✳ Garden
Private beta · free

Docs

Guide 05

Your licence, sync, and connected mode

Activating offline

You receive a licence key by email after purchase. Paste it into Settings.

Garden verifies the key's Ed25519 signature on your device against a public key committed in the application. The verification function has no fetch or server call. It does not register the device, create an account, or consult a revocation list, so a compatible installed copy can verify and run with wi-fi off.

The key itself is stored in local browser storage. It is a signed assertion, not the password for your vault, and Garden does not send it with update, sync, telemetry, or bank requests.

There is no device counter. The same key verifies on your own devices.

If you lose your key

Use the recovery form on the site. It sends the email address you enter to Garden's Worker, which hashes it for lookup against the salted hash kept at purchase. If it matches, Resend sends the key to that same address. The form is rate-limited and cannot redirect the key to another address.

Updates are a separate request

The licence key contains an updates_until date. Founding keys represent the lifetime-update promise with a date 100 years after issue. Standard keys carry a date twelve months after issue.

An expired date does not disable Garden or invalidate the key. The app displays whether the running build is inside the window. The desktop updater currently checks Garden's public update feed when the main shell opens without consulting that licence result, so it can still offer a build outside the date. Opening Settings → Maintenance can repeat the check because its About section mounts a second updater hook. These requests are separate from offline licence verification and send no licence key or financial data.

Optional sync

Sync is off until you enable it. Garden serializes the whole vault and encrypts it on your device with AES-256-GCM before sending it to /api/sync/:syncId. The Cloudflare Worker stores:

  • the client-encrypted blob;
  • a revision number; and
  • an update timestamp.

The blob contains a salt, IV, and ciphertext. The passphrase and derived key do not leave the device, and the Worker has no decryption path. The syncId is the pairing code generated on your device. It is not an account, but it is a bearer identifier for downloading the encrypted blob, so keep it private.

Turning sync off removes the pairing configuration from that device; it does not delete the remote blob. The app and Worker have no deletion endpoint. The privacy policy explains how to request manual deletion.

SimpleFIN

You buy and manage a SimpleFIN Bridge directly from SimpleFIN. Garden does not collect that payment. SimpleFIN is a third party: it receives the bank credentials you give it and can receive account identifiers, names, balances, and transaction history. It handles that information under its privacy policy.

When you connect:

requires an HTTPS claim URL, and posts the claim to the bridge.

Worker requires HTTPS and HTTP Basic credentials before returning it to the device, where Garden saves it inside the encrypted vault.

Worker. The Worker uses it to call the bridge and relays readable account, balance, and transaction data back to the device.

  1. Garden sends the one-time setup token to its Worker. The Worker decodes it,
  2. The bridge returns an access URL containing the connection credentials. The
  3. The first import and every later refresh send the access URL to Garden's

The Worker sees the setup token, claim URL, access credential, and financial response data in readable form while relaying them. It does not write those values to KV, a database, or an application log. It does store an approximate rate-limit counter keyed by IP address in Cloudflare KV for no more than two minutes.

Disconnecting removes the access URL from Garden and leaves imported records as manual records. It does not cancel the SimpleFIN Bridge.

Plaid

Plaid is offered only when Garden's Worker reports that it is configured. That availability ping contains no licence or ledger data.

The app opens Plaid's hosted Link page. Your bank credentials go to Plaid and the financial institution, not Garden. Garden sends Plaid a pseudonymous id derived from the local vault generation along with the requested Transactions product, country, and language. Plaid can receive account identity, balances, transaction history, and device or connection information under its End User Privacy Policy.

Garden's Worker brokers Link tokens and the Plaid access token, then relays account, balance, institution, and transaction data. It does not persist or deliberately log those tokens or response bodies. It does keep a per-IP abuse counter for no more than two minutes. The access token is saved in the encrypted vault on your device.

Disconnecting removes the local access token but the current app does not call Plaid's item-removal endpoint. Use Plaid's controls to remove the connection or data on Plaid's side.

Both real provider paths require an encrypted vault before connection, and later refreshes require it to be unlocked before Garden contacts the Worker.

Optional usage counts

Usage counts are off until you allow them. If enabled, Garden can send only the onboarding stage reached, whether setup used demo data, and which of five main sections opened. The payload has no arbitrary text, number, user id, device id, session id, or financial value. The Worker writes accepted events and a timestamp to Cloudflare Workers Logs. The full allowlist is in the privacy policy.

Exporting your data

Garden exports the complete vault as a JSON file without contacting a server. If you enabled sync, exporting or erasing the local vault does not itself delete the encrypted server blob.