Security

Gusi Budget. Last updated 18 September 2026.

The short version

Every request to our database is checked, by the database itself, against who you are. You can only reach data belonging to a household you are a member of. That check is not in the app, it is in the database, so it holds whether the request comes from the app, from a script, or from somebody poking at our servers directly.

The key in the app is public, and that is on purpose

The app carries a key that identifies our project. Anyone who downloads the app can extract it. That is how this kind of app is built, and it is safe because the key grants nothing on its own. It is an address, not a password. What you can actually read or write is decided by the database, per row, based on the account you signed in with.

We would rather explain that than have you find it and wonder.

What we do

Row-level security on every table. No table in the application schema is readable without a policy that names the household you belong to.
The administrative key never ships. The credential that could bypass those checks exists only on our servers and has never been included in an app build.
Everything is encrypted in transit, and the database is encrypted at rest by our hosting provider.
Invite codes are stored hashed, never in plain text, expire after fifteen minutes, and can be used once. Ten wrong guesses locks an account out of guessing for fifteen minutes, which is longer than a code lives.
The ad-free purchase can only be granted by our server, after it has verified the purchase with the store. The app cannot grant it to itself.
Sign-in is handled by Google, Apple, or an email and password we never see in plain text.

What we do not do

We do not connect to your bank. We hold no card numbers, no account numbers and no bank credentials. Payment is handled entirely by Google Play and the Apple App Store.

What we cannot protect you from

Anyone in your household can see everything in it. That is what a shared budget is. If you no longer want somebody to see your spending, remove them from the household, or leave it.

If somebody has access to your unlocked phone, or to your email account, they can reach your Gusi Budget account. Use a device passcode and protect your email.

We recommend signing in with Google or Apple rather than an email and password. Those accounts have two-factor authentication and breach monitoring that we do not offer today. If you do use a password, use one you have not used anywhere else.

Reporting a problem

If you think you have found a security issue, write to support@gusistudios.com with the subject “Security”. Tell us what you found and how to reproduce it, and give us a reasonable chance to fix it before telling anybody else. We will confirm receipt within 72 hours. We are a small team, so we will not always be fast, but we will always reply.