Your books are under lock and key. And you hold the key.
How Counted protects your expenses, explained in two minutes and without jargon.
Try it: switch the card to Our server to see exactly what we receive.
Follow an expense’s journey- Restaurant dinnerPaid by you · 12 Oct €42.00
- Weekend groceriesPaid by Léa · 11 Oct €86.40
- Chalet rentalPaid by Hugo · 10 Oct €640.00
- FuelPaid by Sami · 10 Oct €58.90
What you and your friends see. Everything is readable, because your devices have the key.
- kQ9xVb2Lr7+fN0aWc1sYpE4hT8uJzM3o=received 12/10 at 20:41
- Z1mR8cTq0+Lw5PaK9vXbN2eHsJ7fU4dYg6==received 11/10 at 18:02
- u7HcN2pXq9Lz0vRb+4WkT1mE8sAfJ5yGd3Q=received 10/10 at 09:15
- F3aZpL8w0Qr+Tn6KcV1hYbM9xE2s=received 10/10 at 09:16
What we receive and store. Without the key, it’s just noise. The balance? Worked out on your devices, never on our side.
An expense’s journey
Let’s follow a €42 dinner from your device to Léa’s. Four steps, and at no point can we read it.
A key is born on your device
When you create a group, your device draws a unique random key, just for that group. It is made on your side, never on ours.
To guess it by trying every combination, all the computers in the world together would not get there before the end of the universe.
Kept on your device. A different key for every group.
Everything is sealed before it leaves
The expense’s name, the amount, the date, who paid and for whom: it all goes into an envelope sealed with that key, right on your device. What goes out over the Internet is already unreadable.
The seal also guards against tampering: if anyone changes a single character on the way, the envelope is rejected when it is opened.
Sealed on your device
We keep envelopes we cannot open
Our servers, in Europe, store these envelopes and sync them between the group’s devices. Without the key they mean nothing: not to us, not to a hacker who breaks in, not to anyone who asks us to hand them over.
“€42? A restaurant? No idea.” We know that an envelope arrived, and when. Not what is inside.
Sharing means handing over a copy of the key
The invite link holds two things: the group’s address, and the key, placed after the # sign. Browsers never send that part to servers. That is a rule of the Web, not a promise of ours. The key travels in your message, without passing through us.
Like a real key: this link opens the group. Only send it to the people it is for.
counted.fr/projects/3f9a2c71#Sy3aK2bF9xQe…
With an account, your keys follow you
Without an account, the key lives on your device and in the link. With an account, Counted keeps a copy of each key in a keyring, locked by a key derived from your password.
Your password never leaves your device. Not even at login do we see it, so we cannot open that keyring for you.
Ground slowly, on purpose, to discourage anyone trying to guess it
Opens
Weekend in Annecy Flatshare My expenses
What we will never see. And what we do see.
A server has to know a few things to do its job. Here is the full list, no small print.
Never
- The names of your groups and expenses
- Amounts and currency
- The date and category of each expense
- Participants’ names
- Who paid, and who owes how much to whom
- Your password
What we see
- Your email, if you create an account
- That a group exists, how many participants it has, and how many envelopes it holds
- When an envelope is added, changed or deleted
- Which groups your account belongs to
- The size of the envelopes: a long description weighs a little more
- Your IP address, in logs kept 30 days at most
One exception, to be complete: importing a group from another app passes through our server in clear while the import runs, without being kept. Everything is then encrypted on your device. Every item, line by line, in the privacy policy
Questions people ask us
What if Counted gets hacked?
The hacker leaves with sealed envelopes, and the keys are not among them. For accounts, the keyring is locked by your password: pick a strong one, it is what protects it.
What if a court asks you for my data?
We can only hand over what we have: unreadable envelopes, and the short list above.
What if I lose my phone?
With an account, log in on the new one: your groups come back. Without one, reopen the invite link, or ask a group member for it.
What if I forget my password?
Nobody can reset it, not even us: it is what locks your keyring. Groups whose invite link you kept still open with that link. Keep your password in a password manager.
Why should I believe you?
Exactly: you don’t have to take our word for it. The app’s code is public, and you can check that the one running on your device is that one. Check the code
For the curious
The technical names, if you want to dig deeper
The technical details → Check the code you run → Source code → Privacy policy →
Share your expenses. Not your data.
Free. No account required. Nothing to install.