Your numbers, on your terms.

Guest mode: everything you enter — account names, balances, savings, settings — is stored in your browser's own database (IndexedDB) on your device. It is never uploaded or transmitted to us. Clear your browser storage or lose the device and the numbers go with it, so export a JSON backup now and then from Settings → Your data.

With an account: the same records are also saved to our database (hosted by Supabase) under your user id, encrypted at rest and in transit. Access is enforced by row-level security in the database itself: your login can read and write only rows tagged with your user id — that rule is checked by Postgres on every query, not by application code we might get wrong. Your device keeps a local copy too, so the app stays fast and pages you've already loaded keep working without a connection; edits made offline upload when you're back. (A cold start still needs the network once — there's no installable offline shell yet.)

Fuego never asks for bank credentials and never connects to a financial institution. You type your numbers in once a quarter. That's the ritual, and it's also the security model: there are no bank tokens to breach.

An account is your email, your display name, and — if you register with a password — a password hash managed by Supabase Auth. We never see or store the password itself. If you continue with Google, Google shares only your name and email address; we get no access to anything else in your Google account, and we never post or act as you.

We don't sell data, run ads, or share your information with anyone except the services that host the product (listed below).

We use Vercel Web Analytics, which is anonymous and cookie-less — no user IDs, no fingerprinting, no advertising trackers. Alongside page views we count a handful of product events (things like “a quarter was closed out” or “a PDF was exported”). These are counts only: they never include amounts, account names, or anything from your balance sheet.

One honest caveat: to tell “one person did this five times” from “five people did this once,” those product events carry a random install id stored in your browser. It isn't your user id, it's never joined to your account or your numbers, and clearing site data resets it — but it makes our event analytics pseudonymous rather than perfectly anonymous, and we'd rather say so than round it off.

When you create a read-only share link, your snapshot is encrypted in your browser before anything leaves it. Short links (fuego.money/s/…) store only that ciphertext on our server — the decryption key rides in the part of the link after the #, which browsers never send to any server, so neither Fuego nor our database host can read what a share contains. Long links skip the server entirely and carry the whole encrypted snapshot in the link itself.

Anyone who has the full link can decrypt it, so share it like the data it contains — and treat sending as permanent: a recipient who copied, bookmarked or forwarded either kind of link keeps what they have. Short links made while signed in are yours to manage in Settings → Your share links: name them, set an expiry, or revoke one and it dies instantly for everyone holding it. Short links made as a guest are anonymous, cannot be revoked, and expire on their own after 180 days.

If the Logbook fetches an instrument price, the request contains the ticker symbol only — never your quantities, balances, or identity.

Everything, instantly, yourself: Settings → Danger zone. Guests can reset the device copy; account holders can delete the account, which removes your login and every row of your data from the database — not a soft delete, a DELETE. Export a backup first if you want to keep your history.

Three services run Fuego, and each sees only what its job requires: Supabase (database + sign-in) stores your account and, if you have an account, your encrypted records. Vercel (hosting + anonymous analytics) serves the app. Price providers (Finnhub, CoinGecko, and similar) receive ticker symbols only.

This page is the whole policy — there is no longer version hiding somewhere. If something is unclear, write to the address on the creator card in the footer.