Storage
Connecting an account puts the access key in this browser and nowhere else. It is never sent to our servers, which is also why nothing can happen while the app is closed.
Dropbox
Sign-in happens on your device and the token stays there. Our servers never hold it, and the permission Zilda asks for covers the app folder it files receipts into rather than the rest of your Dropbox.
Whoever set this up needs to add DROPBOX_APP_KEY. There is no secret to keep — the connection uses PKCE, so the key is public by design.
The other backends
| Backend | What it means | |
|---|---|---|
| Google Drive Any platform. Standard sign-in, folder of your choosing. | Sign-in happens on your device and the token stays there. Our servers never hold it — and Zilda asks for the narrowest permission Google offers, which reaches files this app created and nothing else in your Drive. Google will not renew this connection on its own. It issues no refresh token to an app with no server-held secret, and it will not run its sign-in inside a page, so picking the connection back up has to start from something you do — Zilda cannot top it up quietly while receipts upload. In practice it lasts about an hour and coming back is one click that usually returns without asking anything. The narrow permission has a second edge worth knowing: a receipt you drop into the folder yourself, from Drive, is invisible to Zilda. It only sees what it put there. | In use |
| Hosted storage We keep them for you. Encrypted on your device first. | Files are encrypted on your device before they are uploaded, so only ciphertext reaches us. You get a recovery code at signup — it is the only way back in if you forget your password. This tier has a different trust model to the others: we hold the bucket. The encryption is what makes that acceptable, and the recovery code is what makes it survivable. | Planned |
| On this device Nothing leaves the device. Useful for trying the app out. | Everything stays in this browser or on this phone. Clearing it deletes the receipts. No backup. Losing the device loses the documents. | In use |
Every adapter has to pass the same conformance suite before it ships — round-tripping bytes, refusing to overwrite silently, and surviving a filename like “2026-09-03 Café — Pantry 26.79.pdf”. Dropbox and Google Drive both pass it, which is why they are the two on offer.