Your records stay on your device.
There's no Jinnie account and no Jinnie server holding your finances. The app is built to work with the network off, and when it's on, the only thing it fetches is code.
Where the data lives
Every store persists in the phone's application storage under a namespaced key: balances, the ledger, bills, budgets, subscriptions, cards, community records, your name, and your preferences. Currency conversion, charts and totals are computed on the device from those records; nothing is computed for you somewhere else and sent back.
What the app sends
| Request | Carries | Why |
|---|---|---|
| Mini-app bundles | The app name and platform in the URL. No personal data. | Each mini app is downloaded from its release origin the first time you open it and again when it updates. |
| Connectivity check | Nothing. It reads the device's network state. | So the bridge can tell a mini app whether it's online. |
No analytics beacon, no crash uploader, no sync. Should a future feature need a network call, it's held to the rule every mini app already follows: degrade gracefully and say what you send.
Device protection
Settings & Security can require the phone's own biometrics or passcode to open the app. Jinnie doesn't store a separate PIN and never sees the biometric data; it asks the operating system to confirm the user and acts on a yes or a no.
The privacy switch
One toggle masks every amount across every app. It's for looking at the app in public, and that is all it is: it hides figures on screen until you turn it off, and it encrypts nothing.
Backups
Export writes every record to one JSON file and hands it to the system share sheet. Where it goes from there is your call, whether that's a file manager, a cloud drive or a message to yourself, but the file isn't encrypted, so treat it like a bank statement.
Restore reads a file you pick and checks it before touching anything: product, schema version, key namespace, file size, dates and value types. Current data is snapshotted first so a failed write can be rolled back.
Mini-app isolation
Core apps receive the shared finance context through the bridge. Community apps don't; they get storage namespaced to their own id and nothing more, and the check lives in one place. See community apps.
Code integrity
Mini-app bundles are served over HTTPS from the release origin. A bundle that fails to download or doesn't export a screen is rejected and the tile shows a retry; the shell never runs a partial bundle. Signed bundles with verification in the host are on the roadmap and will be documented here when they land.
Reporting a vulnerability
Write to hello@jinnie.ph with the subject “Security”, steps to reproduce, and the app version from Settings. Give us a reasonable window to fix it before disclosing publicly; we'll acknowledge receipt and tell you what we found.