Why Your Net Worth Data Should Never Touch a Server

---

title: "Why Your Net Worth Data Should Never Touch a Server" description: "Bank-linked trackers ask you to hand over read access to your entire financial life. A local-first net worth tracker keeps that data in your browser instead." date: "2026-11-10" tags: ["privacy", "local-first", "net-worth"]

Every few weeks another fintech app announces a data breach. Credentials leaked. Account numbers exposed. "We take your privacy seriously," the apology begins. If you track your net worth with a mainstream app, that apology is about your balance sheet.

There is an alternative that most people have never considered: a local-first net worth tracker that stores everything in your browser and uploads nothing. This article explains why server-side financial data is a structural risk — not just bad luck — and what local-first actually means in practice.

What happens to your data in a bank-linked tracker

Apps that sync with your bank accounts follow the same pattern. You enter your bank credentials, a third-party aggregator such as Plaid logs into your accounts on your behalf, and your transactions flow to the vendor's servers. Your balances, spending habits, and account numbers then live in a database you do not control.

Three things follow from that architecture:

1. The breach surface is central. One database holds the financial profiles of millions of users. For an attacker, it is a single, high-value target.
2. The data outlives your subscription. Retention policies vary, and "delete my data" requests are notoriously unreliable in practice.
3. You cannot audit it. No matter what a privacy policy says, you cannot verify that your data was never copied, shared with a "partner," or used to train a model.

What local-first actually means

"Local-first" is not a marketing synonym for "we store less." It is a specific architectural claim: the primary copy of your data lives on your device, and every meaningful feature works without a server round-trip.

For a net worth tracker that means:

• Your assets, liabilities, and subscriptions are written to IndexedDB, the database built into every modern browser.
• The vault is encrypted before it is written, using a key derived from your master password. The app vendor physically cannot read it.
• The only server involved is an identity gate — for example, a Google sign-in that controls access to the app but never sees a single number from your balance sheet.

If the vendor's servers disappeared tomorrow, your data would not notice. That is the test.

"But my data is boring — who cares?"

This is the most common objection, and it misunderstands how financial data is actually exploited. A net worth snapshot is not boring; it is a targeting dossier:

• It tells an attacker exactly how much you can afford to lose — useful for tuning scams and phishing lures.
• It reveals where you hold assets, which brokerage, which bank, and roughly what crypto you own.
• Subscription lists expose which services you pay for, enabling convincing fake renewal invoices.

Boring data does not get sold to advertisers. Rich data does.

The honest trade-offs

Local-first is not free. You give things up, and pretending otherwise would be dishonest:

• No automatic bank sync. You update balances yourself — for most people a five-minute weekly habit, and arguably a feature: manual entry is how you actually notice a subscription creep.
• You are responsible for backups. Your data lives in your browser profile, so you export the encrypted vault and store a copy somewhere safe. Self-custody means custody.
• A forgotten master password is unrecoverable. The encryption key is derived from your password and never leaves your device. No vendor can reset it — which is precisely why no vendor can read your data.

If those trade-offs sound acceptable, the privacy gain is enormous: your financial profile goes from "stored indefinitely on servers you do not control" to "never uploaded at all."

How to evaluate a local-first claim

Not every app that says "private" is local-first. When you evaluate one, ask four questions:

1. Where is the primary data store? The honest answer is "the browser's IndexedDB," not "the cloud, encrypted."
2. Is encryption client-side with a key the vendor cannot compute? Look for AES-GCM with a key derived from your password via a KDF such as PBKDF2 — and expect the vendor to explain it plainly. We describe ours in how your net worth gets encrypted in your browser.
3. What does the network tab show? After sign-in, a local-first app should make no requests carrying your data. Open dev tools and watch.
4. Can you leave? Export must produce a file you can decrypt and import elsewhere, not a proprietary blob that only the vendor's server can unpack.

The bottom line

Server-side finance apps ask you to trade permanent, centralized copies of your financial life for the convenience of automatic sync. That trade made sense in 2010. In a world of routine breaches, credential-stuffing, and AI-driven scraping, a net worth tracker that keeps your data in your browser — encrypted with a key that never leaves your device — is simply the lower-risk design.

LocalVault is built exactly that way: AES-GCM encryption in your browser, storage in IndexedDB, and a zero-upload guarantee you can verify in the network tab. If that sounds like the trade you want, look at how it works or start with the free tier — your data stays on your machine either way.