How your data is protected
What is encrypted, what the server can see, and how you can check it yourself.
Last updated 2026-10-14
The one rule
Everything your household shares is encrypted on your phone before it leaves it. Our server stores sealed envelopes and passes them to the other phones of your household. Neither the server nor the people who run besteed can open them.
This is not a policy we could change one day. It is how the app is built: the keys never reach us, so there is nothing we could read, hand over or lose.
How it works, in plain words
When a household is created, the phone that creates it generates a keyring: one key for each area (calendar, lists, house records, money, contracts). Each phone in the household has its own pair of keys; the private half is created on the phone and kept in the system's secure store (Android Keystore, iOS Keychain). It never leaves.
To let another phone in, the keys it is entitled to are wrapped for that phone alone, using its public key. Someone without the key for an area cannot read that area, even with the envelopes in hand.
Money goes one step further: each movement is sealed with its own key, wrapped only for the people who may see that book. A personal book you open to your partner can be read by their phone and nobody else's.
Cloud backups are encrypted on the phone with a random key that your phone's system keeps for you (Google Block Store on Android, iCloud Keychain on iPhone). We never see that key.
What does leave in clear text, and when
Three things, and you trigger all of them: the sentence you jot down when the AI help is on and it is not clear; the description text of new bank movements when you import a statement (never the amounts, dates or account numbers); and a document you ask the app to read — a contract in PDF or photo, or a bank statement in PDF — which is sent whole.
They go through our server to Anthropic, which returns the answer. Our server does not store them; it keeps a cost counter. Anthropic processes them under its API terms and does not train its models on them. Without an account, or with the AI help off, nothing is sent.
What the server holds, item by item
| What | How it is stored | Why |
|---|---|---|
| Email, name, language, plan | In clear | To run your account and tell you apart from other users. |
| When you sign in and from which device | In clear | To keep your sessions and let you close them. |
| Household name and the name you show to it | In clear | So the phones can find each other. |
| Public key of each phone | In clear | Public by design: it locks, it does not open. |
| Notes, tasks, lists, house records, calendar | Sealed envelope | We cannot read them. |
| Money movements, bank accounts (last 4 digits), balances | Sealed envelope | We cannot read them. |
| Cloud backups | Sealed envelope | The key is kept by your phone's system, not by us. |
| Crash reports, if left on | Technical trace only | To fix failures. Nothing you wrote. |
| AI usage | Counters only | What it cost this month; never the text. |
| Photos, attached files, phone numbers, gift ideas | Not on the server | They never leave the phone. |
In a browser (app.besteed.com)
The same app runs in the browser at app.besteed.com, and the same rules apply. There, «your phone» means this browser, on this computer, in this profile: each browser you sign in from is one more device in the household, and it receives the household's keys from another device of yours, or from an adult in the home, just as a tablet would.
The device's private key is kept encrypted in the site's own storage, locked with a key the browser generates and never lets out (WebCrypto, non-extractable). The household's data lives in the site's storage as well. Nothing travels to the server in clear, exactly as on the phone.
Clearing the site's data is like uninstalling: that browser loses its identity and its local copy. When you sign in again, another of your devices, or an adult, hands it the keys and the household comes back down from the server. In a private or incognito window, everything goes when you close it.
How you can check
Inside the app, Settings → What the server sees fetches one of your real envelopes from the server and shows it to you exactly as it is stored there: unreadable bytes. Then it lists, item by item, what the server holds in clear text about you.
In Casa → Household, every member shows the fingerprint of their key. Read it to each other in person: if it matches, the key you hold is theirs and nobody is in the middle. The app remembers each key it has seen and warns you if the server ever hands out a different one.
If this page leaves a question open, write to support@besteed.com. We would rather explain than be trusted blindly.
What we cannot do
We cannot read your data to help you, and we cannot give it to anyone, because we do not have it. And if you lose every phone in your household and your backup key, we cannot get your data back for you either. That is the price of the rule, and we think it is the right one.