Security

A password must be at least 12 characters, and common or breached passwords are refused. We store only a one-way hash, never the password itself, and never write it to a log. Changing a password asks for the current one.

You can sign in with a passkey instead of a password. Your phone or computer holds the key and asks for your fingerprint, face or device PIN each time. A passkey only works on EvenHearth, so a look-alike site cannot use it. We email you when one is added.

Signing in with a passkey is complete on its own: the fingerprint, face or PIN is the second step. Once you have a passkey, signing in with your password, Google, Facebook or Apple also asks for a second step: the passkey, a code from your authenticator app if you have one, or an approval from another device.

Passkeys work in browsers that support them and in the Android app. The iOS app does not support them yet.

You can add a second step, a code from an authenticator app, after your password, Google, Facebook or Apple. Turning it on gives you ten recovery codes, shown once. Each works once, and we keep only a one-way hash of each. Settings shows how many are left, and making a new set replaces the old one.

A phone or computer you are already signed in on can approve a sign-in. The sign-in screen shows a number and the other device offers three. Only the right one lets you in.

If you lose your authenticator, recovery codes and passkeys, the sign-in screen can email you a reset. It waits 72 hours and tells every signed-in device, and signing in any other way during that time cancels it.

Some changes need you to have signed in within the last 15 minutes: setting or changing your password, changing your email address, turning two-factor on or off, making new recovery codes, adding, renaming or removing a passkey, linking or unlinking Google, Facebook or Apple, signing out another device or all of them, deleting your account, handing a household to someone else, deleting a household, and reopening a closed month.

If it has been longer, you are asked what signing in would ask: a passkey on its own, or your password, Google, Facebook or Apple. With an authenticator app on, those also need a code from it or a recovery code, and a recovery code is then used up. If a passkey is your only second step, only the passkey will do. The browser extension and the bug hunting site cannot make these changes.

We email you when a way of signing in changes: a password set, changed or reset, a passkey, Google, Facebook or Apple added or removed, two-factor turned on or off, new recovery codes, and a new email address. If it was not you, the email says what to do.

A new email address must be confirmed with a code sent to it. The old address gets a link that undoes the change for seven days and signs every device out.

Your data is encrypted on its way to us and where it is stored, and the most personal parts, such as names, notes, comments, and receipt images and their text, are encrypted again with a key for your household or Account alone. When you erase your Account or a household, those parts become unreadable in our backups within 14 days, and the backups themselves are deleted within 100 days.

Every request is checked on our servers against what you are allowed to see. A password reset link works once and expires after an hour.

EvenHearth never moves money, so it never asks for card numbers, bank credentials or payment tokens.

If you find a security problem, write to support@maliko.ca with enough detail to reproduce it. Please do not access other people's data while showing it.

If you test in good faith, stay within section 7.1 of the Terms, and give us a fair chance to fix the problem before telling anyone else, we will not pursue you for it.