Coming soon
A calmer way to talk about money together.
Goodwin is a text-message assistant for couples. It reads your shared accounts, sends a short summary each week, and answers your questions in plain words. You both see the same picture, right in your texts.
How it works
Set it up once. Then just text.
Connect on the website
Link your banks through a secure bank connection service, or upload a statement. Mark each account as yours or shared.
Text with Goodwin
Goodwin is a bot. It joins one group text with both of you, plus a private text thread with each of you.
Get the short version
A weekly or monthly summary, a heads-up when something changes, and plain answers when you ask.
Privacy
Built so that even we can't look.
Your bank data will live in a sealed vault. We write the program that runs inside it, but once it starts, nobody can see in. That includes us.
- You can check it.We will publish the vault's code and its fingerprint, so anyone can confirm what is running.
- An outside audit.An independent security firm will review the vault, and we will publish the report.
- Summaries, not account numbers.Texts are for the short version. The details stay in the vault.
- Yours to delete.Text "forget everything," and Goodwin erases your data.
Under the hood
How we plan to lock ourselves out.
For the technically curious: here's the design, and how you'll be able to check it yourself.
Status: being built. Today the vault runs on a normal server, and only the founder's household uses it. It moves into the sealed computer before anyone else signs up.
-
Two separate programs
The website handles sign-up and billing. A separate program, the vault, handles everything about money. The website never receives bank data, not even account names. Pages that show bank data come from the vault itself.
-
A sealed computer
The vault runs in a hardware enclave from our cloud provider: an isolated machine with its own processor and memory, and no disk, no network, and no way to log in. The server it sits on can't read its memory. Neither can we.
-
A fingerprint of the code
When the enclave starts, the hardware measures the exact code inside it and signs that measurement. The measurement is called
PCR0. Change one byte of code, and the fingerprint changes. -
Keys that only open for that fingerprint
Your data is encrypted with keys held in our cloud provider's key management service. The key policy releases them only to an enclave that proves the right fingerprint. Debug mode zeroes the fingerprint, so a debug copy gets no keys.
-
Rebuild it yourself
The vault's code will be public. It's written in Go and built so that the same code always produces the same image, byte for byte. Anyone can rebuild it, compute the fingerprint, and compare it with the live one on our attestation page.
-
Encryption that ends inside
Connections to the vault, from your browser, the bank connection service, the texting service, and our AI provider, are encrypted all the way into the enclave. The server around it only passes along scrambled bytes. Our web host passes that traffic through without opening it.
What we can still see
- Your contact and billing details. Your phone number, email, and payment status live on the website. We use them only to run your account and to send Goodwin's messages.
- Activity, not content. We can see when messages go out, how many, and how large the encrypted data is. We can't see what any of it says. We use this only to keep Goodwin running and to stop abuse.
- What we won't do with it. We won't sell it, use it for ads, share it with marketers, or use it to offer you credit cards or loans.
Where trust still sits
- Texts. Text messages travel through phone carriers and our texting service. That's why Goodwin sends summaries, never account numbers.
- AI. Goodwin uses an AI model from an outside provider to write its messages. The model gets numbers our code has already worked out, never raw transactions. We remove names and account numbers first, and we only use providers that agree not to keep the data or train on it.
- The cloud provider. The sealed computer relies on our cloud provider's hardware design.
- The key policy. We control which fingerprint gets the keys. We'll publish that policy and every change to it.
Pricing
You pay, so you're the customer.
Goodwin is paid only. We price it to cover our costs, not to sell your attention. Every plan starts with a 30-day free trial. We'll share the price before launch.
Waitlist
Be first to try Goodwin.
We'll email you once, when Goodwin is ready. No ads and no tracking cookies.
You're on the list.
We'll email you when Goodwin is ready. Thank you for your interest.
Questions
Good to know
Do I need to download an app?
No. Setup happens on this website. After that, everything happens in your normal text messages.
Is Goodwin a person?
No. Goodwin is a bot, and it always says so.
Can I use Goodwin on my own?
Yes. Goodwin is built for couples, but it works for one person too.
Which banks work?
Most US banks connect through our bank connection service. If yours doesn't, you can upload a statement on the website.
How often will Goodwin text us?
One summary a week or a month, your choice, plus a heads-up when something changes. Never late at night.
Does Goodwin give financial advice?
No. It shows you what's happening with your money and answers your questions about it.