Why we don't connect to your bank
title: "Why we don't connect to your bank" dek: "The conscious trade-off behind Halvy: less richness, more trust." date: 2026-04-05 author: "Iqbal Adrianto" status: published coverImage: /blog/why-we-dont-connect-to-your-bank.svg coverAlt: "A closed vault door — Halvy doesn't connect to your bank" tags: ["privacy", "product"]
Most finance apps open with the same ritual. Pick your bank. Log in. Grant read access to every account you own. Watch the transactions pour in, auto-categorized, complete with merchant logos and running balances. It's a good demo. It's also, for a shared-finance app, a bad fit.
Halvy doesn't do that. Halvy will never do that. Every expense you see inside the app was put there by you or your partner — typed, or scanned from a receipt. It is slower. It is also a deliberate choice, and I want to explain why.
The trade we won't make
Bank-linked apps work by sitting between you and your bank, usually through a third-party data aggregator. That aggregator holds your credentials, polls your accounts on a schedule, and streams transactions into the app you're using. It is a convenience powered by a very long and very quiet data supply chain.
For a solo budgeting tool, that chain is a reasonable trade. For a shared-finance app used by a couple, it is not. A household's finances are more sensitive than a single person's — because the blast radius of a breach spans two people, and because the app becomes a single lens onto both partners' full economic lives. I am not willing to be the thin layer between a couple's full banking history and a data aggregator. So we don't build that layer.
We also don't want the temptation. If we had all of a couple's bank data, we would be pressured — by investors, by our own product instincts — to do something "smart" with it. Predict. Nudge. Upsell. The whole calm, non-shaming ethos of Halvy falls apart the moment we become the app that knows.
What you give up
I won't pretend this is free. Without bank links, Halvy can't:
- Auto-import every swipe of your debit card.
- Flag a forgotten subscription before the third charge.
- Reconcile a mis-entered total against the canonical bank feed.
- Show you a full net-worth picture spanning checking, savings, and credit.
Those are real losses. If you want those features, there are apps that do them well, and you should use one.
What you get
What you get instead is a tool that can't possibly leak what it was never given. Halvy never holds bank credentials, because it never asks. Receipts and expenses live on your device first, encrypted, and then sync to a server that stores only what the two of you typed. There is no aggregator in the pipe. There is no third party waiting on the other end of an OAuth token.
The receipts you scan are processed entirely on your iPhone using Apple's Vision framework. We do not upload the image to parse it. We cannot see the image even if we wanted to, and that architectural choice is intentional: the best way to not be asked for your receipts is to not have them.
The shape of shared money, without the feed
Once you accept the trade, a surprising thing happens. Logging an expense takes four seconds — tap, scan, confirm. The act of typing a shared expense becomes a small, two-person ritual, not a surveillance feed. The numbers you see are the numbers the two of you put there. Nothing is hiding in a merchant-code translation table. Nothing is being inferred on your behalf.
That is what Halvy is offering: a calmer, smaller, shared notebook. We traded the firehose for trust. If the firehose is what you need, we understand. If the notebook is what you want, you're in the right place.