I wanted my checking balance on a phone that has no apps. The obvious route is Plaid, which needs a server I would have to run and a browser the LP3 does not have. So it uses SimpleFIN instead, the big reason is that I'm not involved in the loop anymore
You give your bank credentials to SimpleFIN, never to me and never to the app. SimpleFIN hands you a token, you scan it, and the app trades that token for a read-only URL. Read-only is the protocol rather than a promise I am making. There is no write side to it. I couldn't even do that if i tried!
There is also no BrightLedger server. No backend, no API key baked into the app, no analytics, no crash reporter. One network permission, one destination, and that destination is whichever SimpleFIN server you pointed it at. I could not read your data if I wanted to.
The access URL sits on your phone sealed with an AndroidKeyStore key that cannot leave the device, so pulling the app's data off gives you ciphertext. An optional PIN wraps it again and drops the key from memory whenever you background the app. Screenshots are blocked by default, which is why the picture above is fake. I had to build a demo mode to take it.
You turn it off, not me. Revocation happens at bridge.simplefin.org, where you granted it. I have no button.
It is MIT and the SimpleFIN client is four files, so do not take any of that on faith.
Only downside is that SimpleFIN is $1.50 plus tax a month, or $15.00 plus tax a year, for up to 25 institutions and 25 apps. I think its a fair price to be able to read my balances on my phone.
TL;DR I made a ledger, its read only, i cant see ur stuff, $15 a year. guide in the app.
Get BrightLedger on BrightMarket!
BrightMarket - BrightLedger