Privacy policy
The short version: Shoshita collects nothing, sends nothing, and stores everything on your own computer. This page is mostly a list of things we do not do.
What the app collects
Nothing. There is no analytics, no telemetry, no crash reporting, no usage tracking and no account to create. We do not know how many transactions you have, which banks you use, what you spend money on, or whether you opened the app today.
Your transactions, categories, rules, budgets and savings goals live in a folder you choose on your own machine, encrypted at rest with a key derived from your PIN. We cannot read that file. Neither can anyone who takes the laptop.
There is no “delete my data” request to make, because we never had it. Your data is a folder on your disk. Delete the folder and it is gone.
When Shoshita uses the network
Shoshita makes an outbound request only when you press Activate, and at no other time. That request goes to Polar, our licensing provider, to confirm your key is valid, and the result is recorded locally. If activation fails — a mistyped key, or no connection — pressing Activate again is another request; nothing else in the app ever makes one.
Four things are sent, and this is all of them:
- the license key you typed;
- our organization identifier, which is public;
- a label, which is the word “Shoshita” followed by your computer’s hostname — the name Windows knows the machine by, so you can tell your activations apart;
- a device id, a random identifier generated on your machine the first time it is needed. It is not derived from your hardware.
After that the app never contacts the network again. Not on launch, not on a schedule, not to re-check your license. It works with the network adapter switched off, permanently. If you ever see Shoshita make a network request when you are not activating, that is a bug — please report it.
No part of your financial data is included in that activation call, or in anything else. It never leaves your machine, because nothing in the app ever sends it anywhere.
Purchases
Purchases are handled by Polar, acting as the merchant of record. Polar collects what it needs to sell you a license — your email address, payment details and any tax information required for your country — under its own privacy policy. Payment details never pass through this site and we never see them.
What we can see is what Polar shows a seller: your email address, what you bought, and how many devices your key is activated on. We use it to provide support and nothing else. We do not sell it, share it, or add you to a mailing list you did not ask for.
This website
shoshita.ca sets no analytics and no tracking cookies. It is a static site served from Cloudflare, which processes standard server request logs for security and reliability. The installer is served from Cloudflare R2 storage, which likewise logs requests. We do not build profiles from any of this and it is not linked to your purchase.
If you email support@shoshita.ca, we keep the thread so we can follow up, and use it only to answer you.
Changes
If this policy changes, the date at the top changes with it. A change that meaningfully affects what the app sends will also appear in the release notes — the local-first promise is the product, not a setting, and we are not going to alter it quietly.