Backup, Restore, and Account Deletion Documentation
The owner's exits: a complete encrypted household backup (.ahbak), restore with a preview, and account deletion with a grace period and member notice.
Audience: Household owners planning backups, migration, or leaving. · 4-page PDF · v6.26.1
How to read this document
Sections move from purpose → concepts → calculation process → worked examples → edge cases. Formula boxes use plain mathematical notation for clarity; they are conceptual summaries, not API contracts.
- Point lists call out operator-visible behaviour.
- Callouts mark warnings, limitations, or important qualifications.
- Worked examples use round numbers so you can reproduce the arithmetic by hand.
Purpose
Your data should have an exit as carefully built as its entrance. The household owner can export everything as one encrypted archive, restore it later with a full preview, and — if the household is leaving — delete the account through a deliberate, cancellable process that tells every member.
- One .ahbak archive holds every record plus receipt and attachment bytes
- Protected by a passphrase you choose; tampering is detectable
- Restore previews everything before writing anything
- Deletion is owner-only, deliberate, and cancellable during a grace period
The .ahbak backup
A backup captures the whole household — all records plus attachment and receipt files — into a single .ahbak archive encrypted with a passphrase you choose. Modern key derivation (Argon2id) and AES-256 encryption protect the contents, and an integrity signature makes tampering detectable. The archive includes a plain-language README describing what it holds.
- You are emailed when the backup is ready to download.
- Downloads use a single-use, expiring grant rather than a long-lived link.
- Archives are retained for a limited window (about three days) and then removed from our storage — download promptly and keep your own copy.
- The passphrase is yours alone; losing it makes the archive unreadable, by design.
Restore
- Upload the archive and enter its passphrase.
- A wrong passphrase is detected immediately — not halfway through an import.
- A full preview shows what the archive contains before anything is written.
- Confirming restores into a fresh household.
Account deletion
Deletion is owner-only, started from the web, and requires re-entering the owner's password — an unlocked laptop is deliberately not enough. It then enters a short grace period (a few days) before anything is purged.
- Every member is emailed that the household is being deleted.
- The owner receives a cancellation link and can also cancel from inside the app.
- A reminder email goes out before the purge, and a completion email after.
- After the grace period, the household's data is permanently removed.
A deletion, cancelled
- The owner starts deletion on the web and confirms with their password.
- Members receive notice; the owner receives a cancel link.
- Two days in, the household changes its mind.
- The owner cancels from the emailed link — no data was touched.
Deletion is a process with an exit, not a button with an instant blast radius.
Take a backup first
Deletion after the grace period is permanent. Export a .ahbak backup before starting deletion if there is any chance you will want the data again.
Privacy, advice limits, and what we do not publish
AccountHouse is a household tracking and organisation tool. It is not a bank, payment processor, tax advisor, or investment advisor. Forecasts, health scores, balances, and alerts are informational.
- Household data is scoped to your household; other families cannot see your ledger.
- Public documentation explains product behaviour and calculation concepts, not proprietary internals.
- Exact scoring weights, anomaly thresholds, cryptography parameters beyond high-level algorithms, and operational detection rules are reserved.
- Backup archives are encrypted with your passphrase; AccountHouse cannot read or recover an archive without it.
- Deletion removes household data under the same scoping the backup uses, so 'what is backed up' and 'what is purged' agree by construction.
Intellectual property boundary
This document describes what AccountHouse calculates and which inputs matter. It does not disclose source algorithms, secret constants, or implementation details sufficient to reconstruct proprietary systems.