A complete set of private books — ledger, balance sheet, CFO suite, tax estimates, filing room — in a single HTML document that runs in the browser you already have. No account. No server. No subscription. No telemetry. Zero network calls unless you deliberately trigger one of its two named paths — each behind an action of yours, both off as shipped.
requests this page makes. No fonts, no scripts, no analytics — open the network tab and watch it stay empty.
calls the product makes on open, on save, or on any timer. Nothing in it fires on its own.
network paths in the entire file — each behind a deliberate action of yours, both inert as shipped. Named in full below.
Run one of those before you open it. If the number differs by one character, you are not holding the file we published — and you should not open it.
And then go further: the file is its own source code. Open it in a text editor and read what it does. Every claim on this page is checkable against those bytes, and the kind of person this product is for is exactly the kind who will check.
Most bookkeeping software is a subscription to someone else's server, holding the most sensitive record you own — every dollar in, every dollar out, every account, every client — on a machine you will never see, at a company that has to still exist next year for your books to still open.
The Keep is the other answer. It is one document. You save it wherever you save things. It stores your books in your own browser, encrypted under a passphrase only you have — the first-run interview asks you to set one before the books begin — and by default it has no way to send them anywhere: under the settings it ships with, there is no code path that transmits your books at all.
| Date | Memo | Amount |
|---|---|---|
| 03-14 | Invoice 041 paidOperating ← Accounts receivable | 4,800.00 |
| 03-15 | Payroll runOperating → Wages | 2,310.55 |
| 03-18 | Quarterly estimate set asideOperating → Tax reserve | 1,140.00 |
| 03-21 | Software licence, annualOperating → Subscriptions | 289.00 |
Figures as of the rate pack's published date — tax law changes; verify before acting. The app prints that sentence too.
The first screen is not an empty ledger. It is a conversation — a few dozen questions, more if you run a business, each one turning on a named part of the app rather than filling a database field. Every answer is saved the instant you give it. Close the tab at question nine and nothing is lost.
“I don't know” is a legal answer. It records that you don't know, and the app keeps a list of what is still open instead of pretending you told it zero. Name a state it does not model and it says so, in those words, and asks for the one rate it needs — instead of inventing a number that would look exactly as confident as a real one.
Printed here rather than discovered later. If one of these is a dealbreaker, it is better that you learn it now and keep your money.
There are no bank feeds and no import daemon, because both require handing credentials to a middleman. Transactions are entered by you, or brought in by you as CSV — parsed entirely in this window's memory.
It keeps a local snapshot ring and can recover itself from that, but if you lose the machine and kept no copy, the books are gone. That is the same trade as a paper ledger in a safe, stated plainly.
Federal estimates income and self-employment tax from the figures you enter, using the year's actual tables. Modelled states compute from their own bracket tables with the source and verification date attached. An unmodelled state asks you for one rate and says which it is doing.
A key needs a server to check it against, and the absence of a server is the product. So the file works if you copy it. We are asking you not to.
An annual edition, not a leash. You subscribe to the year: every build we ship while you are paid up is yours to keep, and the file never phones home — we built it so we can't switch it off. Lapse, and you keep what you have; what you give up is next year's edition. For scale: mainstream cloud bookkeeping rents for a few hundred dollars a year and stops working the day you stop paying. This doesn't.
One person, one household or one business. Every version shipped in your paid year is yours. Stop paying and the file you have keeps working forever.
Thirty days, no questions and no interview.
Checkout opens this week — the file and its hash are above.
For a bookkeeper, preparer or advisor keeping books for clients. Same file, same hash — what Practice buys is the licence.
Thirty days, no questions and no interview.
Checkout opens this week — the file and its hash are above.
Your books live in your own browser's storage, on your own machine. Set a passphrase and they rest encrypted under AES-256-GCM, with the key derived from that passphrase by PBKDF2-SHA256 at 600,000 iterations — the snapshot ring and any bound file are encrypted under it too, with no plaintext side door.
There is no server-side to breach, because there is no server side. Under the settings the file ships with, your books are never transmitted anywhere — not a policy, a property. What we will not say is “unhackable”: your machine's own security is still yours to keep, the same as it is for anything else on it.
In your browser's storage, on this machine — not inside the HTML file itself. The file is the application; the browser holds the ledger, tied to the browser and profile you opened it in.
That has one sharp edge, and we would rather print it here than let you find it: clearing your browsing data clears the books. The snapshot ring protects you from a corrupted store, not from that. The answer is built in — bind the books to a file on disk (Vault → bind) and every save is also written there, encrypted under your passphrase. Binding uses the browser's File System Access support, which today means Chromium browsers: Chrome, Edge and their relatives. Everywhere else the app runs fully — export a copy on a schedule instead, and keep it where you keep important things.
No. Download it, put it on a USB stick, open it on a laptop with the Wi-Fi off — everything works, from a plain file:// address, forever. The only two things that touch a network are optional and yours to trigger: the update check (fires only when you set a URL and click it) and the local-model chat (off by default, aimed at your own machine unless you deliberately point it elsewhere).
Then the encrypted books cannot be opened — by you, or by anyone. There is no reset email because there is no server to send one, and no backdoor because a backdoor for you would be a backdoor for everyone. That is what encryption that actually works means, and we would rather tell you here than in a support thread. The Keep cannot reset it, and neither can we.
So: write the passphrase down and keep it where you keep important paper. The snapshot ring protects you from a corrupted file — not from a lost passphrase.
By email. Every update in your paid year is a new file — we send it to the address on your receipt, and its new checksum is published here so you verify it the same way you verified this one. That address is the only thing we ever hold: there is no account, because there is nothing for an account to unlock.
The file keeps working. It asks nothing of us after the day you buy it — no activation, no key check, no company that has to still exist next year for your books to still open. Updates would stop; the product would not.
No. It is bookkeeping and tax-estimation software. It computes from the rules and rates its build carries, each with a source and verification date attached, and it exports a Preparer Package your accountant can read — but a return is still yours and your preparer's to sign, and the app says exactly that, inside, more than once.
Thirty days, no questions and no interview. A buyer who wants their money back has told us something more useful than the money.
You have now read everything we would say in a sales call.
Thirty days, no questions and no interview. Checkout opens this week — the file and its hash are above.