Local-first personal finance software: what it means in practice

The local-first checklist for money apps

One: create and edit budgets without a network. Two: survive restarts with durable local storage. Three: export without begging a vendor portal. Four: if sync exists, it merges — it does not replace your only copy. Five: bank credentials are not required to unlock core budgeting.

Fail any of those and you have a cloud app with an offline cache, not local-first software. Caches are fine. Calling a cache “local-first” is not.

If the app is useless in airplane mode, the server is the product — and you are renting access to your own ledger.

Airplane mode as a product test

Turn on airplane mode and try to assign next month’s dollars. If the app shrugs, you are renting a UI over someone else’s database. If the app keeps working — categories, Available, registers, bills — you are closer to local-first.

I use this test because travel and outages are normal. Personal finance should not require pristine connectivity to answer “can I buy this?” The network should improve sync, not unlock the ledger.

Why personal finance is a perfect local-first domain

Your budget is high-sensitivity, moderate-volume data. It does not need multiplayer at internet scale. It needs to be correct at 30,000 feet and private on a shared laptop. Sync engines and CRDT research matter; so does the product decision to never make the server the boss of your ledger.

Finance also punishes downtime differently than a social feed. Missing a like is trivial. Missing the ability to check Available before a purchase is how people bounce back to spreadsheets.

How Viridel implements it

After load, Ready to Assign, registers, bills, and net worth run offline. Desktop (Electron) and mobile (Capacitor) share one codebase with a native-relative asset base so file:// and packaged apps resolve correctly. Plus sync, when enabled, pulls and merges by record id with updatedAt and tombstones — the discipline that prevents silent data loss when two devices edit the same month.

Native widgets read finance keys only. Pricing is website-first: free web, €50 Lifetime, Plus for sync. The architecture and the business model agree — the cloud is optional infrastructure, not the product you are forced to rent forever.

Local-first vs self-host open source vs sync-first SaaS

Open-source self-host (for example Actual Budget) maximizes auditability if you will run servers and keep them healthy. Sync-first SaaS maximizes convenience if you accept custody and subscriptions. Viridel sits in the productized local-first middle: maintained apps, Lifetime unlock, optional sync, no bank login, finance-only scope.

Pick the threat model and ops burden you want. Local-first is for people who want ownership without becoming their own SRE.

What local-first is not

It is not a promise that backups are optional. Export regularly. It is not a claim that open source is morally required — productized local-first and self-host open source are different jobs. It is not anti-cloud absolutism. Sync can be excellent when it is optional and merge-correct.

It is a refusal to make login the front door to your own numbers. That refusal is why Viridel’s pricing and architecture agree: free web, €50 Lifetime, Plus only if you want devices talking.

Building trust without fake social proof

Premium SaaS marketing loves invented user counts. Viridel will not invent them. Trust comes from clear architecture, exportable history, documented pricing, and a founder who answers email. If that feels quieter than a landing page full of avatars, good — money software should sound like a ledger, not a launch party.

When you evaluate any local-first claim, ask for the merge story, the offline story, and the exit story. If those three answers are crisp, you are talking to adults. If they dissolve into brand adjectives, keep your bank password in your pocket.

Sync semantics that do not erase your month

The failure mode of naive sync is blob replace: the larger file wins, or the later laptop silently overwrites the phone. Personal finance cannot tolerate that. Two humans editing categories on the same day is normal.

Viridel Plus merges at record level with updatedAt and tombstones. Deletes leave markers so a device that was offline does not resurrect dead rows forever, and so a newer edit wins without discarding the entire budget file. You do not need to recite CRDT papers to demand this property — you only need to refuse sync that cannot explain conflict behavior in one paragraph.

Encryption, Europe, and what we will not claim

If you enable Viridel Plus, synced records travel over TLS and rest as AES-256 in Supabase on AWS eu-central-1 (Frankfurt). Transactional email, when configured, uses Resend in Ireland. The marketing site origin is Vercel in Frankfurt. Cloudflare may cache public assets from the United States. That last sentence matters: we will not pretend every packet stays in the EU.

This is not end-to-end encryption. Provider-managed at-rest encryption plus row-level security is a real improvement over a default US blob — and it is still a vendor copy you opted into. Local-first means the canonical ledger can stay on the device. Plus is the conscious exception.

Google sign-in identity is still processed by Google globally. Dodo Payments is the Merchant of Record for checkout. Those are not EU-only systems. Honest hosting copy lists the map; it does not redraw it.

Platforms: web, desktop, mobile, same ledger

Local-first across platforms is harder than a single PWA. Desktop Electron builds and Capacitor mobile builds must resolve assets correctly under file://, keep storage durable, and still feel like one product. Viridel ships that single codebase with a native-relative base when packaging apps.

Widgets on Android read finance keys only — another boundary that keeps the native surface honest after non-finance modules were cut. Premium multi-platform does not mean every OS gimmick; it means the ledger is trustworthy wherever you open it.