Data loss and recovery

Last updated 22 October 2026 · version 2026-10-22

Preview draft, pending legal review. This is the plain-English version of section 14 of our Terms of Service (https://sumone.app/legal/terms). If the two ever differ, the Terms apply.

What we can't do

Your ledger is encrypted on your devices before it syncs, and only your devices hold the keys. That keeps your records private, even from us. It also means:

we cannot read your ledger;
we cannot recover, rebuild or restore it for you; and
our support team cannot bring back records you can no longer open.

Getting back into your account is not the same as getting your records back. A sign-in code gets you into your account. It does not bring back records that are no longer on any of your devices.

What recovery depends on

Your records can come back only from what you have kept:

Another signed-in device that still holds them.
Your Emergency Kit: 12 words and, if you set one, an extra passphrase. We show the 12 words to you once. We do not keep them, and neither do your devices. Your passphrase is never stored by us or the Apps and is never printed on the kit. If you lose the words, or forget a passphrase you set, no one can use the kit to open your records, including us.
Your own exports.

Kit restore is not yet available

Restoring from an Emergency Kit inside the Apps is not yet available in the released Apps. The same applies to restoring a ledger from an encrypted.sum backup file. For now, the kit cannot bring your records back on its own. Until the App tells you restore is available:

keep at least one other signed-in device; and
keep recent exports.

Still make your kit and keep it safe. It will matter once restore is available, and we will tell you in the App when it is.

Sync is not a backup

Sync keeps your devices in step. Encrypted copies of recent changes wait on our sync service only long enough for your other devices to catch up:

up to 7 days on the free plan;
up to 30 days on paid plans; and
never more than 90 days.

After that they are deleted. If your trial ends, sync pauses and those copies keep expiring.

What to keep

Your Emergency Kit, somewhere safe and private. Keep any passphrase somewhere separate.
At least one other signed-in device.
Regular exports, and one more before you:
- delete records, sign out or remove a device;
- replace your Emergency Kit or turn off backups;
- reset, replace or uninstall; or
- let a trial or plan end.
Check imported, read and suggested records against your statements and receipts.

What we will do

Build, test and run the Apps with due care and skill.
Take responsibility if our own mistake, defect or negligence loses or damages your records.
If we find a problem that has lost or damaged users' records, we will:
- tell you in the App, or by email if you have an account;
- fix it within a reasonable time; and
- help you recover what can be recovered from your devices, local snapshots and exports.
Give you at least 90 days' notice, with export still working, if we ever stop the online Service.
If you are in Australia, your rights under the Australian Consumer Law always apply.

In-product lines (one per moment)

These are the short lines the Apps should show at each moment. They avoid the words that the custody copy lint checks. Register any change with the privacy copy owner. Status (2026-10-22): first run, Emergency Kit sheet, printed kit, Devices footers and permanent-delete lines SHIPPED in the shared registry SumMoney/DesignSystem/LegalNotice.swift (summoney-ios#423, summoney-macos#159), pinned by LegalNoticeCopyTests; the shipped wording is the registry's, close to the lines below. Sign out, Keep backups and erase-account lines are PROPOSED: they need new confirmation UI (R27, R03).

First run (acceptance screen): "Only you can unlock your records. We can't restore them for you, so keep your Emergency Kit, another signed-in device, or your own exports."
Emergency Kit setup (until restore ships): "These 12 words are your key. Kit restore isn't turned on in SumMoney yet, so for now also keep another signed-in device or a recent export."
Emergency Kit setup (after restore ships on both platforms): "With these 12 words, and your passphrase if you set one, you can bring your ledger back on a new device. We can't recover the words for you."
Passphrase: "Your passphrase isn't saved anywhere and isn't printed on the kit. If you forget it, no one can open your records with this kit, not even us."
Kit confirmation tick box: "I've stored these words safely. I understand SumOne can't recover them or restore my records for me."
Replace Emergency Kit: "Replacing your kit makes the old 12 words stop working. Store the new words before you close this."
Delete forever: "This removes it from every synced device. We can't bring it back, so export first if you might need it."
Sign out (new confirmation): "Signing out stops sync on this device. Make sure another device or an export has your latest records first."
Remove device: "If this is your only device with your latest records, export first."
Turn off Keep backups (new confirmation): "Turning this off deletes the backups kept on this device. Without them, a problem on this device may not be recoverable."
Remove attachment: "This removes the attachment from this record on all your devices. It can't be undone."
Read-only mode banner: "Your trial has ended. You can still view and export your records; sync between your devices is paused, so export to keep a full copy."
Devices, no kit yet: "Without a kit, losing every device can mean losing your records. You can still sign in, but we can't restore what's on them."
Sync screen: "Sync isn't a backup. Recent changes are kept for up to 7 days on the free plan and 30 days on paid plans, and only your devices can unlock them."
Import, bank feed and receipt reading results: "Imported and read details can be wrong. Check them against your statement or receipt before you rely on them."
Delete account (when built): "This erases your SumOne account and synced copies. Records on your devices stay until you delete them; export first if you want a copy."