Add SimpleFin Sync as a verified community addon

[Bubbles840]

Submitting SimpleFin Sync for the verified community tier.

What it does

Imports bank and credit-card transactions from SimpleFin into Wealthfolio. SimpleFin is read-only, so the addon can never move money.

Beyond plain import:

• Correct balances — a one-time starting-balance entry lands each account on its real bank balance, not just the sum of imported transactions.
• Pending transactions — imported, then reconciled in place when they post (updated if the amount changed, removed if they vanish) rather than duplicated.
• Internal transfers — matching legs across two mapped accounts are detected and linked, so paying a credit card from checking isn't double-counted as both an expense and income.
• Automatic Bank Transfer Typing — single-leg inter-bank transfers (e.g. PNC Bank, Wire, Online Transfer, Zelle, Venmo) automatically type as TRANSFER_OUT / TRANSFER_IN, preventing in-transit transfers from inflating spending.
• In-Transit Transfer Balance Protection — unlinked in-transit TRANSFER_OUT rows are accounted for during drift calculations so in-flight transfers don't flag false balance drift warnings.
• Custom mapping rules — description patterns to activity types; user rules take precedence over automatic detection.
• Balance drift shown per account with a one-click, spending-neutral correction.
• Scheduled auto-sync with a startup catch-up and a one-hour minimum interval.
• Telegram Bot Notifications — optional real-time import notifications and scheduled daily morning budget breakdown reports.
• Native SQLite Spending Tracker Integration — direct reading of Wealthfolio SQLite database for exact category spending & default month budget target reporting.

Details

• Source: https://github.com/Bubbles840/wealthfolio-simplefin-addon
• Release: https://github.com/Bubbles840/wealthfolio-simplefin-addon/releases/tag/v1.0.1
• Pinned to tag v1.0.1, commit da86f5c8b211f42111ef59ca8c2278c2e6462fe8
• Requires Wealthfolio 3.6.2+, SDK 3.6.2
• MIT licensed; 195 tests passing, tsc --noEmit clean

Permissions

Each is declared with a purpose in manifest.json:

Permission	Why
accounts (getAll, create)	List accounts to map to, and optionally create one during setup
activities (checkImport, import, search, getAll, create, update, saveMany)	Import transactions, reconcile pending rows, link transfer pairs
portfolio.getLatestValuations	Size the one-time starting-balance correction
secrets	Store SimpleFin credentials and Telegram notification configuration
network.request	Fetch from SimpleFin, restricted to the bridge & Telegram API hosts via allowedHosts
navigation.navigate	Open a mapped account's page
ui	Register the sidebar item and route

[Bubbles840]

Updated the listing to v1.3.0 (release, tag v1.3.0, commit 4c8ad0d).

Only the six version-carrying fields changed — source.tag, source.commit, release.version, release.notes, release.changelogUrl, and distribution.r2Path. No change to the schema reference, assets, trust level, or minWealthfolioVersion (still 3.6.2).

Highlights since v1.0.1:

• Fixes a class of corruption where a single SimpleFin transaction id appearing in two accounts collapsed both legs of a transfer into one entry — mistyping rows, mis-linking pairs, and skewing starting balances. Identity is now (account, transaction id) throughout.
• Adds Fix baseline: when a wide re-scan finds every reported transaction already stored and matching, a remaining drift is attributed to the account's starting balance and corrected in one click, rather than papered over with a balance-adjustment row dated today. Never automatic, and never offered while any transaction is still unaccounted for.
• Reconcile & link now removes surplus duplicate activities and reports exactly what it deleted.
• Daily and weekly spending reports with per-report category selection, sync-health alerting, and a stuck-transfer alert.

419 tests, clean type-check.

[Bubbles840]

Bumped to v1.3.1 (release) — fixes a flaw in v1.3.0's Fix baseline found live the same day it shipped: a posted-but-not-yet-reported bank transaction produced the same constant-gap signature as a wrong baseline, so the offer now also requires the drift to have been standing for at least 10 days. Same six version fields, nothing else changed.

[afadil]

Thanks for this, and sorry it sat so long. I introduced the addon sandbox in 3.6 and reworked how community listings work before getting to the queue, so this needed converting rather than just merging.

The short version: I've dropped the Verified Community tier. Building, hosting and standing behind other people's code isn't something I can do properly on my own, and a "verified" badge that isn't a real code audit misleads people. So there are two channels now. Mine, in the app. Everyone else's, in a directory that links to your repo, where people download and install with "Install from File".

I've pushed the conversion to your branch:

• moved it to community/directory/simplefin-sync/
• removed verification, distribution, media, source and release, since Wealthfolio hosts nothing and community listings don't use cover art
• dropped the two .webp files for the same reason
• added "commercialModel": "external-service-required", because SimpleFIN needs an account. It says nothing about price, just that people need one
• dropped the README hunk, that file is generated now

You don't declare data handling any more. I read it from your manifest: the network permission plus bridge.simplefin.org, beta-bridge.simplefin.org and api.telegram.org. That's better than a declaration because the sandbox enforces it.

One thing I do need from you. Your README describes Amazon categorisation running in the companion container, which reads a mailbox. That's outside the addon, so nothing in the manifest can show it, and the listing would understate what the full setup does. Could you add:

"privacyUrl": "https://github.com/Bubbles840/wealthfolio-simplefin-addon/blob/main/PRIVACY.md",
"dataHandling": {
  "leavesDevice": true,
  "externalServices": [
    { "name": "Your mail provider, read by the companion container", "url": "https://..." }
  ]
}

Correct that to whatever is actually true. I'd rather your listing say it than have me guess.

Then post this as a comment and I'll merge:

I have read POLICIES.md and confirm:

- [ ] I am the publisher of this addon, or authorised to act for them.
- [ ] I have the rights to the name and description, and grant Wealthfolio permission to display them.
- [ ] The repository is public and has a licence file.
- [ ] What I declared is accurate, and my manifest declares every host the addon reaches.
- [ ] There is no hidden data collection or undisclosed remote code.
- [ ] I own support, updates, security fixes, privacy, licensing, and commercial terms.
- [ ] The name doesn't imply the addon is official or endorsed.
- [ ] A listing is a link only. Wealthfolio doesn't host, audit, endorse, or support it, and may remove it.

[Bubbles840]

Thanks for converting it rather than bouncing it back — and the reasoning for dropping the Verified tier makes sense to me. Standing behind other people's code is a real commitment and it's better not to imply one that isn't there.

I've added the two pieces you asked for, corrected to what the setup actually does:

• privacyUrl → PRIVACY.md, new in the addon repo.
• dataHandling with leavesDevice: true and three services: SimpleFIN Bridge (required, supplies the transactions), Telegram (only if notifications are configured), and the user's own mail provider over IMAP — the one you flagged, read by the companion container for the optional Amazon categorisation. You were right that nothing in the manifest can show it, since it happens outside the sandbox entirely.

The privacy doc spells out what each service receives: bank credentials are never handled (SimpleFIN's setup token is exchanged once for an access URL, held in Wealthfolio's encrypted secret storage), the mailbox reader keeps only an order's total, date and Amazon's own category label — not message bodies — and there is no telemetry or analytics anywhere in the addon or the companion.

Validated against the repo's own scripts/test-schema.mjs and scripts/validate-addons.mjs; both pass with no warnings on this record.

I have read POLICIES.md and confirm:

• I am the publisher of this addon, or authorised to act for them.
• I have the rights to the name and description, and grant Wealthfolio permission to display them.
• The repository is public and has a licence file.
• What I declared is accurate, and my manifest declares every host the addon reaches.
• There is no hidden data collection or undisclosed remote code.
• I own support, updates, security fixes, privacy, licensing, and commercial terms.
• The name doesn't imply the addon is official or endorsed.
• A listing is a link only. Wealthfolio doesn't host, audit, endorse, or support it, and may remove it.