Orange Way
Personal finance for Bitcoin households, where the tracker can't read your books.
Your categories, notes, budgets, goals, and net worth never reach our servers in a form anyone can read. Not us. Not an attacker who breaks in. Not a subpoena. The math runs in your browser, after you unlock it with a password that lives only on your device.
This is a cypherpunk project, and we're recruiting collaborators. Join the build ↓
Why this exists ·
How it's different ·
How it works ·
Join the build ·
Security
What this is, in one minute
Orange Way is a personal-finance app you can use to track every account in one place: checking, savings, credit cards, investments, Bitcoin, Lightning. Categories. Budgets. Goals. Net worth.
The difference from every other tracker on the market is that our server can't read what you store with us. Your transactions and the labels you put on them are encrypted on your laptop or phone before they leave. The encryption key is derived from a password only you know. We keep ciphertext. You keep the key. If our database gets breached tomorrow, the attacker gets opaque blobs and the shape of your data, nothing more.
You still use the app like a normal web app. The encryption is invisible.
Three honest caveats. Every privacy product over-promises, and most people skip the small print. Read this part:
- Your bank still sees your bank account. Banks are the source of truth for their own ledger. No app on Earth changes that. What Orange Way protects is everything new that gets added inside Orange Way: the categories you assign, the memos you write, the budgets you build, the goals you set, the household plans you share, the Bitcoin holdings you track, the net-worth view across all your accounts.
- People you invite to your household can read what you share with them. Orange Way supports household sharing (your partner, a trusted family member, your accountant). Whoever you invite gets keys to the rows you grant them. The privacy guarantee is against the operator and any future buyer of the company, not against people you intentionally invite.
- On-chain Bitcoin transactions remain on-chain. Bitcoin's blockchain is public by design. When you connect an xpub (read-only Bitcoin wallet), the addresses and on-chain transactions stay publicly visible. We don't change that. What we don't see is your interpretation of those transactions: categories, memos, household context.
Why this exists
"Here we are faced with the problems of loss of privacy, creeping computerization, massive databases, more centralization, and [David] Chaum offers a completely different direction to go in, one which puts power into the hands of individuals rather than governments and corporations. The computer can be used as a tool to liberate and protect people, rather than to control them."
Hal Finney, cypherpunks mailing list, November 1992
Thirty-four years later, every mainstream personal-finance product operates exactly the way Finney warned against.
Monarch. Copilot. Simplifi. Empower. YNAB. Quicken. Intuit Mint (until Intuit shut it down in March 2024, giving 3.6 million users 90 days to migrate or lose years of financial history). Every single one stores your transactions, categories, budgets, notes, net-worth history, and connected-account credentials in a form their servers can read. "Bank-level encryption" means TLS in transit and AES at rest, with the keys they hold. One breach, one subpoena, one curious employee, one rogue administrator, and every line of your financial narrative is legible to someone who is not you.
That bargain made sense when "the cloud" was new. It makes less sense when:
- LastPass was breached in 2022. Attackers exfiltrated encrypted vaults and spent three years brute-forcing weak master passwords. In March 2025, federal prosecutors linked a $150 million cryptocurrency heist to that breach. The only vaults that stayed safe were the ones with strong master passwords.
- Intuit killed Mint in 2024. Millions had to manually extract or migrate years of history under a 90-day deadline. Lesson: vendor risk is your risk.
- Plaid stores bank credentials in a form its servers can decrypt. Plaid is the aggregator most of these apps sit on top of. As one Hacker News commenter put it in 2021: "Plaid is only one security breach away from being utterly destroyed." [HN]
- "Bank-level encryption" is marketing. Banks are also targets. Equifax (147M), Capital One (106M), T-Mobile (37M), MOVEit (2023), Change Healthcare (100M Americans, 2024). The pattern is the database, not the industry.
Orange Way flips the model. We build the tracker. You hold the key. Neither of us can read your data without you.
This is not marketing. It's architecture. Read the threat model.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
