Finance Baba (ফাইন্যান্স বাবা)

A mobile-friendly personal finance diary. Users log what they spend and what they earn each day. The app shows the daily total, analyses each week, month and year, and exports full PDF statements. It works in English and বাংলা, with three themes: light cream (default), dark and a hand-drawn sketchbook theme.

Features

Area	What it does
Accounts	Sign up / log in with a username and password, or Continue with Google (any Gmail account). A one-time recovery code resets a forgotten password without losing data.
Daily log	Choose expense or income, write what it was for, then enter the amount and category. The day's total spending is always shown.
Past days locked	Adding, editing or deleting entries on a day that has passed needs the password again. Editing then stays unlocked for 5 minutes.
Analysis	Week (Saturday to Friday), month and year views with charts, category breakdown, comparison with the previous period, savings rate and insights.
Monthly target	Set a spending limit for the month on days 1–3 only (then it locks). Crossing it shows an alert, a system notification and sends an email, once per month.
Currency	Bangladeshi Taka (৳) by default. Pick another currency in Settings → Currency: new entries are saved in it and every total, target and report is shown in it. Older entries keep their original amount and are converted at the live rate. The change and its date are written into PDF reports.
In Taka	A tab with the live rate of your currency to Taka, a converter, and your day / month / year totals in Taka. Rates come from ExchangeRate-API (free, no key; Google Finance has no public API), with jsDelivr's currency-api as a backup, cached 6 hours in the database.
Loans	Log money you borrowed or lent (person, amount, date, optional return date). A loan stays open — on the Daily page and in Loans & Savings — until it is paid back; repayments can be partial, and it closes itself when the full amount is repaid. Overdue loans are flagged.
Savings	Put money into or take money out of savings; every change is logged. Shows your balance, how much you saved each of the last 6 months, and whether you are saving this month. You can't take out more than you have.
Email	Every account confirms its own email with a 6-digit code (or via Google). Log in with username or email.
Month-end report	When a month ends, its full PDF is emailed automatically (can be switched off). Monthly and yearly PDFs can still be downloaded any time.
PDF	Monthly and yearly statements with summary, category bars, day-by-day or month-by-month totals and every transaction, in English or Bangla.
Onboarding	A "what is what" slide tour after the first sign-up (swipe on phones). It can be replayed from Settings.
Privacy	Users see only their own data. Admins see only counts and anonymous activity signals and can send warnings that the user must acknowledge.
Mobile	Responsive layout, bottom navigation on phones, safe-area support and an installable web-app manifest.

Mobile app

• Install from the website: Finance Baba is an installable web app. Use the Install app button on the login page or in Settings, or Add to Home screen in Chrome, or Share → Add to Home Screen in Safari.
• Android / Google Play: android/ holds the Play Store app. It is a Trusted Web Activity that opens this same site, so it uses the same database and accounts. GitHub Actions builds the APK and AAB. See docs/ANDROID.md for building, signing and publishing step by step.
• iPhone / App Store: see docs/IOS.md.
• Security tests: npm test includes test/security.test.js, 99 black-box checks against a production-mode server.

Tech stack

The parts you already know: HTML, CSS and vanilla JavaScript in the browser, and Node.js on the server. A few small, well-known additions:

Added	Why
Express 5	The standard, minimal Node web framework for routes and middleware.
PostgreSQL (pg, hosted on Neon)	The database. Locally, without DATABASE_URL, the same SQL runs on PGlite (Postgres inside Node), so there is nothing to install.
Node's built-in crypto	scrypt password hashing and AES-256-GCM encryption, with no extra crypto dependencies.
Chart.js	Charts on the reports page, served locally rather than from a CDN.
google-auth-library	Verifies "Continue with Google" sign-ins on the server (Google's official library).
PDFKit	Generates PDFs on the server. The bundled Noto Sans Bengali font renders Bangla correctly.
helmet and express-rate-limit	Security headers (a strict CSP) and brute-force protection.

No frontend framework or build step is involved: edit a file and refresh the page.

Email setup (Gmail, free)

1. Turn on 2-Step Verification for the Gmail account that will send the emails.
2. Open https://myaccount.google.com/apppasswords, create an app password named "Finance Baba" and copy the 16 letters.
3. Set SMTP_HOST=smtp.gmail.com, SMTP_PORT=465, SMTP_USER=<that Gmail>, SMTP_PASS=<the app password> and MAIL_FROM=Finance Baba <that Gmail>.

Gmail allows about 500 emails a day, plenty for a personal project. Any other SMTP service (Brevo, Zoho, …) works the same way. Until email is set up, sign-up still works and the email step is skipped.

Month-end reports are sent by a daily job: on Vercel by Vercel Cron at 19:15 UTC, which is 1:15 AM in Bangladesh (vercel.json, needs CRON_SECRET), on your own server by a timer inside npm start. Each user's previous month is sent once, according to their own time zone.

How the encryption works

Even a full copy of the database is useless to an attacker:

This is the beginning of the README. Read the rest at the original. Read the full README ↗