Banque de papa et maman

What it does

Pocket money can go into mum and dad’s bank instead of the piggy bank. The bank pays interest every day, at a rate chosen to teach rather than to match the market, and each child has a read-only page that shows the balance growing: a passbook, a chart, and a gauge for how much of a coin the bank now adds by itself each week.

It started as a Google Sheet. The sheet worked, so the hard part was never the maths. It was turning something that worked for my family into something another family could trust.

The promise: whoever hosts it can know nothing

I did not want to hold anyone’s e-mail address, let alone a list of children and their savings. So there are no accounts. A secret link opens a bank, and twelve recovery words bring it back. Everything is encrypted in the browser before it leaves the phone. The server stores blobs it cannot open, keeps no logs, runs no analytics, and the pages make no request to any other site.

The cost is real and the app says so: lose the link, the words and the backup, and nobody can recover the bank. Not even me.

How it is made

• One Worker, one database. A Cloudflare Worker serves the app and a small JSON API, and D1 stores the encrypted blobs. The free plan is far more than a family needs.
• A pure engine. All the money maths lives in one folder with no DOM, no network and no clock. Today’s date is always a parameter. A Python reference implementation produces test vectors, and the TypeScript engine has to match them to six decimal places.
• Crypto from the platform. HKDF and AES-GCM through Web Crypto, and BIP39 for the recovery words, in French and in English.
• Tested like a product. Unit tests run inside the Workers runtime, end-to-end tests run at phone size in light and dark, and every new screen gets an accessibility check. A test fails if the Worker ever contains a console.log.
• Made to be copied. A Deploy to Cloudflare button gives any parent their own instance in five minutes, and an invitation code lets a friend’s family use yours without you being able to see inside.

Worth noticing

The API is frozen at version one. Self-hosted copies do not update themselves, so a newer app must always be able to read an older bank. It is the kind of constraint that only appears once you imagine a stranger depending on the thing.