Zero cloud AI
The health score, the subscription detector, merchant intelligence, forecasting, categorisation: all of it is rule-based and computed on-device. No model file. No inference runtime. No API call.
Privacy
Not “encrypted in transit”. Not “anonymised”. It does not leave. The ledger is an ObjectBox database on your device, and the entire intelligence path makes exactly one request to the internet, for today’s exchange rates.
Stays on your device
Everything. Literally everything.
- Every transaction
- Every balance
- Every account
- SMS your bank sent you
- Categorisation
- Financial health score
- Subscription detection
- Merchant intelligence
- Forecasts
- Safe-to-Spend
- Budgets & goals
- Trips & people
- Notes & attachments
- Search history
Leaves your device
One request. This one.
GET
open.er-api.com/v6/latestA free, key-less exchange-rate feed. No API key. No account. No identifier. It sends nothing about you, and it gets back a list of numbers.
And that is the complete list.
- Transactions
- Balances
- Merchant names
- Bank credentials
- Your SMS inbox
- Notes
0
network call in the entire intelligence path
0
financial fields our backend will accept
0-bit
AES-GCM on every backup container
0-day
Trash, because nothing is recoverable from a server
No bank login. Ever.
No Plaid. No aggregator. No screen-scraping. No credentials for us to lose, because we never ask for them. WealthWise reads the SMS your bank already sent you.
A backend that cannot hold your money
There is a Control Plane. It has no transactions table and no endpoint that accepts one. It answers three questions: who is this person on a new device, did they actually pay, what should be turned on. Switch it off and the app still works.
Backups sealed with AES-256-GCM
The encrypted container is written to your own iCloud Drive or your own Google Drive folder. There is no server of ours in the middle. The key is random, per-device, and lives in the OS keychain.
Analytics on a strict allowlist
The allowlist is enforced server-side. An event carrying an amount, a merchant or a note is rejected with a 400, not quietly dropped. Crash stack traces are scrubbed of paths, amounts, emails and quoted literals before they are ever stored.
Locked, and always reversible
Face ID or fingerprint, an app-lock timeout, and a separate balance lock with a timeout of its own. Delete is soft everywhere and Trash holds for 30 days, because a local-only app has no server copy to fall back on.
The app is fully usable with our backend switched off. That is not a fallback mode. It is the design.
Performance
Nothing in WealthWise is fetched, so nothing in WealthWise is loading. The heavy maths happens in a background isolate, the answer is cached against the ledger’s revision, and the controls you touch are the operating system’s own.
Press itPressableScale · live
- transform
- scale(1) → scale(0.97)
- duration
- 110 ms
- curve
- Curves.easeOut
- haptic
- selectionClick()
- chart replay
- 650 ms easeOutCubic
- ripple
InkWell splashglobally disabled
The scale is the feedback. There is nothing else: no splash, no highlight, no 300ms of ink crawling across the surface.
Native controls, not imitations.
An imitation is a thing that looks right in a screenshot and feels wrong in your hand. So where the platform ships a control, the app uses the platform’s control.
UITabBarThe system’s own tab bar: genuine Liquid Glass on iOS 26. Not a Flutter widget wearing its clothes.
CupertinoSliverRefreshControlPull down and the activity ticks scrub in one by one, exactly the way Mail does it. Same control, same feel.
UIContextMenuInteractionLong-press gives you the platform’s lift-and-blur preview, its haptics, its timing. Nothing reimplemented.
Dynamic Type · VoiceOverInherited from the OS rather than approximated. Crank the text size and the layout actually reflows.
Background isolate
The maths happens somewhere else.
Opening AI Insights on a four-thousand-transaction ledger does not stall a single frame. The aggregation is dispatched to an isolate and posts one message back when it’s done. Refreshing does the same thing. The thread that draws your screen is never asked to do arithmetic.
01instant
First open
The insights bundle is persisted to the database, so even the first open after an app restart paints instantly.
020 ms
Every revisit
Results are keyed to the ledger revision. Same revision, same answer. Nothing is recomputed to tell you what it already knows.
03isolate
A transaction changes
The revision bumps. Only now does the aggregation re-run, and it re-runs off the UI thread.
There is no “you’re offline” mode.
Not a stripped-down one, not a read-only one. Every feature works with the radio off, because there was never an online mode for it to degrade from. Aeroplane, basement, dead SIM: same app.
0.00
press scale
0ms
press duration
0ms
chart intro, easeOutCubic
0
haptic call sites, one toggle