Security and trust

Here is how Left Unspent protects your data, in plain terms. Every claim on this page describes what the app does today, nothing more.

How your data is protected

• Encrypted in transit. All traffic is served over HTTPS, and both the app and its API are configured with HSTS, so your browser is instructed to connect over HTTPS only.
• Encrypted at rest. Your data lives in a managed Postgres database from our provider, Supabase, which encrypts data at rest. This is standard platform encryption, not a proprietary Left Unspent capability.
• Isolated per account. Every account's data is separated at the database level by row-level security, enforced by the database itself and not by application code alone. One account's data is never reachable by another.
• Hardened browser headers. The app sends a strict set of browser security headers, including clickjacking protection, content-type protection, a restrictive referrer policy, and a locked-down permissions policy.

The app is built on Supabase and Vercel, providers that maintain SOC 2 compliance. That compliance belongs to those vendors, not to Left Unspent.

What we collect and hold

The most important part is what we never touch.

• No bank logins, no card numbers. Left Unspent never sees or stores your bank login or your card number. You enter amounts yourself, so the app works from the numbers you type, not from your account credentials.
• Payment goes straight to Stripe. Purchases run through Stripe's hosted checkout, so your card details go to Stripe and never reach Left Unspent's servers.
• No password to steal. Signing in is passwordless: you use Google or a one-time code sent to your email. There is no password for Left Unspent to store or for anyone to steal.

Your control over your data

• Delete everything, for real. Deleting your account removes your profile and all of your financial data in a single cascading operation. Stripe billing records are kept only as required for tax and accounting.
• Protected sign in. Authentication requests are rate-limited to guard against automated abuse.

This page describes the Left Unspent app at app.leftunspent.com, where your financial data lives. This marketing site itself collects nothing beyond an email address, and only if you choose to give us one.

Questions about security or your data can be sent to support@leftunspent.com.