> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ai2fin.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Run AI2Fin on your own machine — where your data lives

> How the AI2Fin desktop app stores your records locally: the exact folder, the SQLite database, encrypted receipts, backups, and how to verify for yourself that nothing leaves your machine.

## Your records are files in a folder you own

The desktop app is not a browser pointed at our servers. It runs a small server
on your own machine, bound to loopback so nothing on your network can reach it,
and keeps everything in one folder you can open, copy, back up and inspect.

There is **no account on the free plan.** Nothing to create, nothing to verify,
no password to forget. You install it and it works.

<Card title="Where the folder is" icon="folder">
  Open the app and click the device chip in the header → **Open the folder**. It
  shows the real path and opens your file manager there.
</Card>

## What is in it

```
FinData/
├─ fin.db                  SQLite — every transaction, category, bill, rule
├─ attachments/            Receipts, stored by content hash
├─ secrets/
│  ├─ server.bin           This device's keys, sealed by your OS keychain
│  └─ app/                 Provider keys you have added
├─ clock.mark              Tamper-evident time marker (see below)
└─ backups/                Encrypted archives you create
```

`fin.db` is an ordinary SQLite database. You can open it with any SQLite tool
and read your own data — we would rather you could than couldn't.

Sensitive fields inside it are encrypted at rest with a key generated on this
device and held in your operating system's keychain — Keychain on macOS, DPAPI
on Windows, libsecret on Linux. AI2Fin never has a copy.

<Warning>
  Because the keys are in your OS keychain and nowhere else, **copying the folder
  to another machine will not work on its own.** Use a backup (below), which is
  encrypted with a passphrase you choose and is portable by design.
</Warning>

## Verifying it for yourself

The claim is only worth something if you can check it, so the app is built to be
checked.

<Steps>
  <Step title="Read the outbound record">
    Device chip → **What has left this device**. Every request AI2Fin has made,
    where it went, and why. Counts and destinations — never contents.
  </Step>

  <Step title="Turn things off">
    Each outbound connection has its own switch, and one switch stops them all.
    Everything on this device keeps working; features that need a connection say
    so plainly rather than failing oddly.
  </Step>

  <Step title="Watch the wire">
    Choose **Sovereign** and run a packet capture. The expected result is
    nothing. That is the intended reaction to this product, not an awkward one.
  </Step>
</Steps>

## Privacy postures

<CardGroup cols={3}>
  <Card title="Standard" icon="shield-check">
    Rows you ask about are processed and kept nowhere. Everything else stays
    here.
  </Card>

  <Card title="Your own key" icon="key">
    Intelligence requests go straight from your machine to your own provider on
    your own key. AI2Fin is not in that path.
  </Card>

  <Card title="Sovereign" icon="lock">
    Nothing leaves. The outbound record reads zero, and it is meant to be
    checked.
  </Card>
</CardGroup>

## Backups

Backups are a single encrypted archive: **scrypt** to derive a key from your
passphrase, **AES-256-GCM** to seal the contents.

<Steps>
  <Step title="Choose a real passphrase">
    Several unrelated words beats one clever word. The app scores it and will
    tell you when it is weak — the archive is only as good as this.
  </Step>

  <Step title="Keep it somewhere else">
    A backup on the same disk protects against mistakes, not against losing the
    disk.
  </Step>

  <Step title="Test restoring one">
    An untested backup is a hope. Restore into a spare folder once and confirm
    your transactions are there.
  </Step>
</Steps>

<Warning>
  Lose the passphrase and the archive is unreadable. AI2Fin cannot recover it —
  not as a policy, but because there is nothing to recover it with. That is the
  same property that makes the backup safe to store anywhere.
</Warning>

## Offline, and time

Everything on the free plan works offline forever. Paid features keep working
offline for as long as the subscription is actually paid, because the entitlement
carries its own expiry rather than checking in.

`clock.mark` is how that survives contact with a wrong clock. Entitlement
decisions use the latest time AI2Fin can *prove* has passed — a marker on disk,
the licence's signed issue date, and the newest timestamp in your own records.

Setting your clock back therefore buys nothing. If your clock is simply wrong —
a dead battery, a restored snapshot, a long flight — offline grace pauses until
the next connection and then resumes. **It never touches your data.** Whatever
happens to a licence, your records stay readable and export keeps working.

## If a plan lapses

The app returns to the free plan and keeps running. Your data stays readable,
export keeps working, nothing is deleted or held back.

Withholding someone's own financial records is not a mechanism we will use, in
any circumstance — including a licence dispute. It is written into the licence
so it is not merely a promise.

## Frequently asked

<AccordionGroup>
  <Accordion title="Can I move my data to another computer?">
    Yes — make a backup and restore it there. Copying the folder alone will not
    work, because the encryption keys live in the first machine's OS keychain.
  </Accordion>

  <Accordion title="Is the database really just SQLite?">
    Yes. Open `fin.db` with any SQLite browser. Some columns are encrypted, but
    the structure and most fields are plainly readable, deliberately.
  </Accordion>

  <Accordion title="What does the app send when I do nothing?">
    On the free plan with Sovereign off: a licence check and, if you have opted
    into telemetry, error reports. Both appear in the outbound record. On
    Sovereign: nothing at all.
  </Accordion>

  <Accordion title="Do I need an account?">
    Not for the free plan. Paid features need one, because a subscription has to
    belong to somebody — you link it through your browser, and card details
    never touch the app.
  </Accordion>

  <Accordion title="What happens if I delete the folder?">
    Your data is gone. There is no copy anywhere else — that is the whole
    premise. Keep a backup.
  </Accordion>
</AccordionGroup>