Privacy

Last updated: 10 September 2026

otherWise is a self-hosted ledger used by a small group of people. There is no company behind it, no business model, and no third party involved. What follows describes what actually happens on this server — it is not a list of promises.

What is stored

Entered by you — your name, a photo (optional), your usual currency, your interface language. An email address exists only if someone created your account for you, and it can be left blank.

Recorded by you — amounts, currencies, dates, categories, notes, participants, groups, and any receipt photos you upload.

Required to sign in — your passkey's public key and device identifier, your session, and the time you last signed in.

Passkey biometrics never leave the device. The server receives only a public key, used to confirm that a device belongs to you. It cannot be worked backwards into a fingerprint or a face.

What is not stored

No analytics. No cookie banner. No record of which pages were opened or which buttons were pressed. No ads, no tracking pixels. This is not a promise not to — there is no such code.

Where the data lives

On a rented server in Nuremberg, Germany. Receipt photos sit on that same machine's disk and never pass through an image host or cloud storage.

The database is backed up encrypted to Backblaze B2 once a day, alongside whole-machine snapshots. The backup key has no delete permission — deliberately, so that even someone who took over the server could not destroy the backups.

Who can see it

People who share a ledger with you can see your name, your photo, and the expenses between you. Anything unrelated to them stays invisible.

I administer the server, so technically I can read the database. I won't go through your expenses, and I won't pretend I couldn't — whoever runs a self-hosted service always can.

Nobody else. Nothing is sold, nothing is shared, and no third-party service can read any of it.

Requests that leave the server

To convert currencies, the server queries a public exchange-rate API (frankfurter.dev, for example). Those requests contain a currency code and a date — nothing about you.

No mail server is configured, so the system sends no email.

What you can do

Export — Settings has “Download my data”. Everything can be taken out at any time.

Delete — an account can be deleted on request. Your expenses disappear from the ledger; amounts already settled keep one record, stripped of anything identifying you, so that the other side's books still add up.

Changes

If this document changes, you will be told directly. You are not expected to come back and check.

Questions: 222879939+Crosten@users.noreply.github.com