Team and roles
Inviting people into a wallet, what owners, editors and viewers can each do, custom permissions, and how access works for API keys.
A wallet can be shared. What each person sees and may change is set per person, from a role or from a custom set of permissions.
Roles
| Role | Can |
|---|---|
| Owner | Everything, including inviting and removing people, renaming the wallet, changing the base currency, managing API keys, and deleting the wallet |
| Editor | Read everything and change the data: assets, valuations, transactions, categories, plans, scenarios. Connect and manage bank connections |
| Viewer | Read everything, change nothing. No comments, no assignments, no uploads |
A wallet has exactly one owner: the person who created it, whose subscription the wallet runs on. Ownership cannot be handed to someone through an invitation or a role change, and the owner cannot be removed from their own wallet.
Custom permissions
Editor and viewer are presets. When neither fits, pick the permissions one by one when you invite someone or edit their access. Each area of the wallet has a read and a write permission:
| Area | Covers |
|---|---|
| Assets | Assets and asset groups |
| Balances | What assets are worth over time: net worth, performance, holdings values, manual valuations |
| Transactions | Transactions, crypto and security trades, splits, transfers, merchants, tags, comments and files |
| Financials | Categories, the income & expenses and profit & loss reports, planning and scenarios |
Write includes being able to delete. Four admin permissions sit beside them: managing members, managing API keys, managing bank connections, and the wallet's name and base currency.
Reports need every area they draw on. The net worth report needs assets and balances; a list of the biggest expenses needs financials and transactions, because it shows the transactions themselves. A section someone cannot read is left out of the app and out of their summary emails rather than shown empty. The AI summary on the home page and in summary emails speaks to the whole wallet, so it appears only for someone who can read all four areas.
Financials alone is enough for an accountant or advisor who should see the numbers but not the account statements: the income & expenses and profit & loss reports for the whole wallet, with no way into the transactions behind a figure and no transaction counts anywhere. Filtering a report by asset also needs assets, because figures per asset are a view of the assets.
Nobody can grant more than they hold, and nobody can change or remove their own access.
Inviting someone
Invite by email address from the users page, choosing a role or custom permissions. They get a link; if they do not have an account yet, registering with that address puts them straight into the wallet. An invitation can be withdrawn before it is accepted, and it lapses if whoever sent it leaves the wallet or no longer holds the access it offers.
Notifications and emails
Everyone gets only what they may read. A viewer of the transactions is told when a transaction is assigned to them or they are mentioned in a comment; someone without access to transactions is not. Transactions can only be assigned to someone who may change them. The weekly and monthly summaries are put together per person from the sections they can read, and someone who can read none of them gets none.
What a shared wallet does not do
There are no per-asset permissions: anyone with access to assets sees every asset in the wallet. If part of your picture should stay private, that part belongs in a separate wallet.
API keys and access
An API key is scoped to one wallet and carries its own permissions, read-only by default. Keys belong to the wallet rather than to the person who made one: they keep working if that person leaves, which is convenient for automation and worth remembering when someone does.
Support access
Walletguide support can sign in as you to investigate a problem, and when they do, every total is hidden from them: net worth, asset balances, and every chart of money. They can see a single transaction's amount, because that is usually the thing being debugged. You are not shown anything when this happens, and it is logged.