Skip to main content

Data model and security

Persistence, SQLCipher startup, migrations, backups, and lifecycle guarantees.

Store abstraction​

The application depends on a Store interface. Device builds use Drift over SQLCipher. Web and tests can use memory-backed implementations.

SQLCipher open sequence​

  1. Load the SQLCipher dynamic library.
  2. Read or create a random database key in platform secure storage.
  3. Apply PRAGMA key before reading schema content.
  4. Verify the loaded engine exposes SQLCipher support.
  5. Refuse to open if only plaintext SQLite is available.
  6. Run Drift migrations and startup checks.

The current schema version is 28.

Main record families​

  • accounts/wallets and balances;
  • transactions, transfer pairs, splits, labels, attachments, and source evidence;
  • categories and ordering;
  • budgets and rollover;
  • goals;
  • recurring and one-time scheduled payments;
  • seettu circles, members, cycles, payments, winners, and bids;
  • merchant/categorization/ignore rules and corpus metadata;
  • unmatched bank-message evidence; and
  • financial and device-local preferences.

Exact money​

Values use integer minor units. Foreign-wallet entries preserve native value, currency, rate, and LKR reporting value. Never introduce floating-point money arithmetic into domain or storage code.

Serialized writes​

Application mutations are serialized so rapid UI actions cannot reorder dependent writes. Restore and delete-all use atomic database operations and explicit post-commit file handling.

Backup contract​

The personal JSON format is versioned and validate-first. Restore replaces the financial snapshot atomically. Device-bound security, consent, and notification preferences are not imported; SMS tracking is forced off.

File safety​

Transaction attachments live only in an app-owned directory. Delete operations validate path confinement. Delete-all removes both referenced and orphaned receipt files after financial deletion succeeds and reports partial cleanup honestly.

Logging boundary​

Never log raw SMS, merchant, value, balance, full account/card value, database key, backup payload, attachment content, or authentication evidence.