Lefover Your money stays put
Here is exactly what Lefover can and cannot do.
The bank connection
Read-only
The bank connection is read-only. It can see transactions, and it cannot move money or pay anyone.
Your credentials stay at your bank
You enter them in your bank's own connection flow, on your device. They are entered in your bank's own flow, not on Lefover's servers.
Lefover keeps a token, not your login
Only an access token for the connection, encrypted at rest with AES-256-GCM.
In transit
Encrypted in transit
Between the app and Lefover, in both directions.
The app proves it is genuine
Before sensitive actions the app proves it is a genuine, unmodified build through the phone's attestation. The servers refuse requests that cannot prove it.
On your phone
No Lefover password
Sign in with Apple or Sign in with Google. There is no Lefover password.
Sensitive actions ask for your passcode
Disconnecting a bank and deleting your account each require your device biometric or passcode.
Hidden in the app switcher
The screen is covered when the app is not in front, so your finances do not sit in a preview thumbnail.
A warning on rooted phones
The app warns you on a jailbroken or rooted device.
An optional app lock
App lock asks for your device biometric or passcode before the app opens.
Your data
Your data stays in your country
Separate databases for the United States, Canada, and the United Kingdom. Each region is kept apart. Moving to another region means a new account there.
Diagnostics carry no personal data
Personal data is removed before diagnostics leave the device. What we receive is technical detail, not your finances.
You can delete your account
From the app, on the Menu tab, under Danger zone. An email confirms it with the completion date. The account is inert but fully recoverable for 30 days, and either you or an operator can cancel it in that window. After it, everything is permanently deleted and a final email confirms it.
What is kept after deletion
Payment and refund records, the referral reward ledger, and the security audit log, each stripped of your name and email. Everything else that is yours goes. Uninstalling the app is not a deletion, and deletion does not cancel a store-billed subscription.
Lapsed accounts are deleted after 90 days
Its data is deleted after 90 days, with a reminder before that happens.
Disconnecting a bank removes its data
It removes that bank's accounts, its bills, and its transaction history. The app says so before you confirm, and the confirm asks for your device biometric or passcode.