Comment by devinsit | Hacker News Reader

Comment by devinsit | Hacker News Reader

Hey HN! I'm excited to (officially) show off the project I've been working on (for far too long): uFincs, a privacy-first personal finance app! https://ufincs.com

Yes, it's another personal finance app. Yes, there sure are a lot of them. But when I got tired of using GnuCash a couple years ago, I figured I should try something a little different and throw my hat in the ring.

The result? No banks, no budgets, no data collecting. Just a clean UI, a privacy-first attitude, and good old double-entry accounting.

The main thing that makes us so 'privacy-first' is the fact that we do client-side encryption: all of the financial data that you enter is encrypted before it leaves your browser and hits our servers. That way, you maintain sole ownership of your data. Want more of the juicy technical details? Check out our security overview: https://ufincs.com/policies/security

If you want to skip past all of the marketing fluff, feel free to drop into using the app right away: https://ufincs.com/noaccount. Since uFincs is offline-first and a PWA, we can offer the ability to use the app completely without an account, for free! Of course, if you want to easily access your data on all your devices, that's where a paid account comes in handy :)

And if you're getting some mad déjà vu from all this, it's because I commented about uFincs a couple weeks ago: https://news.ycombinator.com/item?id=26970716

Finally, since I know some people were hesitant about the pricing, I decided to throw together a special coupon just for you guys: "HN15". It's 15% off, forever, on any of the plans, for the first 100 new sign-ups.

If you have any questions, feel free to check out out the FAQ (https://ufincs.com/faq), but I'll be here all day to respond to any comments!

Privacy-first finance app should really have a self-hosted option front and center. That's not even negotiable.

That's because otherwise the privacy property of the app hinges on a trust in vendor and the assumption that they won't serve some funny JS on the next page reload. The one and only way to address this is to provide a self-hosted, completely self-contained version. There's really no way around this. It's not a matter of encrypting things or storing them locally, it's a matter of divorcing yourself as a developer from users' data. Right now, it's a packaged deal.

PS. Looks very nice though. Clearly lots of thought went into the design and UX elements. This part is really well done!

Yep, I agree. If you want perfect security and a 100% trust-less solution, then uFincs certainly isn't it.

But I like to think that, at least when put in contrast with other products on the market, choosing to do these privacy/security related things is better than not.

I elaborate on this further in our security doc (https://ufincs.com/policies/security#the-catch) and the FAQ (https://ufincs.com/faq#is-a-ufincs-a-trustless-system).

Well, the thing is that if you say "privacy-first", you are pitching to people who care about this sort of thing. For these people the fact that uFincs is not self-hosted is an instant no-go. And for people who don't see it as a problem, the privacy angle doesn't matter much either. See the disconnect? You have a good product, for sure, but the pitch needs a revision.

Oh I'm well aware of the disconnect. I just disagree that there are only people who care about privacy to the degree that they have to self-host everything. I believe there's room to ride the line between being 'privacy-first' (in that we care about privacy, first and foremost) and offering convenience (i.e. providing a web app).

I'm sure my customers who signed up with ProtonMail and Fastmail addresses can attest to that fact.

And for those who do fall all the way to the self-hosting side, well, there's plenty of other options on the market! Of course, there's nothing stopping us from being one of those options, it's just not our priority at this very moment.

Why not team up with the ProtonMail people to build a browser extension that verifies and logs javascript sigs/hashes? Corporate clients may like it. Gives them an IOC for the next big supply chain issue.

I don't know enough about browsers or js to know if its difficult or not.

Thing is anyone even passingly interested in privacy will start questioning it - is it open-source? Can it be self-hosted? Is it available as a desktop app? It's privacy theatre unless the privacy can be proven.

https://github.com/awesome-selfhosted/awesome-selfhosted#mon.... A bunch of self hosted alternatives, some of them with nice UI as well.

Firefly III (https://www.firefly-iii.org/) in particular is a pretty good self-hosted solution.

Ah, I really like how clean the UI feels and also the e2ee. I'd love if this also could have a mobile app, as I then could document transactions on the go more easily.

Any plans for a mobile app?

Thanks for the feedback on the UI! Definitely put some time into trying to get that right.

And yep, we have plans for dedicated mobile/desktop apps for sometime this year. Android will almost certainly come before iOS though.

Others have already mentioned how it's a non-starter if there isn't an option to self-host so I won't bring that up: instead, for those who don't mind that I'd suggest easier means to import data from existing formats. Offer an on-ramp for people who too are fed up of GnuCash or have been using Ledger up until now and could use something friendlier. Best of luck in your project!

Any plans for Plaid/etc integration for transaction syncing?

Absolutely none at all! uFincs is all about manual entry (although CSV import + recurring transactions makes things a bit easier).

I made a deliberate choice to not support any bank integrations for privacy reasons (although simplicity is also a big factor).

privacy in what sense? the bank owns your data already, if you don't store any user data in the cloud, then is private by design, right? I was looking for something like this, but I do need auto import my transaction data, across all banks and brokers, etc. Offline first and only, ala Personal Capital, but secure and safe. Paying 20 bucks a month for the privilege of manual data entry is a bit much. There is a bunch of open source alternatives(GNU Cash, etc...), that let you manually enter your data. That said, this is my particular use case. I do wish you the best, and the app does look pretty.

Privacy in the sense that, while the bank may own your data already, third-parties like Plaid do not. And at least up in here Canada, we're a bit weaker on the whole 'bank API' system, so it generally turns into a wonderful game of "hand over your bank account credentials".

Anyways, I definitely understand where you're coming from. Plenty of other products that do have bank integrations though, so at least of there's lots of options for you!

And thanks for the design feedback :)

Plaid is own by Visa, but I get your point. As I said, wish you the best!

The deal did not go through. Plaid just got valued at close to triple what Visa was going to spend on it in a recent fund raise at around $14B post money.

Not having integrations is a deal breaker for me. All of my financial information lives in other systems that I need to be able to import it into a single view that I can manage. There is no way I'm going back and manually entering all of that info. A privacy centric solution would store credentials for systems like plaid, bank accounts, etc. in the client on the OS keychain and open source that part of the code to be audited. The data then would be stored preferably on a self-hosted server or your cloud provider of choice. There is some sweet spot here at the intersection of the personal cloud server movement and local client credential storage that none of the current finance apps have yet addressed. Once someone does I think they may have a real hit on their hands.

I totally understand that. And I knew, when making the decision to not do any integrations, that there's a ton of people just like you that value automating everything as much as possible.

But I also made the bet that there would be people just like me who value entering things manually. Certainly far fewer people, but hopefully still people.

In any case, I also hope that the app you described eventually gets built; certainly never hurts to have more privacy-friendly options available!

Reply on news.ycombinator.com