The parts I'd want to read first.

How your data is actually protected.

The vault

Your data is encrypted in your browser or on your device with AES-GCM, 256-bit. Nothing is encrypted on a server and then sent back to you — by the time it leaves the device it is already unreadable.

Your passphrase

The encryption key is derived from your passphrase with PBKDF2-SHA256 at 210,000 iterations. That deliberate slowness is the point: it costs you a few hundred milliseconds once, and it costs anyone guessing at your passphrase several hundred milliseconds per guess, forever. Neither the passphrase nor the derived key is ever written to disk or sent anywhere. They exist in memory while the app is unlocked, and stop existing when it locks.

What that costs you

If you lose the passphrase, the data is gone. There is no reset link and no recovery flow, and I cannot build one without also building the thing that would let me — or anyone who compelled me — read your vault. That trade is the whole design, and you should know you are making it.

Bank linking

Optional, opt-in, and additive: the app is fully useful with it switched off. When you turn it on, you link accounts through Plaid and you are accepting Plaid's terms and privacy policy for that connection — Plaid holds the relationship with your bank, not me, and I never see your banking credentials. The Cloudflare Worker Garden puts in front of Plaid is a stateless relay: it passes a request through and keeps no database of its own.

Connected mode

The accurate claim, and the one worth holding me to: Garden retains no decrypted copy server-side. That is not the same sentence as "nothing ever leaves your device" — that stronger one is only true in local and manual-import mode, so I don't use it anywhere on this site.

Manual mode

Manual entry and CSV or PDF statement import run entirely on your device. In this mode there is no account, no server call, and nothing to intercept.

Where it runs

A web app, a macOS desktop build, and a native iOS app being rebuilt in Swift on a shared Kotlin Multiplatform core.

Who checked this

One person. Me. Nothing here has been audited by anyone else. Treat every claim on this page as something to verify rather than something to believe, and write to me if you find a hole in it.

It only touches what you point it at.

No backend

Kapers has no server. There is no account, no sign-in, and nowhere for your data to be sent, because there is nothing on the other end to send it to.

What it reads

Your calendar events and reminders, through Apple's EventKit — the same system Calendar and Reminders use — and only after you grant permission in iOS Settings. Revoke it there and Kapers loses access immediately.

Nothing changes on its own

Kapers proposes and waits. Nothing is written to your calendar or reminders until you approve that specific change.

The full Kapers privacy policy →

What this site knows about you.

No analytics

No Google Analytics, no Plausible, no pixels, no third-party scripts of any kind. I do not know how many people read this page and I am fine with that.

No cookies

This site sets no cookies, which is why you have never seen a consent banner on it.

One thing stored

If you use the day/night switch, your choice is saved in your browser's local storage under khushin:theme so the page does not flash white at you next visit. It never leaves your browser and it is not sent to me. Clear your site data and it is gone.

Hosting

The site is served by Cloudflare Pages. Like any web host, Cloudflare's edge records standard request logs — IP address, timestamp, the page requested — for security and abuse prevention. I do not query those logs, build profiles from them, or connect them to anything.

Email

mail@khushin.com forwards to a personal iCloud mailbox. If you write to me, I have your email address and whatever you put in the message, and I use it to reply to you and nothing else. No list, no newsletter, no passing it on.

Your data, back or gone

Ask, and I'll tell you everything I hold that relates to you and delete it if you want it deleted. For Garden and Kapers the honest answer is usually "nothing" — your vault is not readable by me, and Kapers never leaves your phone.

Who owns what.

Copyright

© 2026 Khushin Patel. The writing, design, photography, generated artwork and source code of this site and of Garden and Kapers are mine, all rights reserved, unless a file says otherwise in the file itself.

Names

Khushin, Garden and Kapers are used as product names for this work. Any other names, marks or logos that appear — Plaid, Apple, Cloudflare — belong to their owners and appear here only to say accurately what the software uses.

Betas

Everything on offer here is pre-release software from one person, provided as is and without warranty. Garden is not a bank, a broker or a financial adviser, and nothing it shows you is financial advice — it draws your own numbers, and the numbers can be wrong. Keep your own records.

Studio

"Studio" is how I describe the practice. It is not a company, there is no incorporation behind it, and I'd rather say that here than let the word do work it hasn't earned.

Changes

If any of this changes, the date at the top of the page changes with it. The previous wording stays in this site's git history permanently, so you can diff it.