Security
Security and data protection
Zenarios is built so there is as little as possible to protect: your financial plan never leaves your device.
The principle
- No accountNo email address, no password, nothing to steal or reset.
- No bank loginZenarios never connects to a bank and can't move money.
- No copy on a serverPlans aren't synced. There is no database of financial data to attack.
Where your plan lives
On iPhone, plans, scenarios, milestones and settings are kept in a database in the app's private storage. Other apps can't read it, and iOS encrypts it along with the rest of the device.
In the browser, the plan is kept in that browser's storage on that device, walled off from other websites. It is never sent to a server.
A plan only leaves the device when you share it yourself, as an export file or a PDF report.
What leaves the device
Anonymous usage statistics, unless you turn them off in Settings: which screens and features are used. Never names, amounts, balances or anything you type.
Crash reports, only if you turn them on: technical error details, never your plans.
Both are processed by PostHog on servers in the EU (Frankfurt) on our behalf. The details are in the privacy policy.
This website
- Encrypted connections only (HTTPS with HSTS).
- A strict Content Security Policy: scripts, fonts and images come from this domain only.
- No cookies, no third-party advertising or tracking scripts.
- The calculators work in the browser. Inputs are neither stored nor sent.
Your controls
In Settings, under “Your data”, export everything as a file or remove everything on this device with “Delete all data”. Turn statistics off under “Privacy”.
Because there is no copy on a server, we can't recover a lost plan. Export a backup now and then.
Report a vulnerability
If you have found a weakness in zenarios.com, app.zenarios.com or the app, write to . Describe what is affected, how to reproduce it and what impact you expect.
Please give us reasonable time to fix it before you publish anything, and don't access other people's data. We won't take legal action against good-faith research that follows these guidelines.