Verify it yourself

Don't trust us — check it

Most apps ask you to believe their privacy promises. Kontoo lets you prove them. Everything below is something you can verify on your own device, with tools you already have — your browser, a text editor, a few lines of standard code. No account, no inside knowledge required. If any of this didn't hold, you'd see it immediately.

1. "No external requests" — watch the network tab

The strongest privacy claim is also the easiest to check: while you use Kontoo, nothing about your finances leaves your device. You can see this directly.

  1. Open web.kontoo.app in your browser.
  2. Open the developer tools (F12 or right-click → "Inspect") and switch to the Network tab.
  3. Use the app: create a household, add income and expenses, switch tabs.
  4. Watch the request list. You'll see the app's own files load once (HTML, JS, CSS, fonts — all from kontoo.app), and after that no request carries your budget data anywhere — no income, no expenses, no balances leave the app.
The one honest exception: if you turn on the optional encrypted device sync (Settings → Device sync), the app talks to the sync server you configured — and even then it only ever sends ciphertext (see section 3). Kontoo is completely ad-free — no ad or tracking scripts load anywhere. Leave sync off and the app makes no network requests at all after the initial load.

2. The Content-Security-Policy — read it per page

A network tab shows what did happen; the Content-Security-Policy (CSP) is the browser-enforced rule for what's even allowed to happen. Kontoo sets a CSP as a <meta> tag in every page — view the page source (Ctrl+U) and read the Content-Security-Policy line yourself. It differs by host, and we want to be precise rather than flattering:

Pageconnect-src (outbound connections)What it means
Home & legal pages
(kontoo.app/, /imprint, /privacy, /data-format, this page)		connect-src 'none' The browser blocks every outbound connection. These pages genuinely cannot call home.
The calculators, the knowledge hub & its articles
(e.g. /renten-rechner, /learn, /learn/…)		connect-src 'none' — blocks every connection These pages are completely ad-free and make no connections after loading — just like the home page. And they hold none of your budget data — that never leaves the app.
The app
(web.kontoo.app)		connect-src 'self' https: The policy allows HTTPS, but only one thing uses it: the optional end-to-end-encrypted sync you set up. With sync off, the app initiates no connection after loading — verifiable in section 1.

We call this out deliberately: it would be easy to write "Kontoo makes no connections anywhere" — and for every content page that is now literally true. The one exception is the app: it permits HTTPS for the sync you choose. What none of them do is send your household data: your income, expenses and balances stay on your device. That is the claim that actually matters, and the one you can watch hold in section 1. You can confirm every policy in the page source.

3. Zero-knowledge sync — the server only ever sees ciphertext

If you enable device sync, here's exactly what the server receives — and why it can't read a thing. This is the same crypto as the encrypted backup file, fully documented on the data-format page.

  1. Your data is encrypted on your device before anything is sent: PBKDF2-SHA-256 (600,000 iterations) derives a key from your passphrase, then AES-256-GCM encrypts the household. The server never sees the passphrase or the key.
  2. The blob is stored under an ID derived from your passphrase — a separate PBKDF2 hash. The server knows neither your name, nor an account, nor how to guess the ID.
  3. What the server actually stores is just this envelope — no plaintext whatsoever:
{ "ts": <timestamp>,
  "env": { "format": "hbk1", "iter": 600000,
           "salt": "<Base64>", "iv": "<Base64>", "ct": "<Base64>" } }

The whole sync server is a ~100-line Cloudflare Worker that does nothing but store and hand back that ciphertext blob by its ID. It has no database of users, no login, no way to read the content. You can run your own copy in about five minutes — then not even we are in the loop.

Best of all, you can decrypt your own data yourself, entirely without Kontoo, in any browser or in Node.js. The data-format page shows the exact ~8 lines of standard WebCrypto that turn an hbk1 envelope back into your readable JSON. If you can decrypt it and the server can't, the "zero-knowledge" claim isn't marketing — it's math you can run.

4. No lock-in — your data is readable without us

Verifiability wouldn't mean much if you were still trapped. You're not. Kontoo exports your household as plain JSON (any text editor), as CSV (any spreadsheet), or as an encrypted .hbk backup — and every one of those formats is openly documented so you (or any tool) can read it forever. See the full schema, the CSV columns and the decryption recipe on the data-format page. Even if Kontoo disappeared tomorrow, you could still open everything.

The short version: open the network tab (your budget data never leaves), read the CSP per page (every page blocks every connection; only the app permits HTTPS for the sync you choose), and decrypt your own backup (the server can't). Privacy you can check beats privacy you're asked to believe.

This page describes how Kontoo works and how to verify it. If anything here stops matching what you observe, that's a bug — please tell us.