Privacy-first finance, for a life that moves.

The problem

Managing money across currencies is genuinely difficult. Exchange rates shift, accounts multiply, and local obligations don't pause because someone has moved countries. Most finance apps are built for one country, one currency, one life that stays put. Expats have always made do with tools that weren't built for them.

What we built

A full personal finance platform, not a demo: accounts, budgets, recurring transactions, savings goals, net worth tracking, and a household mode for shared finances. Receipts and bank statements are parsed automatically; an AI assistant answers questions against a user’s own transactions, balances, and budgets.

One product across web, iOS, and Android, built and maintained by the same team that designed it. No outsourced mobile, no feature gaps between platforms.

Because the product is ours, every trade-off was ours to make and ours to live with. It is the clearest demonstration we can give of how we build when nobody is cutting corners for a deadline.

How we built it

React 19 for web, Flutter for iOS and Android, FastAPI on the backend, each with its own architecture guide and its own test suite, kept in sync across a monorepo. Every frontend call runs through a single typed API client; a contract test reads every call the client makes and every route the backend exposes, and fails the build if either drifts from the other. It has already caught a route that existed in the client but not the backend before a user ever hit it.

Monitoring is part of the build, not something added after launch: Prometheus and Grafana track the system in real time, and post-deploy smoke checks verify the things that are easy to break silently (page metadata, analytics, account deletion) on every release, not just the one that introduced them.

Built for the audit, not just the launch

Financial data is collected minimally and account deletion is real: a request erases a user’s data on a fixed grace period, verified by an automated sweep that fails the build if any table with a user’s data is left behind. A scanned receipt is read for its numbers and then discarded, never stored.

Every third party that touches user data, and exactly what reaches it, is documented and kept in sync with the privacy policy as a matter of process, not a pre-launch scramble.