Quietly careful.

You sign in with your email address and a password. Passwords are never stored as you typed them — only in a one-way scrambled (hashed) form that we cannot reverse. Your session is kept alive with short-lived tokens that expire and refresh automatically.

ARA connects to New Zealand banks through Akahu, an established open-banking provider. ARA never sees or stores your internet banking password.

The connection is read-only. ARA can see account names, balances and transactions. ARA cannot move money, make payments, or change anything at your bank.

The tokens that keep the connection alive live only on our servers, as protected configuration. They are never sent to your browser, never written into the pages you load, and never appear in our code repository.

ARA can access what you put into your Residence, and — if you connect a bank — your account and transaction information.

ARA cannot access your internet banking login, your email inbox, your contacts, or anything on your device you haven't shared.

Everything between your device and ARA travels over an encrypted connection (HTTPS). Your household's information is stored separately from every other household's, and every request is checked to make sure it belongs to yours.

Syncing stops immediately. Transactions already in your Study stay there so your record remains complete — until you ask us to remove them, which we will.

You can request full deletion of your account and household information at any time through the Contact page. We confirm when it's done.

If you believe you've found a security problem in ARA, please tell us privately through the Contact page before sharing it anywhere else. We take every report seriously and reply personally.

We deliberately avoid phrases like "bank-grade" or "military-grade" security. We'd rather tell you plainly what we do, and keep doing it carefully.