A finance app knows the most intimate thing about you: how much you have, how fast you spend it, and where. A lock icon on the login screen is not enough. Here is how to read the security of a budget app like an adult, and what Plan! does under the hood.

Three layers of biometric lock

"Face ID protection" means very different things depending on the app.

  • Layer 1 — UI lock only. Face ID gates the app's screen, but the database file inside the sandbox is unencrypted. A jailbroken or compromised device leaks it. Most free apps stop here.
  • Layer 2 — UI lock + file-level encryption at rest. Face ID gates the UI, and the database is encrypted with iOS Data Protection (class NSFileProtectionComplete). This is the correct baseline.
  • Layer 3 — UI lock + app-level encryption. In addition to iOS protection, the app encrypts sensitive fields with a key derived from the Secure Enclave. Even a forensic extraction shows gibberish.

Ask the developer which layer they implement. Plan! implements Layer 2 on every build, and Layer 3 for premium fields (account balances, note fields).

Local vs cloud: the real risk

Cloud sync is convenient and it is also the biggest attack surface in finance apps. Three questions to ask:

  1. Does the provider actually encrypt client-side (end-to-end), or does the server hold the keys? Most "encrypted" apps store keys on their server, which means an employee can read your data and a breach leaks everything.
  2. Does the app include your financial institution credentials (Plaid)? That is a far juicier target than your budget totals.
  3. Can you opt out of cloud entirely and stay local? If not, you have no privacy floor.

Plan! stores all primary data in a local SQLite database on your device. iCloud sync (optional) uses Apple's own end-to-end encrypted CloudKit and only carries non-credential data. There are no Plaid-style bank logins. Your risk surface is small.

What to avoid

Red flags in a finance app's security posture:

  • "Free with ads" apps that upload transaction data to third-party ad networks. Privacy policy search for "advertising partners".
  • Apps without a published privacy policy or data-retention schedule.
  • Apps that require an account before you can see the app (they want your email to monetize).
  • Apps storing your bank credentials "for your convenience". Mint worked this way. Look how that ended.

Plan!'s approach, in plain English

Plan! is a local-first iOS app. Your data lives in a SQLite database inside the app sandbox, protected by iOS Data Protection. Face ID locks the UI on every resume. iCloud sync, if enabled, goes through Apple's end-to-end encrypted CloudKit; the Plan! team has no key and no server you need to trust. There is no bank-credential aggregation. The privacy policy is one page of English.

The only finance app whose breach cannot leak your bank logins is one that does not store them. Plan! never asks for them.

Enabling Plan!'s Face ID lock

  1. Open Plan! → Settings → Security.
  2. Toggle "Require Face ID on open".
  3. Optionally set a fallback 4-digit PIN.
  4. Toggle "Hide amounts in widgets" if you share your lock screen with kids.
  5. You are done. Every app-open now costs a glance.

Checklist

  1. Check your current finance app's privacy policy for "advertising partners".
  2. Confirm it uses at least iOS NSFileProtectionComplete at rest.
  3. Enable Face ID in the app's security settings.
  4. If the app requires bank credentials, evaluate whether you actually need sync.
  5. Consider a local-first alternative like Plan!.

Your budget is not public. It should not be cheap to leak. Plan! is built to make sure it cannot be.