Six Questions to Ask ANY Finance App Before You Sign Up
Finance apps are full of marketing. "Bank-grade security!" "Millions of users!" "AI-powered insights!" It all sounds great. But which questions should you actually be asking before you start feeding a new app with your spending data?
Below are six questions every serious finance app should be able to answer. They work for Okidoky and for every alternative you're considering. If a provider can't clearly answer one of them, that's already information in itself.
1. Where is your data stored?
What to ask: In which country are the servers located? Which law applies to the hosting provider? Is there a documentable data processing agreement (DPA)?
Why it matters: If your data sits in the US, US law applies — including Cloud Act requests where you aren't always notified. Data in the EU falls under GDPR with legal guarantees that don't exist in the US. For financial data, this isn't a technical detail — it determines what a government can do with your records.
What a good answer looks like: The hosting provider's name, the country, and a link to the DPA. Not vague "in the cloud".
Okidoky: servers at Hetzner in Germany/Finland, Mollie (NL) for payments, DPA publicly linked on the site.
2. How does the provider make money?
What to ask: What percentage of revenue comes from subscriptions versus ads, data sales, or cross-sell to other financial products?
Why it matters: Apps that are fully free for everyone have to collect their bill somewhere. Usually that's aggregated analytics or data sold to third parties. "Free" is rarely actually free — you pay in information about your spending behaviour.
What a good answer looks like: Explicitly, with rough percentages. "All from subscriptions, nothing from data sales" or "80% subscriptions, 20% privacy-respecting ads" or "fully ad-funded". Honest numbers, no marketing fog.
Okidoky: fully customer-funded (subscriptions + limited non-intrusive ads for free users — no data sales, ever).
3. Who's behind it, and are they full-time?
What to ask: Company name, jurisdiction, owner/maker. Do they work full-time on the product, or is it a side project?
Why it matters: An app from "CompanyX LLC, Wilmington DE" tells you little about who actually maintains it. An app from a sole proprietorship in the Netherlands whose owner works full-time is transparent and has an operational problem if the maker gets sick — and you should know that.
What a good answer looks like: A "who's behind it" page with real names, optional photos, and an honest account of how the work is divided. Plus a plain-English sentence about what happens if they stop (data continuity).
Okidoky: sole proprietorship RULIDO in the Netherlands, KVK 98709364, one maker working full-time. Sunset plan with 180 days advance notice + CSV export + open-source release as last resort.
4. How do you leave?
What to ask: Is there an export for all your data in a standard format (CSV, JSON)? Can you delete the account yourself, or do you have to email? How long does deletion take and what happens to the backups?
Why it matters: If leaving is hard, you're not a customer anymore — you're locked in. Good apps make leaving as easy as signing up. Every bump on the exit path is a red flag.
What a good answer looks like: One-click CSV export, account deletion within days, a clear timeline for backup rotation (usually 30-60 days).
Okidoky: CSV export always available, account deletion within 48 hours via email (self-service button is on the roadmap, not yet built), backups wiped at the next monthly rotation.
5. What happens in a data breach?
What to ask: Is there a public responsible-disclosure policy? Where are past incidents documented? How are users informed when a breach happens?
Why it matters: Data breaches aren't an "if" — they're a "when". Every serious organisation will have one. The difference between trustworthy and not-trustworthy shows in how they get communicated. Silences and vague press statements are a preview of how the next one will go.
What a good answer looks like: A security.txt, a disclosure email, a public incidents page (even if it's empty — that's a commitment), and an explicit reporting window (GDPR requires 72 hours).
Okidoky: security.txt present, disclosure via security@okidoky.nl, public incidents page (currently listing no reported incidents — that's in writing), GDPR-compliant 72-hour reporting window.
6. What does the app not do, and why?
What to ask: Which features does this app deliberately refuse to build, and what's the reasoning?
Why it matters: Every honest provider has a list of things they don't do. No list = either an undifferentiated product, or a provider who hasn't thought about their edges. The reason behind a non-feature says more about philosophy than a thousand marketing pages.
What a good answer looks like: Concrete examples. "We don't build live bank integration because X." "We don't sell your data because Y." "We don't support crypto because Z."
Okidoky: no live PSD2 integration (to avoid aggregator dependency), no AI coach (local OCR, no cloud LLM on your data), no crypto integration, no full bookkeeping (no VAT filing — we stay a ledger).
One more thing: the pitch trap
A lot of apps answer these questions in interviews or blog posts — but not on their public website. That's rarely a good sign. If you can only find the answers in a podcast with the founder, transparency isn't a built-in principle — it's a PR play.
The best test: apply these six questions to three apps you're considering. Write down the answers. Winning this comparison is almost always the right call for the next three years — not the app with the prettiest homepage.
Okidoky answers all six questions publicly on the site. Questions 3–5 live on /about, /security, and /sub-verwerkers; question 6 on /about under "what Okidoky is NOT". Feel free to copy this checklist and use it on any other app you're comparing — a source link back to Okidoky is appreciated but not required.