How sync keeps your data private
Sync is end-to-end encrypted. Your records are locked on your device before they leave it, and only your devices hold the key that opens them. Not us, not the companies that run our server, and not anyone who might break into it.
What end-to-end encryption means
Think of sync as a safe-deposit box that only you have the key to. Before Whole sends anything, it scrambles your data on your device so it can only be read with your key. The server stores the scrambled copy and passes it on to your other devices, which unscramble it with the same key.
Because the key never reaches our server, the server only ever holds content it can’t read. That includes your:
- amounts
- category and group names
- notes
- dates
- settings, such as your preferred currency
Why it matters
- Your finances stay yours. We can’t look at your net worth, and we can’t be asked to hand over something we can’t read.
- A breach reveals nothing useful. If someone ever got into the server, they would find scrambled data with no key to open it.
- Tampering gets noticed. Your devices check everything they receive. If anyone changed your data on the server, swapped it around, or faked a deletion, your devices would notice and refuse it instead of trusting it.
- Your devices keep working on their own. Every device keeps its own full copy of your data and works offline. Sync keeps those copies the same; it doesn’t move your data away from your devices.
The server is hosted in the European Union.
What the server can still see
To do its job, the server knows a few facts about your data, but never what it says. It can see how many categories and records you have and how big each one is, when something was changed or deleted and from which of your devices, and which categories appear in each record.
To run sync, we also keep your sign-in email, some technical information about your devices, and your Premium purchase. The privacy policy lists everything.
Your key and your recovery code
When you first turn on sync, Whole creates your key on your device and shows it to you as a recovery code: 12 ordinary words. The words are your key, written in a form you can keep. Anyone with them can unlock your synced data, so treat them like a password.
Save the code somewhere safe and private, such as a password manager or a piece of paper stored away. You can see it again on any device that syncs: open More, tap Sync, then Recovery code. Whole asks for your device’s screen lock or fingerprint before it shows the code.
Your key is kept in two places besides the code:
- On each device that syncs. That’s how they read your data, and why any of them can show you the code again.
- In your Google account’s backup. When you set up a new phone with the same Google account, the key usually comes back on its own. Google encrypts this copy too, as long as your phone has a screen lock. If your phone can’t keep this copy safely, Whole tells you so and asks you to make sure you’ve saved the code.
If you lose the key
This is the one thing to remember. The key is the only way to read your synced data, and nobody else has it. If it’s lost, nobody can read that data again, not even you, and not even us. We can’t reset it or recover it for you. That’s the other side of a server that can’t read your data.
It takes losing all of these at once:
- every device that syncs,
- the copy in your Google account’s backup,
- and your recovery code.
As long as you still have one of them, you’re fine. A device that still syncs can show you the code, and the code lets a new device join.
Even if you lose all three, the records on any device you still have stay as they are. What you lose is the synced copy, and the way to bring it to a new device.
In short
- Your data is locked on your device before it’s sent, and only your devices can unlock it.
- We can’t read it, and neither can anyone else.
- Keep your recovery code safe: it’s the one key, and there’s no spare.
Have more questions? See the FAQ or send us feedback.