SimpleFIN accounts that stopped updating, and the advice that couldn't be followed. A MERGE LEFTOVER STOPPED THE WHOLE CONNECTION If you had merged two accounts from the same bank connection and a copy of the merged-away one later reappeared, SAFE Budget found two saved accounts claiming one bank identity. It refused to guess between them — right — and then refused to update every other account on that connection too, for as long as the copy existed. The message said "membership could not be verified" and named nothing, and its advice ("sync once, then merge") was a loop: the sync refused because of the copy, and the merge refused the copy because no sync had recorded its identity. Now one disputed identity is skipped and named, and every other account on the connection updates as normal. The sync note and Data Health say exactly which two accounts are involved, when the copy appeared, that it is frozen and double-counts in Net Worth, and the two actions that end it: merge the copy into the account that owns the identity, or delete it. That merge is now accepted. Nothing is changed for you; the choice stays yours. The copy itself can no longer come back: an identity that a merge moved onto a surviving account routes to that account from every device, whatever the connection's warnings say. APPLE WALLET KEEPS WHAT IT HELD BACK When an import holds an account back — because two saved accounts claim it, or because the account it belongs to has not reached this device yet — Apple Wallet used to move its bookmark past the held changes anyway, and they were never delivered again. The bookmark now stays put for exactly the accounts that were held, and everything else advances as before. DELETED ACCOUNTS STAY DELETED, AND SAY SO If you deleted a synced account and the bank keeps sending it, SAFE Budget kept it deleted but never mentioned it, and counted it among the accounts it had updated. It still stays deleted; the sync note now says so, and the count reflects only what was actually updated. A BRIDGE THAT ANSWERS SLOWLY SimpleFIN gathers your accounts from each institution live and answers only when the slowest has replied. The app used to give up after sixty seconds of silence; it now waits up to four minutes for that one request. Your budget stays on your devices and in your private iCloud. No servers, no tracking, no analytics.

The Mac unlock button: the second cause, and the fix that finally lands. TOUCH ID ANSWERED, AND THE APP STAYED LOCKED On the Mac, the Touch ID or password panel is a separate window. When it appears, macOS briefly makes SAFE Budget "not the active app" — the same signal it gets when you switch to something else. The app treated that signal as you leaving, locked itself against the authentication it was in the middle of collecting, and then threw away the successful answer. Nothing was said. Password instead of Touch ID went the same way, because it is the same panel. This has been true since 1.2.0. The 1.3.1 fix was real — a cover really was sitting over the button and eating the click — but once the click got through, this was waiting behind it. We are sorry it took two releases to see. The app's own prompt is no longer counted as you leaving. Switching to another app while the app is unlocked still locks it exactly as before. And an answer that arrives a few milliseconds before the Mac hands the app back its focus is waited for instead of refused. EVERY REFUSAL SAYS SO If the unlock is ever not applied — the app was hidden while the panel was up, or lost focus while it was opening your household — the lock screen now says which happened and what to do, instead of sitting there. Your budget stays on your devices and in your private iCloud. No servers, no tracking, no analytics.

An unlock button that did nothing on the Mac, and money that was almost right. THE MAC UNLOCK BUTTON WORKS AGAIN When SAFE Budget is not the active app on your Mac, it covers its windows so nobody at your desk can read your finances over your shoulder. That cover swallows clicks on purpose, so nothing underneath can be operated through it. It was also being placed over the lock screen — where there is nothing to hide and the only control is "Unlock with Touch ID". If you switched to another app and came back, your click landed on the cover instead of the button, and the app did exactly nothing you could see. The cover now goes up only when something is on screen to protect. The lock screen stays clickable. THE UNLOCK BUTTON ALWAYS ANSWERS Separately, a Face ID, Touch ID or Optic ID request goes through the system, and that request can go unanswered — no prompt, no error, nothing. The app waited forever, which on screen is a spinner and a button that appears dead. It now stops waiting after thirty seconds and says what happened. Four other ways the button could refuse also ended in silence: the app not being in a state where it can unlock, not being able to open its storage on this device, not being able to tell which household to open, and the system cancelling a prompt you never saw. Each now says which one it was and what to try. Dismissing the prompt yourself stays silent — that is the one case where you already know what happened. THE NET WORTH FIGURE DISAGREED WITH ITS OWN BREAKDOWN Your home's mortgage balance is worked out by walking the amortization schedule forward from the day the loan started. That calculation answers in a different kind of number than the ledger keeps, and converting it back carried a tail of digits far below a cent. The Accounts hub then showed the same home equity twice, from two paths that rounded differently — so the headline net worth and the breakdown printed underneath it were not the same number. Every figure the app derives from an internal calculation now becomes money at one place, on the way in. A BUDGET TARGET YOU MET EXACTLY COULD REPORT MONEY LEFT A weekly target of $5,000 was stored as a fraction of a cent under the $21,666.67 it displayed. Spending exactly the shown amount then left a sliver unspent, which carried into the next month or read as overspending by $0.00. Reopening the target editor could also show a saved amount as something like "116.6700000000000728" in a field you were expected to type in. A PORTFOLIO EXACTLY ON ITS BENCHMARK SAID "BEHIND BY $0.00" The comparison was made before the number was rounded for display, so a holding level with its benchmark could be labelled behind it by nothing at all. Your budget stays on your devices and in your private iCloud. No servers, no tracking, no analytics.

Bank sync spent months telling you it had not run. It had. "NO FULL SYNC ON THIS DEVICE YET" — OVER DATA THAT HAD ALL ARRIVED SimpleFIN answers every request with a note saying that asking for more than 45 days of history may, in future, be capped. Nothing was capped and nothing was missing; it is a standing remark about how their service may behave later. This app read it as "that response was incomplete" — on every single sync, forever. So the app withheld the one claim that says a refresh finished. Accounts updated, transactions arrived, and the screen went on reporting that no full sync had ever happened on this device. The same misreading also meant an account you closed at your bank could never retire from your list, because the app never trusted a response enough to act on what it no longer contained. A remark about the future is not a report about the present. Both now work. A CONNECTION THAT NEEDS ATTENTION NOW SAYS WHY A failing bank showed the words "Needs attention" and nothing else. The reason — the provider's own message, the thing that tells you whether to re-authenticate or just wait — was attached where only VoiceOver could reach it. It is now on the screen, and selectable, so you can copy it rather than retype it. A FAILED BANK NO LONGER TURNS GREEN ON ITS OWN That status was remembered only while the screen stayed open. Leaving Data Connections and coming back, or reopening the app, showed a bank that had just failed as a healthy "Connected". What a connection last reported now outlives the screen that watched it, and is forgotten when you disconnect — so a new connection never inherits the last one's verdict. SYNC NOW EITHER RUNS OR TELLS YOU WHY IT DID NOT Five conditions could stop a sync before it began — the app locked, an erase still finishing, a device set to view-only. Every one of them ended the same way: nothing happened, nothing was said, and the last-sync line stayed as it was. Each now says which one it was, and the keyboard shortcut is unavailable rather than silent when it cannot run. "4-7 DAYS OLD" WAS PRINTED BESIDE A FIGURE THREE WEEKS OLD Both were right and they contradicted each other. The freshness note was fixed text, while the age band it described changes with the kind of account — days for cash, months for an investment. It now states the age it measured. TWO WAYS A PARTIAL RESPONSE COULD LOOK COMPLETE A reply that arrived without its error channel, and one written in a newer dialect this app cannot read, both decoded as clean — and a clean-looking partial response is what lets accounts be closed for being absent. Silence is now treated as "we were not told", not "nothing was wrong". Your budget stays on your devices and in your private iCloud. No servers, no tracking, no analytics.

Corrections, mostly — including one that could double a budget you never changed. A BUDGET YOU OPENED AND SAVED COULD DOUBLE Using "adjust to average" on a budget item stored the monthly average into the per-period amount and left the cadence saying something else. On a biweekly item that left $1,000 a month recorded as $1,000 "biweekly" — two figures that cannot both be true. Opening that item and saving it with NOTHING changed re-read the cadence and turned an accepted $1,000 a month into $2,166.67, which then fed your category totals and what the app said you had left to spend. The same confusion sat on the card above it: a biweekly item read "+$500 vs budget" in a warning colour while you were actually $83 a month UNDER it. The amount and its cadence are now written together, and the card compares one figure against one authority. MONTHLY FIGURES NOW AGREE ACROSS EVERY SCREEN A pay amount converted to a monthly figure could land a cent apart depending on which screen had last saved it — one path rounded exactly, the older one went through a decimal approximation, and the two disagreed on the same item. Small, but it is the kind of difference that makes two screens quietly contradict each other. There is now one exact conversion, and every screen uses it. Where a projection has to drop a figure it cannot reconcile, it now tells you it did so whenever that changed a number you can see — not only when the gap clears a threshold. A difference that has already moved a forecast is not a rounding artefact, whatever its size. ADDING A WARRANTY POINTED AT THE WRONG SCREEN It said new items are added under Net Worth. Net Worth is a projection and lists no individual items, so following that took you somewhere the thing you just added does not appear. It now names the screen that actually shows it: Accounts → Assets, where a new item sits with no value until you set one. THE ACCOUNTS SCREEN COULD HIDE SECTIONS WITHOUT SAYING SO If the check for which sections have data failed, the Accounts screen kept its previous answer — empty, the first time you opened it — and silently hid assets, loans, mortgage, savings and portfolio. A failure to read is not evidence of nothing to show. It now shows those sections and tells you the check did not complete, rather than presenting an incomplete screen as a full one. "YOUR DATA CANNOT BE OPENED" NOW MEANS IT IS ALSO PUT AWAY When an older copy of the app meets data written by a newer one, it stops and says so. Three of the five routes to that screen left the app's local search index in place behind it — account names and transaction text, in a file that on macOS carries no additional protection — until you happened to lock the app or check for updates again. All five routes now clear it, which is what locking has always done. Your budget stays on your devices and in your private iCloud. No servers, no tracking, no analytics.

Two new features, and corrections — several to problems the last update caused. SCAN A PAYSTUB Point your camera at a paystub and SAFE Budget reads it on this device: gross and net pay, every tax withheld, and every deduction line — 401(k), Roth, health, dental, vision, life, disability, HSA, FSA, union dues. You check every figure before anything is saved, and you can send the year-to-date column to your tax profile, which the Taxes screen's withholding projection is built from. Apple Vision reads the image on your device. It is never uploaded and never kept. If the lines don't add up, SAFE Budget fills in nothing and says why. A paystub prints this period and year-to-date side by side, and reading those the wrong way round would multiply a paycheck by the number of paydays so far. The app works out which column is which first; when it can't, it leaves the fields blank rather than hand you a confident wrong number about your taxes. Not tax advice — check these against your records. Find it in Income → + → Scan a paystub, or on the Taxes screen. UPDATE INVESTMENT PRICES FROM A TABLE YOU CHOOSE If you have an end-of-day price file, SAFE Budget can use it. Portfolio → "Update prices from a table…", paste the address once, and it shows exactly which prices would change before changing any. SAFE Budget downloads the WHOLE file and matches your symbols on your own device. It never adds anything about your holdings to the request — which is why it works this way instead of looking prices up one at a time. No provider is built in and the feature is off until you add an address; manual prices work as before. ACCOUNT TYPES ARE READ CORRECTLY AGAIN The last update taught SAFE Budget to recognise retirement accounts by name, far too eagerly: it looked for wording anywhere in the name, and account numbers contain the same digits. A checking account ending 5290 was read as a 529; one ending 4015 as a 401(k); a credit union with "Miracle" in its name matched "IRA". Not cosmetic — a retirement account is not spendable cash, so each of those quietly dropped out of your available balance and safe-to-spend. Short keywords now match whole words, and plan numbers only where they really are plan numbers. SAFE Budget also tells a product apart from the institution selling it: a "Cash Management Account" at a firm with "Investments" in its name is a spending account, an "HSA" is savings while "HSA Invest" is not, and a "Cash ISA" is savings while a "Stocks & Shares ISA" is not. CHANGING AN ACCOUNT'S TYPE STICKS If SAFE Budget guessed wrong and you corrected it, the next sync changed it back — every sync, with nothing explaining why. Your choice is now recorded and syncing leaves it alone, including when your bank sends its own type. If another device disagrees, the account's screen says so and offers one tap to settle it. RESTORING A LARGE BUDGET TO A NEW DEVICE CAN FINISH Setting up a new device told you to keep the app open while your budget downloaded, then stopped after 45 seconds. A large budget takes minutes, so that could not work. It now waits as long as it takes, and offers a way out whenever nothing has arrived for a while. "Reset this device" says what it is doing and no longer claims to remove the iCloud copy it keeps. WARNINGS FROM YOUR BANK REACH YOU WHEREVER YOU SYNC A message like "this connection needs attention" appeared only on Data Health. Everywhere else called the run clean: Accounts said "up to date" and cleared itself after six seconds, pull-to-refresh showed nothing, and "Last full sync" moved forward. Apple Wallet's notes were missed the same way. All of them show it now. An account's screen judges its balance date on Data Health's clock too. Data & Privacy now says what the restore sheet already did: restoring a local snapshot MERGES rather than rewinds, so changes made after it can return. Your budget stays on your devices and in your private iCloud. No servers, no tracking, no analytics.

This release fixes problems reported from real use. RETIREMENT AND LOAN ACCOUNTS NO LONGER ASK TO BE "REVIEWED" FOR NO REASON Data Health judged every account on the same clock: a balance older than a week was called stale. That is right for a checking account and wrong for a 401(k), a 403(b), a managed portfolio or a mortgage, which report on their provider's schedule. Those accounts were permanently flagged, and no amount of syncing could clear them. Two things caused it, and both are fixed. Accounts now get a staleness window that matches how their kind actually reports. And accounts whose names carry wording like "EMPLOYEE SAVINGS PLAN" or "RETIREMENT SAVINGS PLAN" are now recognised as retirement accounts instead of savings accounts — including 401(a), 403(b), 457(b), TSP, pensions, annuities, 529 and education savings, ESPP and stock plans, advisory and managed portfolios, and registered accounts such as RRSP, TFSA and RESP. Accounts already saved with the wrong kind correct themselves on the next sync. A real warning is now visible instead of buried among false ones. SYNC NO LONGER TELLS YOU THE OPPOSITE OF WHAT IS HAPPENING While downloading a large budget from iCloud, the app could say iCloud was sending nothing, or that it was being throttled, and suggest restarting the device. Restarting discarded the partly-downloaded copy and began again, so following that advice made the download impossible to finish. The app now reports what it can actually observe, never blames a cause it has not seen, and tells you the one thing that helps: leave it open. That screen also offers a way out if it ever stops making progress, rather than leaving you with nothing to tap. MAC: SETTINGS AND OTHER SCREENS RESPOND AGAIN On macOS the privacy shield that hides your finances when SAFE Budget is not the active app had stopped drawing while still absorbing clicks. The window looked normal and ignored everything, most visibly in Settings. Worse, the shield's whole purpose is to keep balances and payees off an inactive screen, and an invisible one was not doing that. It is now drawn by the system rather than depending on the interface layer, so it is opaque whenever it is up. Your budget stays on your devices and in your private iCloud.

SAFE Budget 1.0.1 is a correctness and privacy update. Nothing about your data or your privacy changes: still no servers, still no tracking, still end-to-end encrypted in your own iCloud. NEW • Choose what your widgets show while SAFE Budget is locked. Settings → Security → "Show figures while locked". Leave it on and your widgets, Apple Watch and "What's left?" keep showing balances after the app locks, exactly as before. Turn it off and they go blank the moment the app locks, and fill in again next time you unlock. Your Lock Screen is unaffected either way — those figures were already hidden while your device is locked. LOCKING • Auto-lock now applies while SAFE Budget is still opening. Previously, if the app was mid-open when you switched away, coming back could finish opening your budget without asking again. It now re-checks. • On Mac, closing the main window no longer leaves Settings unlocked. If Settings was the only window open, switching away and returning could reveal it without authentication. • On Mac, connecting a bank no longer suspends auto-lock indefinitely. The allowance for stepping out to your bank's website is generous, but it now ends. • Less chance of a glimpse of your budget in the moment between returning to the app and the lock screen appearing. YOUR DATA • Erase all data now asks you again if it was interrupted. SAFE Budget no longer quietly finishes an interrupted erase the next time you open the app. It tells you what it can actually prove about what is left — including when part of the erase already happened — and lets you finish it or keep your data. • Restoring a backup now stops instead of replacing your household while something is still writing to it, so a recent change cannot be lost in the swap. • Saved bank credentials are held more strictly on your device, and an erase now reaches every copy of them. • Disconnecting a bank on one device no longer risks another device quietly reconnecting it. ICLOUD • Clearer iCloud sync messages. SAFE Budget no longer says an answer is needed when nothing is waiting on you, no longer points you at a control that may not be there, and only offers "Retry iCloud sync" when retrying can actually do something. • Sharing problems are explained in plain language instead of showing an internal code. • If a future version of SAFE Budget ever writes data this one cannot read, it will now ask you to update rather than showing an unexpected-error screen. Nothing today produces that data — it ships now because it has to be in place before it is ever needed.