We never ask for your bank login.
Last Chair is a planning tool, not a vault for credentials. Nothing you give us could let anyone touch your money, and the figures that matter to you are encrypted before they reach us.
Your email address
It is how you sign in. We send it sign-in links, the monthly reminder if you turn it on, and membership notices.
When you signed in and saved
Session records: when each sign-in happened, the kind of browser and the IP address it came from. And the time each encrypted copy was written, so sync works across your devices.
Your sign-in label and membership
The label you chose for the sign-in screen, if any. Your plan, a Stripe customer reference, and whether the monthly reminder is on.
Passkey public keys
For each passkey you add, its public key and your household key sealed under it. Only your device can open that seal.
The size of your encrypted statement
A block of ciphertext and its version number. Not what is in it.
Which public symbols are looked up
Price and expense-ratio requests carry only tickers and coins, batched, with no cookie and no account. The price cache never reads who asked.
How many people visit the public pages
Hourly totals by page, linking site, country and type of device, counted on our server. No cookie, no script, and no address or identifier kept.
Your accounts, balances or holdings
They are encrypted in your browser before they leave it.
Your passphrase or recovery key
Neither is ever sent to us, so neither can be reset by us.
Your properties, mortgages, spending or goals
Part of the same encrypted document.
Any bank or brokerage credential
We never ask for one. There is no account linking and nothing to link.
The server holds a sealed envelope.
No connections to financial institutions. No credential entry, no OAuth to a bank, no third-party aggregator. You enter tickers and share counts, coins and quantities, or a plain balance. Accounts are labels such as "Traditional IRA · Vanguard", never account numbers.
Encrypted on your device. Your statement is one document, encrypted in your browser with AES-256-GCM. The key is derived from your passphrase with Argon2id, on your device, and is never transmitted. A passkey can open it too: your phone or computer derives a key from it with Face ID or Touch ID, and that key never reaches us either. On your own computer you can have the browser remember you: a key made there, which cannot be read out of it and never reaches us, opens the statement until you forget that device or sign out. A printed recovery key, shown once, is the way back in if you forget the passphrase. Lose the passphrase and the recovery key with no passkey or remembered device left, and the data cannot be recovered; we would rather say so plainly than pretend otherwise.
Calculations run in your browser. Allocation, the independence date, trades, fees and the statement itself are computed from the decrypted document on your device. The server stores ciphertext and serves public prices; it cannot compute anything about you.
Anonymous lookups. Prices and expense ratios are fetched through our cache by symbol, in batches. These requests carry no cookie and no account; the price cache never reads who asked.
No credentials, no account numbers. We never store credentials, account numbers or Social Security numbers. We do not say "unhackable"; we say we do not hold anything that would let anyone touch your money.
Yours to take, yours to erase. Export the whole household as JSON and CSV at any time. Delete everything in one step, and it is gone from the server and this device. No data resale, no advertising; membership pays for the app.