Workspaces and households

A workspace is one set of books: its own transactions, its own categories, its own rules, its own uploads and duplicate reports. Nothing crosses between workspaces on its own.

You always have exactly one personal workspace, created with your account. Nobody else can be added to it and it can never be deleted or left. It is yours.

Beyond that you can create or be invited to shared workspaces, which is how a household keeps joint finances together.

The switcher

The control on the right of the header names the workspace you're currently in, and everything on screen belongs to it. Open it to switch, to create a new workspace, to reach workspace settings, or to accept an invitation. A number badge on it means someone has invited you to something.

Switching workspaces changes every screen at once. Nothing in the app ever mixes two workspaces together.

Setting up a household

The usual shape is one shared workspace that both people load statements into, with each personal workspace left for anything private.

1. One of you creates it — New workspace… in the switcher. Whoever creates it is its owner.
2. The owner opens Workspace settings… and invites the other person by email, choosing their role.
3. The invited person sees the invitation in their own switcher next time they open the app, and clicks to accept.
4. Both of you upload statements into the shared workspace, and the categories and rules you build there are shared.

Invitations are matched against the verified email address on your Google account. An invitation sent to an address you haven't verified won't appear. That is the only thing in the app granted by email rather than by account, which is why the bar is set where it is.

An owner can invite one person per email address at a time — a second invitation to a pending address, or to someone who is already a member, is refused rather than piling up.

Roles

Every membership carries one of three roles.

	Viewer	Editor	Owner
Read transactions, categories, rules, reports	✓	✓	✓
Export the account as JSON	✓	✓	✓
Upload statements, import a bundle		✓	✓
Create and edit categories and rules		✓	✓
Override categories, delete transactions		✓	✓
Rename the workspace, invite and remove members, change roles, delete the workspace			✓

Editor is the collaborator role — the one you want for the other adult in a household. Viewer is genuinely read-only: the write controls aren't disabled, they aren't rendered.

Roles are enforced on the server, not just in the interface. A viewer's browser cannot write to a workspace whatever it asks for.

Managing members

From Workspace settings…, an owner can rename the workspace, change any member's role, remove a member, revoke an outstanding invitation, or delete the workspace entirely (which deletes its data with it, and is refused for a personal workspace).

A workspace always keeps at least one owner — the last one can't be demoted or removed. Promote someone else first.

Anyone who isn't an owner can leave a shared workspace from the same dialog. Leaving is immediate and takes your access with it; rejoining needs a fresh invitation. Your own data is untouched, because none of it was ever in that workspace.

Getting data into a shared workspace

Creating a shared workspace gives you an empty one. Your existing transactions do not follow you into it, by design — a shared workspace with your personal history silently copied in would be a privacy accident, not a convenience.

Two ways to populate it:

• Upload the statements there. Switch to the workspace and upload. This is the normal path.
• Export and import. From your personal workspace, ⋮ → Export JSON gives you a single file with categories, rules, and transactions. Switch workspaces and ⋮ → Import JSON loads it. See Your data.

Within a workspace, uploads deduplicate across members: if both of you upload the same credit-card statement, the transactions land once, not twice. What that doesn't catch is the same charge arriving through two different file formats — Duplicates is the tool for that.

AI agents only see your personal workspace

This is worth knowing before you wire anything up. A request authorized through OAuth — the MCP server, the REST API — is pinned to your personal workspace and cannot be pointed at a shared one, no matter what it asks for.

So an agent connected to your account can read and change your own transactions, and cannot reach a household workspace you belong to. If you want an agent working on shared books, that is not currently something the API can do.