"Local-only" isn't a slogan.
Here's exactly how it works.

Because the key only ever exists in your session's memory and is never stored anywhere — not on your disk, not on a server — there is no "reset password" flow that can recover encrypted data without the PIN. The app's Forgot PIN option lets you wipe and start fresh, but it cannot decrypt old data. This is the direct tradeoff of true local-only encryption: nobody holds a spare key, including us.

No — it's entirely optional and can be skipped during onboarding. PIN lock protects your data at rest (in case someone else uses your computer); it is independent from Privacy Mode, which just visually masks numbers on-screen and resets every time you reload.

Yes, for a handful of things you asked it to do — and here is the complete list. Price data: Yahoo Finance and OpenFIGI (to turn an ISIN into a ticker); versions up to 0.53 also use Stooq as a fallback. Broker sync, only if you set one up: Interactive Brokers and Trading 212, contacted directly. That is everything. No usage analytics, no crash reports, no background sync, and no license server — your key is verified offline on your own machine from its Ed25519 signature, so activation works with the network unplugged. One detail most companies would not print: in versions up to 0.53, when a price lookup cannot reach Yahoo directly, it can fall back through a public CORS relay (allorigins.win, corsproxy.io, codetabs.com, thingproxy.freeboard.io); version 0.54 and later never do this. That relay sees which ticker symbols you are pricing — not your quantities, your holdings, or any credential. Broker syncs never use that path: your IBKR Flex token travels only to IBKR, and if the direct route fails the sync fails rather than routing your credential through anyone else. You can verify all of this yourself — the app is not sandboxed against inspection.

Locally, on your own machine, in a vault folder inside your own user account — never on our servers. Up to 5 prior versions are kept automatically and are restorable in-app. With PIN lock enabled, that local data is AES-256-GCM encrypted at rest; without it, it's stored in plain form, which is why we recommend PIN lock if you share the computer with anyone.

The trial start date is tracked locally, redundantly: in the app's vault and in one further OS-level marker outside the app's own folder, so deleting the app's data doesn't reset it either. None of this reaches a server, identifies you to us, or is used for anything except remembering when your trial started; nothing changes about what leaves your machine (see above). Like any offline trial, someone determined enough to actively work around it always could — this is meant to prevent an accidental reset, not defeat deliberate tampering.

F2F-Folio is closed-source today, but the exact algorithms in use — AES-256-GCM, PBKDF2-SHA256 at 600,000 iterations, native Web Crypto APIs — are named plainly here and in the app's own EULA rather than left as a vague "bank-level encryption" claim. If independent auditability matters to your decision, treat that as an open question, not something we're claiming today.

The header's Backup button exports everything — holdings, transactions, and profile — as a single JSON file you can carry over to a new laptop, a work machine, or just keep as an offline copy. Restoring is the same drag-and-drop import flow you already use for CSVs. One thing to know: the exported file itself is plain, readable JSON, not encrypted — even if you have PIN lock turned on, only the copy stored in the app is encrypted at rest. Treat the exported file the way you'd treat a bank statement PDF: fine on a USB stick or your own cloud drive, not somewhere public.

No — closing the window quits the app. Your data is saved to disk automatically as you work, so nothing is lost; just open F2F-Folio again to pick up where you left off.