card marked paid off, a balance a new statement says is down and a payment back recorded go the moment you press the button, so for those the server also learns when you pressed it, and still not what it said.

The app talks to Berm and nothing else. No analytics, no fonts, no tags, no trackers — and not merely because we choose not to: the app is locked to its own address, so there is nowhere else for anything to go.

Notifications are off until you switch them on, one kind at a time. Each one is sealed on your device, for your devices, before it leaves, so the server that sends it knows when it is due and not what it says. On the way it passes through your browser maker's push service — Apple's, Google's, Mozilla's or Microsoft's — which learns that a notification went to your device and when, and cannot read it either. What your lock screen shows of it is up to your phone's settings.

It is free while Berm is in pre-launch, and it costs you nothing else either. No advertising, nothing sold, and none of it funded by knowing things about you — it could not be, because there is nothing here to know.

Berm counts how it is used only if you ask it to, and then without you in the count. Off until you switch it on in Settings, on each device. Switched on, the device keeps a tally of what it does in Berm — how many times a day it opened the app, imported a file, pressed a pill, kept a plan, went to a card, and the like, from a fixed list of kinds — and once a day sends the days before as a number a kind, without your sign-in. The server adds each number to that day's total for everybody and keeps nothing else: no account, no device, no address, no figure, no name, and no date of anything in your budget. Nothing is counted in the sample. While there are few people using Berm, a day's totals are mostly one person's doing, so switching it on is saying you do not mind that.

What this costs you

Nobody holds a spare key, so a lost password cannot be recovered — not by us, not by anybody. There is no reset link for your data, because a reset link is proof that somebody else can get in. An account made with an email address can choose a new password for signing in, with a code sent to the address, but that only gets you in: the budget opens the first time after it with a passkey or your recovery code, and without either it stays shut. It also means whoever can read your email can sign in as you, though not open anything. So the app works at not letting you stand on one leg: it lets your password manager make the password and checks the manager kept it, enrols a passkey while you set up, writes an encrypted backup file whenever you ask, and tells you whenever there is only one way into your data.

For the same reason, clearing your browser data deletes it. With cloud save off and no backup file, the copy in your browser is the only copy. On iPhone and iPad a tab you have not opened for seven days is cleared by the system — which is why Berm asks to be added to your home screen, since an installed app is exempt and keeps its own storage.

Removing somebody from a shared budget cannot take back what they have seen. They stop reaching it from their next request and their ways in are taken out, but whatever their devices already hold stays there. Only the person who shared it can remove people or delete it. The same goes for a household: whoever leaves one keeps what they saw in it, and ending it deletes it for both of you, what was owed included.

This website

The page you are reading collects nothing: no analytics, no cookies, no tracking, no embedded fonts, nothing from anybody else. It runs no code in your browser at all, which is less a boast than the simplest way to be sure of it.

Berm keeps a few days of logs, so we can fix what breaks: a short line for each request the app makes to our servers — what was asked for, whether it worked and how long it took — and a line for each error the app hits on your device. None of them says who: no account, no email address, no IP address, no name and no figure, and an error is reported without your sign-in. This site's pages are not logged at all, so nothing records who read which page or what anybody searched for.

What the support form keeps

Your message, which of the four kinds you picked, a contact detail if you chose to leave one, the time, and one note of whether you came from a link inside the app — with, if you arrived after something failed and left its box ticked, the reference the app gave that failure, so we can find its line in the logs. That is the whole row. Not your IP address, not a fingerprint, not a cookie, not which pages you read first — leave the contact field empty and nothing stored says who you are.

It is read by us and nobody else. It is not encrypted the way the app's data is, and it could not be: a message nobody can read is not a support request. So keep your own figures out of it — describe what went wrong rather than what you earn. If you email instead, that reaches the same people, but it arrives with your address on it, which is how email works rather than a choice anyone made here.

An email to support@berm.money is kept the same way, beside the form's messages, with what an email brings: your address, the name your mail program sends, the subject, and the names and sizes of anything attached. The attachments themselves are not kept, so if we need one we will ask for it another way. A copy still reaches the inbox we read support in, as every email to that address always has.

When we write back, it is from support@berm.money and it is plain text: no tracking pixel, and no link rewritten to count what you click. What we write is kept with what you sent, so a conversation reads in one place, and it is sent by Cloudflare, the company that already runs Berm's servers. Ask us and we will delete a conversation for good, what you sent included.

When a message looks urgent, such as somebody locked out or a charge they do not recognise, we are emailed to say so. That email gives the conversation's number, how it arrived and a link to where we read it, and nothing else: not what you wrote, and not who you are. On its way, the number waits in a queue at Cloudflare, and a number is all that queue is ever given.

Asking for your bank on the banks page keeps the same kind of row with less in it: the bank's name, a country if you gave one, and the time. Nothing about who asked.

The honest limit

Worth saying plainly, because encrypted is routinely asked to carry more than it can. Berm's own server sends your browser the code that does the encrypting. So the encryption protects you against a stolen database, a stolen backup, a court order and a curious employee — but not against Berm itself being taken over or turning hostile, because whoever controls what your browser is sent could change it. That is a real and useful guarantee, and it is narrower than we cannot read your data sounds. We would rather say so than let the sentence do work it cannot.

Your bank

Berm does not connect to your bank. There is no bank login, and nothing is fetched from your accounts: what Berm knows is the file you choose to give it. If a bank connection is offered one day, it will be an option you switch on, and anything read through it is encrypted on your device like everything else. One thing would be different: Berm's server would keep the pass that Plaid, the company making the connection, issues for reading your account. It would be locked with a key only the server holds, so that the connection can always be cut off, even after a lost password. That pass would be the one thing on Berm's server that could be used, by somebody who took over the server itself, to read a connected account until you disconnect. Plaid would also tell Berm's server when your bank has something new, or wants you to sign in again, and the server would note that there is news — never what — until your device reads it. So it would know roughly when your account changes. Berm is a budgeting tool — not a bank, it holds no deposits, and none of this is financial advice.

An AI assistant, if you connect one

Berm can let an AI assistant — Claude, or another one you use — add what your bank shows: transactions, the pending ones a bank's export leaves out, the balance, and the file your bank exports. It is off until you connect one, in Settings, and you can remove it there at any time. A connected app can add to your budget. It cannot read it.

Berm's program for assistants seals what it sends on your computer. It runs there, beside the assistant, and seals what it sends with a key only your budget holds before it leaves, so Berm's server keeps it without ever being able to read it. It reads your bank's file itself, so the file need not pass through your conversation with the assistant: the assistant passes it the file's name, and is told how many lines went, never what they say. Berm tells the assistant not to open the file, though one that can read files on your computer is able to.

What a connector on the web sends passes through Berm's server readable. Claude on the web or on your phone cannot run anything on your device, so what it sends arrives over an encrypted connection and is sealed the moment it arrives, with a key only your budget holds. From then on it is kept only sealed, until your budget next opens and takes it in, and then it is deleted. Nothing from it is kept readable or written to a log. That is a promise about what the server does with it, rather than a lock it cannot open, and it is the one part of Berm where that is so. It happens only for what you choose to send this way, it takes no files, and the rest of your budget never goes near it.

The server learns which keys and apps are connected and the name each is listed by, and when each sends something and roughly how much. What you show an assistant is covered by its maker's privacy policy — Anthropic's, for Claude — not this one.