Your records stay yours.

Esta keeps your properties, tenants, rent and expenses on your device. If you choose to share a workspace with a team, your records are encrypted on your device first, so we store them without being able to read them. This page explains exactly what happens to your information.

Last updated: November 4, 2026

What Esta stores, and where

Properties, tenants and leases, rent records and payments, shared expenses, reminders, settings and any files you attach are saved in your browser’s storage (IndexedDB) on the device you’re using. Unless you turn on team access, they are not uploaded to Esta or anyone else, and another device or browser won’t see them unless you move them there with a backup.

If you turn on the encrypted vault in Settings, this data is encrypted on your device with AES-256 using a key made from your vault password. We never see that password and can’t recover it for you.

Team access (optional)

Team access lets you share a workspace with co-owners, family or a property manager. It only starts when you create a team account and choose Share this workspace or accept an invite.

• Your account: your name, email address and password are handled by our sign-in provider, Neon Auth. Your password is stored only as a secure hash. Signing in sets a cookie that keeps you signed in to team access; it isn’t used for anything else.
• Your records: before a record is uploaded, Esta encrypts it on your device with a key that only members of the workspace hold (AES-256-GCM). The encrypted records are stored with our database provider, Neon, in Singapore. We, and Neon, can see only that encrypted data plus what’s needed to keep it in sync: which workspace and kind of record it is, a record number, which member changed it and when.
• Your keys: the key that opens your shared workspaces is kept on your devices and, so you can use it on a new device, in a backup that is itself encrypted with your team password. We never receive your keys or your password in a form we can read. If you lose your team password, that backup can’t be opened — by you or by us.
• Invites: an invite link carries a secret in the part of the address after “#”, which browsers never send to a server. We store only a scrambled fingerprint of it. Anyone holding the link can join with the role you picked until it’s used or expires after 7 days, so send it privately.
• Members: people in a workspace see the records in it and each member’s name and email. Removing someone stops their access to future changes; anything already on their device stays there, as with any shared file.

You can stop sharing at any time: sign out, leave the workspace, or (as the owner) remove members. To have your team account and its encrypted data deleted from our servers, email rsuilq69@gmail.com.

What we don’t collect

• No analytics or usage tracking, and no advertising.
• No cookies, except the sign-in cookie described above if you use team access.
• No third-party scripts or fonts: everything Esta needs is served from its own address. The app connects only to our sign-in and database providers, and only when you use team access.

Hosting

Esta’s files are delivered by our hosting provider, Vercel. Like any website host, Vercel may keep standard technical logs of the requests that load the app — such as your IP address, browser type and the time of the visit — to operate and secure the service. Those logs never include your Esta records. Vercel’s own privacy policy covers how it handles these logs.

Face ID and fingerprint unlock

If you turn on Face ID or fingerprint unlock, your device checks your face or finger itself. Esta never receives any biometric information — only a yes-or-no answer and a secret that stays on your device and is used to open your vault.

Sharing, backups and exports

Esta only shares when you ask it to. Private sharing creates an encrypted file with just the sections you choose; you send it and its passphrase yourself. Encrypted backups are protected by a passphrase you set. Unencrypted backups, CSV exports and calendar files are not encrypted, so store and send them carefully.

Notifications

If you turn on device notifications, reminders are prepared on your device. By default they show only a count (“2 things need your attention”), so names and amounts don’t appear on a lock screen unless you choose to show them.

Other people’s information

You may record details about tenants, co-owners and others. You decide what to record and who to share it with, and you are responsible for collecting and keeping it in line with the privacy laws that apply to you, such as the Philippine Data Privacy Act.

Deleting your data

You can remove everything on a device at any time from Settings → Data → Erase everything, or by clearing this site’s data in your browser settings. Once erased, it can only be brought back from a backup you made or, for a shared workspace, by signing in to team access again. Shared records stay on our servers for the other members until the workspace is deleted.

Contact

Questions about privacy, or a request to see or delete your team account data: rsuilq69@gmail.com. We aim to reply within 7 days.

Changes to this page

If how Esta handles information changes, we’ll update this page and the date at the top.