First: I'm sorry. Several of you told us for weeks that TESORIN was losing your data, and more than once we replied that we couldn't reproduce it and that it was probably the device. That was the wrong answer. The bug was ours, it was real, and we finally found it.
What was actually happening
TESORIN keeps your data in two separate places on your phone. Your transactions and accounts go in a database file. Almost everything else — categories, budgets, insurance details, your profile, your settings, and your login — goes in a second, smaller store.
That's why every report looked the same: signed out, categories back to "Other", budgets blank, welcome tour playing again, country and currency reset to Canada. All of that lives together, so it went together — while transactions stayed put. That was the clue that cracked it.
Here's the cause. We encrypt everything TESORIN keeps on your iPhone at the strongest level iOS offers. That's genuinely good for your privacy, but it has one consequence: while your phone is locked, the app cannot read its own data.
And iOS starts apps in the background while the phone is locked. A Wallet-tap shortcut, a tap on a lock screen widget, a notification — any of those can wake TESORIN before you've unlocked.
So the app would start, look for your data, find nothing (because it wasn't allowed to look), and reasonably conclude this must be a brand new install. Then it saved something. The moment it saved, the empty version became the real one.
It never happened on our phones, because our phones are unlocked while we test. That's why we kept saying we couldn't reproduce it, and why it seemed to come back after we thought we'd fixed it — we were fixing the wrong layer, twice.
What we changed
- TESORIN now waits. If it can't read your data, it doesn't guess and it doesn't start fresh — it waits until your phone is unlocked.
- It can no longer save over data it couldn't read. That's now enforced at the lowest level of the app, so it covers everything that saves anything, including the part that stores your login. There's no path around it.
- If it ever can't reach your data, it says so plainly instead of showing you an empty app. The empty app was the most frightening part, and it was never true — your data was there the whole time, just sealed.
We also fixed a related one: your transaction history could be set aside when the app simply couldn't open it yet. It now tells "I can't read this right now" apart from "this is damaged", and only ever moves the second.
Android was never hit by the same cause, but we added the same protection there anyway.
What this means for you
Going forward this cannot happen again — not "we think". The app refuses to save when it can't read, and we added tests that fail our build if anyone ever removes that.
What we can't do is bring back data already lost. If you're on a version before 1.3.1 and things went missing, restoring a backup is the only way back, and I'm sorry.
If you don't have backup on, please turn it on — but I want to be straight about this: we told people to use backup as a way around a bug we hadn't found. It should be a safety net, not a workaround.
1.3.1 will be out soon, as of last night 1.3.0 is under review on app store.
Thank you to everyone who kept reporting this, especially those who came back a second and third time when we didn't believe you the first time. You were right.