arrow_back Back to home

Release history

What each major release brought: a plain-language summary of features, improvements and fixes.

Bank and documents

Connect your account to Fio bank (PRO) — transactions from the account are loaded into Treziqo automatically, read-only. Card payments in a foreign currency are matched even with a small exchange-rate difference.
Missing documents — a single queue of payments that are missing a receipt or invoice. A scan uploaded from the queue is attached straight to the right transaction.
Handover of documents to your accountant (PRO) — email the documents for a chosen period to your accountant or download them as a ZIP.
A document on a transaction can be removed or moved to another payment.

Recurring payments

"Pay now" with the actual amount — when a payment differs from the plan (say, a higher utility bill), you enter how much you actually paid.
Undo an executed payment — move an occurrence confirmed by mistake back to pending.
Choice of months — a payment only in some months, for example children's school lunches during the school year without the holidays.
Ended payments in a separate section, and you can restore them with one click.

Blog and content

Short videos for articles — selected articles have a video with voice-over, captions and a text transcript below the player.
Content transparency — for every article you see whether it was created with the help of AI and whether an editor reviewed it before publishing. The new Legal notice and nature of content page explains what is and isn't our content.
The calculator shows a sample result with model numbers before you enter your own.

AI assistant

The assistant explicitly states that it is not individual financial or investment advice, and does not give specific recommendations on what to buy or sell.
AI quota is refunded when document extraction fails through our fault.

Fixes

Investment valuation correctly handles several movements on the same day.
Turning off automatic investment prices really disconnects the price services.
A business account with mandatory documents saves correctly again.
The import rollback bar no longer covers the menu on mobile.

For developers

Public read-only API v1 — create tokens in Settings → API.

Try Treziqo without signing up

The "How long will your money last?" calculator — enter your balance, income and spending and in a few seconds you see how many months your savings will cover, when they would run out at this pace and how you compare with common recommendations. No sign-up — find it in the top menu under Calculator. You can email yourself the result and, after signing up, move it into your account with one tap.
14 days of PRO free for every new user — all features right from the start, no payment card.

More insight into your numbers

The dashboard shows the trend. For the 30-day cash flow you see whether you're doing better or worse than in the previous 30 days ("↑ 12 % vs. the previous 30 days").
Analysis compares periods. The summary of income, spending and savings shows the change against the previous period. A year or month in progress is fairly compared with the same-length part of last year or last month.
Filter by tags in transactions. You could already add tags — now you can filter by them too.
Summaries in the app. You can open and read the weekly and monthly summaries right in Treziqo, not just by email.

Documents and statements

Several receipts at once — up to 10 files in a single upload. If one fails, the others are saved and you see which one to upload again.
An AI outage doesn't cost you an attempt. When AI statement extraction fails through our fault, the attempt doesn't count towards your monthly limit and you find out what happened.

Blog

Practical guides alongside the news — emergency fund, family budget, freelancer cash flow and more. Each guide has FAQs and a link to the calculator below it.
Tables in articles are displayed as tables.

What's next

Reminders based on where you left off (finishing sign-up, saving the calculator result).
A regular overview of new guides by email.
Recommend Treziqo to a friend.

The website speaks Czech to search engines too

Until now the Czech website was invisible to Google: the Czech version hid behind the same address as the English one and the search engine skipped it. Now Czech has its own addresses (/cs, /cs/rodiny, /cs/podnikatele, /cs/investori, /cs/blog) and every page tells the search engine where its language twin is.

Page titles and descriptions say what people actually search for: "family budget", "household finances", "investment overview".
Blog: under every article you find more articles on the topic and a button to try Treziqo right away.
Article images stopped being one and the same desk with a laptop — every new article gets a scene that fits its story.

Savings, investments and categories

Savings accounts finally earn. For an account with an interest rate set, you see how much it will bring you per year — a gross estimate and the amount after 15% withholding tax. It is an estimate based on the current balance; nothing is written into your transactions automatically.
Investments by year. Above the investments overview you switch which year's contributions you are interested in — for all time, or just this year.
An extended set of expense categories. New: Household supplies (bulbs, batteries, a duvet…), Heating, Licence fees and Security under Housing; Leasing, Shared mobility, Third-party insurance and Collision insurance under Transport; Pension savings, Building savings, Life and Accident insurance, Liability insurance, Investment fees, Currency exchange and Debt collection under Finance; a new group Authorities & legal. "School" was renamed to the more precise Tuition.

Fixes

The Czech landing pages returned a 500 error shortly after deployment. Fixed within the hour; we added a check that won't let the same error out again.

What's next

The first posts from Treziqo straight to Facebook and Instagram — the connection is ready.
Onboarding for new users and one-tap receipt entry on mobile.
Export to accounting and well-thought-out account deletion.

Mobile is now a full-fledged app

Until this version, the phone was just a quick-entry pad: add a transaction, look at the latest movements. Now you can handle most of your everyday money work on it.

Bottom navigation — Home · Transactions · Overview · Add · More. It no longer happens that on your phone you can only get where a tile leads.
Overview — balances, net worth, budgets, cash-flow outlook and the yearly balance. The same numbers as on the computer, because they are calculated by the same code — no second truth is created on mobile.
Analysis with charts — summary, cash flow and breakdown by category, with one-tap period selection.
Filters in the transaction list — period, type and category. The list stopped being archaeology after thirty items.

Imports, category management, scenarios and more complex settings stay on the computer. That's where they belong.

Sign-up and plans

Completing sign-up via email was invisible under certain circumstances — the "Verify and finish sign-up" button rendered white on white. Fixed, including on the password reset and two-factor authentication pages.
Paying by card via Stripe no longer kicks you out of the app when the trial ends. Anyone who paid by card was redirected to checkout after 14 days, despite having paid. Fixed, including making sure nobody is offered a second payment for the same thing.
A canceled subscription with a remaining period keeps access until the end of the period, and during that time you can choose a different plan.
The "Start with Pro" button in the pricing really preselects Pro. It used to lead to sign-up with Basic preselected.
Language and currency based on your browser. A Czech visitor gets the Czech website and prices in crowns right on the first visit; a manual language choice always takes precedence.
The offer for early users talks about the PRO plan — it used to promise "Premium", which never existed in the pricing.

Web

Promo video on the homepage. It loads from YouTube only after you click — until then the page sends nothing anywhere.
The homepage loads with 85 % less data (from 5.7 MB to 0.9 MB) and the image quality stayed the same: the app screenshot is lossless.
Links to YouTube, LinkedIn and Facebook in the footer, a cookie bar and links to privacy, terms, cookies and withdrawal from the contract on every public page.

Privacy and measurement

Treziqo has no Google Analytics or Facebook Pixel — and it won't. We don't send your behavior to ad networks; we only measure anonymous traffic on our own server. When you come from an ad and become a customer, the ad system learns only that its click led to a payment — not what you did in the app.

Security and fixes

The unsubscribe link in emails could under certain circumstances be abused to unsubscribe someone else. Fixed.
Nine findings from a review audit — security, period boundaries in overviews and performance.
Previews of shared articles have the correct aspect ratio and actually measured dimensions, so they are not shown cropped on LinkedIn and Facebook. The company page on LinkedIn gets an image with a shared article.

What's next

Onboarding for new users and one-tap receipt entry on mobile.
Invoices as another document type and bulk upload of receipts.
Export to accounting and well-thought-out account deletion.

Bank statements: amounts that add up

The most important fix in this version concerns importing PDF statements from Raiffeisenbank. For incoming payments with a variable symbol filled in, the VS in some cases got "glued" to the amount — 5 000 Kč turned into 30 205 000 Kč and the row passed as fine. Fixed for all the shapes the statement actually has, including amounts in the hundreds of thousands.

On top of that we added a safeguard that doesn't depend on a single regular expression:

An amount that exceeds the total of movements in its direction is impossible given the statement header. Such a row is now flagged and goes to manual confirmation, not straight into your data.
A flagged row sends the whole import to review — even if the statement totals otherwise match. Previously the error could hide in an offsetting movement and the import looked clean.

If you imported an RB statement and saw a nonsensically large amount in your overview, get in touch — we know how to fix it retroactively.

Recurring payments

A broken recurring transfer is paused and visible. When the target account was deleted, the rule used to fail silently every morning and nobody found out. Now it is paused (it stays in the overview, just inactive) and all you need to do is add a new target.
Yearly payments keep the day based on the anchor, even when no day is explicitly set for them.
Fixed the recurring payment form, which under certain circumstances stopped being interactive altogether.

AI assistant

Chat quota in three tiers, so it's clear how many questions you have available and when the limit resets.
Deeper reasoning enabled for more complex questions — the assistant takes more time on harder questions instead of giving a quick but shallow answer.

Plans, payments and sign-in

Seven fixes in plans and payments — from behavior when changing plans to payment processing.
Sign-in with Google and Microsoft tells you what happened. When the provider rejects the sign-in, you see the specific reason instead of a generic error. We distinguish whether you canceled it yourself or whether the provider wants you to sign in again in its window.

Currencies, news and privacy

More accurate conversions between currencies in summaries and aggregations.
News shows fresh articles — sources are filtered by age and older content sinks lower.
Updated privacy policy: added processors and a new section on how data is processed in AI features.
Library updates in response to seven security advisories.

What's next

Invoices as another document type and bulk upload of receipts.
Export to accounting (Pohoda) and well-thought-out account deletion.
An onboarding guide for new users.

Numbers you can trust

Version 3.1 is largely a cleanup under the hood — we put the app through a quality audit and fixed dozens of places where the numbers could quietly drift from reality. None of it is a new button feature, but it all means one thing: what Treziqo shows you is now more accurate.

Editing a transaction no longer silently changes the currency. The saved currency is correctly pre-filled and on save it is checked that it matches the account — no more cases where the amount was switched to a different currency after an edit.
Deleting an account, category or currency no longer throws away data in the trash. Items in the trash are handled correctly during moves and deletions, so after restoring you don't lose a category or currency.
Deleting a liability installment or an investment contribution is now correctly reversed — the principal and the portfolio return to their state before the payment, rather than just the row disappearing.
Net worth counts foreign-currency liabilities in the correct currency (by the liability's currency, not a random account's).
Recurring payments are more accurate: paused ones are not counted in "due", a delayed cron no longer drops the last installment, yearly payments respect the chosen month and month ends, and the liabilities widget correctly marks an overdue installment.

The AI assistant answers more reliably

It reads account balances correctly (previously it could return zeros for some queries).
"Today / this month" is calculated in your time zone — a question shortly after midnight no longer falls into yesterday.
It doesn't pass off an incomplete list as complete — when there are more results than fit, it tells you.
It knows your accounts and main currency, so it guesses less about what you mean and doesn't add currencies together.

Security and reliability

A redirect loophole closed in return links (you could not be led to a foreign website via a modified link).
Payment webhooks are resilient to double delivery and, when verification is missing, err on the side of caution.
Protection against double form submission across the main screens.
Back to where you came from — after editing or deleting you return to the list with your filter, not to a generic overview.

What's next

Invoices as another document type and bulk upload of receipts.
Unified cross-currency conversions in summaries and reports.
An onboarding guide for new users.

Snap a receipt, Treziqo does the rest

The flagship feature of 3.0: receipts. You snap a photo of a receipt (or upload a PDF) and Treziqo uses AI to read the merchant, date, total amount and the individual line items. Then you just check the suggestion and either create a new transaction or match the receipt to a transaction you already have — Treziqo itself offers candidates with the same amount and a nearby date.

Is there a QR payment on the receipt? Treziqo pulls out the account number, amount and variable symbol.
We guess the category from your history — if you usually use a category for that merchant, we pre-fill it.
72 h to change your mind — if a transaction is created from a receipt by mistake, it can be reverted within three days, document included.

The document is stored encrypted and stays linked to the transaction. The photo is sent to AI (Anthropic) to be read, so the feature is opt-in in Settings → Privacy. It is part of the BASIC and PRO plans (monthly limit according to the plan); you can always fill in a receipt manually too.

Improvements

Analysis: currency switcher — instead of showing all currencies at once, you switch to one and the chart and numbers adapt.
Analysis: export and drill-down — download the chart and data as CSV or PNG, and clicking a category in the chart takes you straight to its transactions.
Budgets: "pace" — the progress bar now shows whether you are spending on plan or faster than the period elapses.
Recurring payments: "next 3 occurrences" — the detail shows right away what is coming up and when.
Liabilities: when it will be paid off + "what if I pay extra" — an estimated payoff date and a mini-calculator showing how much sooner the liability will be gone if you pay extra.
Cashflow: lowest balance — the forecast now highlights the day with the lowest balance in the horizon, so you see the risk at a glance.
Correct number formatting in charts, in the English version too.

Under the hood

Reading receipts builds on the same verification principle as reading statements — the model suggests, checking the sum of line items against the total amount keeps the quality; uncertain receipts go to manual review, not straight into your data.
Stricter security filters and dependency updates.

What's next

Invoices (paid/unpaid) as another document type.
Bulk upload of multiple receipts at once.
Onboarding guide for new users.

AI reads statements even from banks Treziqo doesn't support yet

When you upload a PDF statement from a bank or format for which Treziqo has no parser of its own, it can now read it using artificial intelligence — extracting transactions, amounts, dates and balances. It is not a replacement for the precise parsers of popular banks; it is a safety net for unknown formats, so you are not left with a statement that "can't be imported".

Important: AI only suggests, the math keeps it correct. Every row is checked against the balance chain (opening balance + movements = closing balance). Anything that doesn't add up gets lower confidence and is flagged for review — no "made-up" row gets into your data.

The feature is optional and off by default — you enable it in Settings. Because the statement is sent to artificial intelligence for processing, it is a conscious decision (hence opt-in). It is available on the Basic and Pro plans with a monthly limit on the number of extractions.

Import of ČSOB credit-card statements

We added a parser for ČSOB credit-card / loan-account statements — alongside the current account you can now import the card too, with the correct sign on purchases and repayments.

Analysis no longer mixes currencies

The Analysis module now breaks widgets down by currency. If you have accounts in multiple currencies, you no longer see a meaningless sum of crowns and euros together, but a clear breakdown by individual currency.

Improvements

A clear message for a file that is too large. When you upload a statement above the allowed size, instead of a "black box" you see a clear message about what is wrong and what to do next.

Under the hood

Security dependency updates (HTTP and cryptography libraries).
A shared statement balance validator — a common mathematical foundation for the precise parsers and the new AI extraction.

What's next

AI model escalation and gradual learning from corrections in statement extraction.
Laravel 11 → 12 — the latest security patches.

Share your bank statement straight into Treziqo (Android)

Download a statement from your mobile banking app, tap Share → Treziqo and the app starts the import right away — you just pick the target account and continue to review. No file hunting, no manual upload.

Works for the installed app on Android (via "Add to home screen"). On iPhone the system does not yet allow this kind of sharing into web apps — there the classic upload on /import-export remains.

Withholding tax on savings-account interest

Savings accounts, term deposits and building savings can have a withholding-tax rate set (default 15 % for the Czech Republic). When you then post interest, Treziqo automatically deducts the tax from the gross amount and creates two separate, auditable entries — gross interest and withheld tax — so in the product history you see exactly how much came in and how much the state took. You see a preview of the tax and the net interest before you confirm.

Improvements

Fio "Account statement" now imports. We added a second Fio statement format — the official monthly PDF (alongside the "Account movements" export). We also fixed broken Czech encoding in these PDFs (Èíslo úètu → Číslo účtu).
Link to Noir in the footer next to the Terms of Service.

Fixes

A withdrawal from an investment is now correctly subtracted from its value. After the latest valuation, movements (deposit/withdrawal) entered later were not reflected in the displayed product value — the value is now computed as the valuation plus net cash flow after its date.

Under the hood

Security and maintenance updates (stricter email validation, dependency updates).
A tool for restoring local development data and the introduction of internal rules for auditing and project memory.

What's next

Laravel 11 → 12 — unlocks the latest security patches.
Cross-currency Analysis module — unified currency conversion in analyses.
Pest 2 → 3 migration of the testing framework.

Tailored landing pages — families, entrepreneurs, investors

Instead of one generic homepage, Treziqo now has four targeted landing pages:

/ — the main page with a rebuilt hero and social proof
/families — for families (shared finances, household members)
/entrepreneurs — for entrepreneurs (business + personal in one place)
/investors — for investors (portfolio, returns, allocation)

Each one speaks the language of its audience. Registration and the waitlist across them track the source (which persona the visitor came from), so we know what brought whom — no third-party cookies, just an internal enum.

Drip email sequences + event-driven triggers

A new marketing engine (/admin/sequences, /admin/mailing): emails are sent based on user actions (registration, activation, …), not just via manual campaigns. A Welcome series for new users, audience filters by consent, and an admin dashboard with a delivery overview.

Budget alerts — redesigned email

The proactive alert for an exceeded budget got a cleaner template (less visual noise, a clearer number + AI-generated context).

Page management in admin

/admin/pages replaced the older SEO admin — a single place to edit the content and meta data of static pages (a page registry instead of per-page code).

Improvements

Noticeably faster across the app — we ran an optimization audit of all 15 subsystems. The biggest speedup is in the investments overview (dozens of DB queries → 2), followed by the dashboard (budgets are computed once instead of 4×), the transaction list, analysis and admin sections. Fewer queries = snappier loading, especially for accounts with history.
Rebuilt hero on the main page + small polish of the persona landing pages (brand strip, early-access bonus, trust proof).

Fixes

Mobile — "Full version" no longer throws an error. When you reached /m/desktop on mobile via browser history or a bookmark, the app returned 405. Now it redirects you smoothly.
Mobile — AI chat. The send button now has an accessible label for screen readers; the field for a new account focuses itself.

Under the hood

Security and maintenance dependency updates.
The optimization audit is documented in docs/claude/audit/optim-2026-06/ (15 modules, per-module findings + what was intentionally left as is).
A new N+1 regression test (investments overview) as a safeguard against slowness coming back.

What's next

Pest 2 → 3 migration (unblocks the last dev-only security patch).
Cross-currency Analysis module — unified FX conversion in analyses.
Per-persona email campaigns tied to registration source tracking.

A 5-layer learning system for import categorization

Treziqo learns from how you sort transactions into categories. On your next import it no longer floods you with thousands of "Uncategorized" rows — suggestions come from 5 sources, from strongest to weakest:

Your rules — when you check "Remember next time" in review or add a rule manually in /settings/import-rules, it always wins.
Your history — if you have mostly sorted a merchant into one category in the past, Treziqo notices.
Global learning — anonymized knowledge across users (Lidl → Groceries, Netflix → Subscriptions). It only activates after reaching a threshold (≥3 users / ≥10 signals / ≥80 % agreement), so a single user cannot shift the system alone. You can turn it off in /settings → Preferences.
Hardcoded dictionary — dozens of well-known Czech merchants (Tesco, McDonald's, Bolt, …).
AI fallback — for unknown merchants Treziqo asks Claude Haiku 4.5. 30-day cache per merchant, daily cap of $2 (against runaway cost). You turn it off with the same toggle as the AI assistant.

The admin sees the detail of learned rules at /admin/global-rules. What Treziqo has collected but does not yet meet the threshold is in /settings/import-rules → Import learning — candidates — there you can promote a candidate to your personal rule with one click.

Bank statements are now the primary import path

The dashboard widget "Import data" no longer offers MyBank XML first — the primary option is a bank statement (PDF / CSV / TSV) from these 5 banks:

ČSOB · Fio · Raiffeisenbank · Air Bank · Revolut

Air Bank is new as of today. MyBank XML import remains fully functional in /import-export as a secondary path for existing users with a Moje peněženka history.

Account history — security audit log

The new section /settings → Account history shows a chronological overview of security actions on your account — sign-ins, password changes, enabling 2FA, OAuth linking, email changes. Filter by event type, expandable JSON detail with IP and user-agent. Records are immutable, retention is planned at 365 days (no prune cron yet).

Statement import — partial commit + UX polish

Per-status partial commit — you can commit a statement section by section: "Verify all matches" separately, "New" separately, "Needs attention" separately. No blocking all-or-nothing step for long statements.
"+ New rule" form on /settings/import-rules — add a rule manually even for a merchant that has never appeared in your imports.
The CTA button in statement review shows the actual number of checked rows, not the page size. Disabled until you check at least one.
"Completed imports" section in /import-export — an archive of imports outside the 72h rollback window.
Rollback now also restores import_system_note (the previous state), not just deletes the tx.

Improvements

Multi-currency dashboard — the "What if: cut spending" drawer + investment widget no longer add values across currencies without FX conversion (a mixed-currency product is split into per-currency cards).
Bank parsers — Air Bank PDF understands decimal commas, NBSP whitespace and 14 transaction types. Reliable on 3 test statements (confidence 1.0).
Personal rules — bulk bootstrap — admin command import:analyze-merchant-signals --write + web equivalent in /settings/import-rules. Creates rules from learned signals for merchants with ≥90 % dominance.

Fixes

The CTA button "Import this page (50)" was confusing — it showed the number of items on the page, not the checked ones. Fixed to "Import checked (N)".
Statement import partial commit — when a second batch failed, the previous commit_log was overwritten and rollback did not know what to revert. It now keeps cumulative IDs.
Statement import account lock — one statement cannot be split into two different accounts (the server refuses with a clear message).
Personal rule analyzer — on a tie in signals (several categories with the same frequency) it no longer saves a random one but marks it as "ambiguous" for the user to decide.
common.save / cancel / edit / delete translations were missing entirely — the UI in /settings/import-rules showed raw keys. Added.

Under the hood

4 new DB tables: import_categorization_signals, import_categorization_signal_users, import_global_category_rules, ai_categorization_cache.
MerchantIntent enum (10 values) as the canonical layer between the merchant and the per-user category.
New cron tasks: import:aggregate-global-signals (daily 04:15 — materialization of global rules after the threshold).
13 new Pest tests (7 global learning + 6 AI fallback) + 4 audit history + 6 Air Bank parser + 5 MyBank smoke (regression guard).
Refactor: shared MerchantSignalAnalyzer service (the console command and web controller call the same logic).

What's next

Drip email sequences — finishing the UX of /admin/sequences (add a sequence, add a step with campaign selection), seeding a Welcome series for new users.
Cross-currency Analysis module — the third P1 bug from the multi-currency audit (requires a UX decision: scope-to-primary vs per-currency vs FX-convert).
PROD nginx 413 — MyBank XML upload fails at the infrastructure level (nginx client_max_body_size < the application limit). Step-by-step fix in docs/TODO.md.

My currencies — no more 300 currencies in every select

In /settings you can now choose your currencies — the ones you actually work with (CZK, EUR, …). Currency selects across the app (investments, liabilities, budgets, accounts) then show only those, not the whole list of 300+ ISO currencies. Fulltext search over localized names, and a currency "in use" cannot be removed by accident.

At registration the set is pre-filled by language — CZ → CZK + EUR, EN → USD + EUR
Editing an older record in a deactivated currency still works (the currency is temporarily added)

Unified forms — liabilities, recurring payments, budgets, accounts

The forms for adding and editing a liability, recurring payment, budget and account got the same look as /investments/create: type tiles, clear sections, collapsed advanced settings and a live summary in the right panel.

Account administration now has its own page instead of a slide-out panel — clearer management of currencies, categories and deletion.
No change in functionality — just nicer UX, the same fields and validation.

Redesigned checkout

The /checkout page now shows payment methods as full-fledged cards side by side (Stripe, PayPal) with logos and descriptions. The BASIC/PRO plans are fully clickable and you switch currency right on the page, without a detour into settings.

Improvements

Investments — clicking anywhere on a row in the list opens the product detail; cleaned-up UX of automatic valuation (Twelve Data).
Dashboard — the cashflow risk alert banner can be closed.
Admin — /admin/plans shows the Stripe Price ID next to the PayPal Plan ID.

Fixes

Article image generation — on 12 May 2026 OpenAI shut down the DALL-E models. Blog hero images switched to the successor gpt-image-1.
Investments — the asset selection (ticker / coin) no longer disappears when the product is saved.
Sign-in with Google / Microsoft — fixed generation of a unique nickname (registration could previously fail).

Under the hood

New CI deploy-safety checks — migrations, seeder idempotency, routes, scheduled tasks.
CodeRabbit — automatic AI review of every pull request.
Dependency updates (Laravel Sanctum, npm packages).

Stripe Billing as a second payment provider

Alongside PayPal, you can now pay for your subscription via Stripe Checkout — card, Google Pay, Apple Pay in a single hosted window (Stripe picks them itself based on browser and device). PayPal remains fully functional and is not replaced — the user chooses what they prefer on /checkout.

Support for EUR, USD and CZK via Stripe (originally only EUR/USD were planned, CZK was added on request)
New /settings/billing page — you see the active provider, plan, next renewal, payment history with provider badges
Stripe users have a direct link to the Stripe Customer Portal for self-service management (change card, PDF invoices, cancel)
Webhook on 6 events: activation, status changes, recurring billing, payment failures
The admin in /admin/users/{id}/plan sees a provider badge + a deep link to the Stripe Dashboard

Auto-valuations for stocks and ETFs

Investments of type STOCK / ETF / REIT have an autocomplete ticker picker (Twelve Data API) — you pick a symbol (AAPL, VWCE, VOO…) and the app then automatically updates the price daily. Works in parallel with the existing CoinGecko auto-pricing for crypto.

Daily cron at 23:00 Prague time (after US markets close)
Cross-currency: if the quote is in a different currency than the investment product (typically AAPL=USD, product in CZK), conversion via FxConverter
Backfill of historical values on the first save of the product (analogous to the CoinGecko backfill)

Editing contribution history

In the investment detail you can now edit any historical contribution — amount, currency, note. For contributions matched to a bank transfer, it cascades down to the transfer + both transactions in one DB transaction.

Fixes

Recurring investments with "write automatically" mode silently failed — the mandatory currency_id was missing in the insert query (constraint violation after the multi-currency migration). Fixed. Existing FAILED occurrences remain in the DB; you can catch them up manually with "Pay now" on the recurring detail or add a contribution in /investments/{id}.
PWA offline: clicking "Add transaction" on the offline page did not lead to the form — the Service Worker did not keep /quick in its cache, so navigation fell back to the offline page (loop). Service Worker bumped to v6 — /quick is now cached, offline submit via the outbox keeps working the same.

Improvements

/quick reliability — submit no longer uses the navigator.onLine gate (which lies), instead fetch + catch fallback to the outbox. Replaces silent failures on WiFi without internet.
/m/transactions/{id}/edit offline — PUT requests are queued into the outbox following the /quick pattern (PUT is naturally idempotent, no client_uuid needed).
Edit modal in contribution history — a shared Alpine instance for the whole table, no per-row form render.

Under the hood

New namespace App\Services\Billing\ for StripeService + checkout/webhook/settings controllers
StripeService::isTestMode() detects Restricted keys too (rk_test_*), not just the Standard secret
WebhookEvent table shared between PayPal and Stripe for dedup (provider column)
Payment.provider extended with the 'stripe' value, UNIQUE on provider_transaction_id = Stripe invoice ID
5 new columns on users: billing_provider, stripe_customer_id, stripe_subscription_id, stripe_price_id, billing_currency, subscription_status
Artisan stripe:bootstrap-products — idempotent build of Stripe Products + Prices from the active plan_prices in the DB

What's next

End-to-end testing of Stripe checkout (after composer install on Linux/Forge)
Email notification on invoice.payment_failed (currently only the status is flagged, mail is a Phase 6 follow-up)
Provider-aware refactor of SubscriptionService (still PayPal-centric, the Stripe webhook bypasses it via a direct user->update)

Highlights

DMS — operational documentation under one roof

A new company-wide document management in /admin/dms. A tree folder structure (sales, brand, legal, ops, …) with file uploads and markdown documents created directly in the app. Inline image upload (paste, drag-drop, file picker), a button toolbar (bold/italic/headings/lists/code/quote), smart Enter in lists, an emoji picker and auto-save of drafts to the server every 30 s.

Documents have a TOC sidebar (clickable anchors from H1–H6 + scroll spy), fulltext search via Ctrl+K (a palette with snippet previews across the whole DMS), syntax highlighting in code blocks (Prism + 30 languages) and mutual cross-references between documents (@document-slug syntax).

Per-folder permission grants for helpers: read / write / admin level. A helper (is_staff) can create documents in folders where they have write+, and delete / manage grants where they have admin. Grants propagate to the subtree (a grant on ops automatically covers ops/inventory).

Documents can have tasks attached (the Tasks section in /admin/dms) — assignee, deadline, status, photo attachment. The "My tasks" widget on /admin (originally on /dashboard) summarizes your own pending tasks for both super_admin and staff.

RBAC — a helper is an `is_staff` flag, not a 4th role

Instead of adding a 4th role (super_admin/manager/member/staff), we promoted staff to an orthogonal flag users.is_staff. Reason: staff can be a manager (data owner) and a member (shared access) at the same time — a boolean expresses this cleanly, an ENUM would force a tradeoff.

Helper canAccessAdminTeam() = isSuperAdmin() || isStaff(). The admin_team middleware lets users into admin landing pages + DMS tasks/items with a grant; a member with is_staff=true sees the /admin My tasks widget + their own documents, but not KPI tiles or /admin/users.

Defensive bypass in the sidebar — isActiveTester() force-enables the menu even if isPlanActivated() regresses. The tester PRO license holds a redemption row + the middleware recognizes it across role types (manager and member).

PWA offline mode — transaction buffer + idempotency

Mobile /quick (quick transaction entry) works offline. A submit while the network is down is saved to a localStorage outbox + a green "Saved offline" banner. When the network comes back, the queue is sent automatically (window online event + visibilitychange to visible + page-load).

The backend is idempotent via client_uuid (UUIDv4 from the browser, UNIQUE per created_by_user_id) — replaying the same transaction after a crash/race returns the existing row instead of creating a duplicate.

/m (mobile dashboard) is now cached by the Service Worker — even offline it shows the last snapshot of accounts + other transactions. Other pages offline → fallback /offline page with pointers to pinnable features.

A global offline banner at the top of the layout (amber when online + pending, slate when offline). The CSRF token is refreshed from <meta name="csrf-token"> before every flush.

Curated admin sidebar

In the /admin dashboard, the categories (People, Billing, Content, DMS, Emails, Settings) are now collapsible and pinnable. Clicking the header expands the list of items, clicking the pin icon adds the category to the left sidebar for admin mode.

When you are on an /admin/* route, the left sidebar replaces the regular app navigation (Records/Plan/Insights/Setup) with just your pinned admin categories. Each category auto-opens if the current page is inside it; otherwise the open/closed state per category is persisted in localStorage.

At the bottom, a "Back to finances" CTA button — exits admin mode back to the classic dashboard. Per-user preference in users.admin_pinned_categories (JSON), legacy default = all pinned.

Notifications — friendly redesign of weekly + monthly + "Send now"

The weekly summary + monthly summary have a completely reworked design (warmer copy, less corporate, locale-aware sentences, internal movements between your own accounts filtered out). Identical pattern in both notifications, shared test suite.

On the /admin/email-templates index, a new "Send now" button — the admin picks a user and the template is rendered for them + sent, without having to wait for a trigger event. In /settings/notifications, an analogous button for testing your own notifications.

Improvements

Dashboard + cashflow

Cashflow risk banner below the hero — a critical alert across scopes (FAMILY / PERSONAL / BUSINESS) if the minimum balance of any account drops below its threshold. Clickable, leads straight to /cashflow with a pre-filtered scope.
Per-account threshold is respected (it stopped being summed across scopes) + the lowest balance is highlighted in the alert. Fixed label duplication.
yearly_goal widget min_col_span 4 → 3 (1/4 width possible on ultrawide).

Mobile `/quick`

Transfer between 2 accounts — if the user has only 2 wallets, clicking "the other" side swaps from/to instead of blocking. With 3+ wallets the behavior is the same as before (disabled = prevents the same account on both sides).
"Add transfer between accounts" CTA — the small 16px swap_horiz icon in the header moved down as a big gradient button (bg-gradient-to-br from-accent-indigo to-accent-purple, visually the same style as "Add new account" in /m/accounts). User feedback: the icon in the header was undiscoverable.
Hidden client_uuid input in the form — generated on init, regenerated after an offline submit for the new tx.

Marketing copy

"The first 50 users get Premium free for 2 years" — unified across the landing waitlist (hero badge, bonus headline + body, meta description), the waitlist confirmation email, auth.register.tester.hint and the historical record in News + changelog v2.1. Previously it said just "Premium free" or "premium access for the duration of testing" — inaccurate given the tester program "PRO for 2 years + feedback after 14 days" defined in the README.
🚀 emoji in the hero badge replaced with 🎁 (matches the Premium gift theme; distinct from ⭐ in the bonus section).

Small things

Footer — gradient T badge removed, only © 2026 Treziqo remains. Saves space.
/admin/users/{id}/edit full-width (drop max-w-4xl).
Onboarding tooltip placement clamped within the viewport (right/left edge).
Main "Administration" link in the user dropdown → /admin (dashboard), not /admin/users (the original target was misleading).
DMS document-show inline delete button → <x-ui.btn> (UI convention).
Admin emails — removed the legal disclaimer banner + added a HelpDesk CTA in every transactional email.

Under the hood

Migrations of the day (11): 2026_05_11_120000 (Premium 2 years copy fix — translations + welcome email body), 190000 (quick.transfer.cta seed), 200000 (transactions.client_uuid + UNIQUE), 210000 (offline.* translations), 220000 (users.admin_pinned_categories JSON), 230000 (admin.nav.* translations).
transactions.client_uuid + UNIQUE (created_by_user_id, client_uuid) — idempotency for offline replay. The UUID is generated client-side (crypto.randomUUID), the backend compares; a cross-user UUIDv4 collision is mathematically impossible.
users.admin_pinned_categories JSON nullable — NULL = legacy "all pinned", explicit array after the first toggle. Cast 'array' + helpers pinnedAdminCategories(), toggleAdminCategoryPin($key).
public/js/offline-outbox.js — standalone module, exposes window.OfflineOutbox.{save, flush, count}. Auto-flush triggers on DOMContentLoaded + online event + visibilitychange. CSRF refresh via <meta name="csrf-token"> before every flush. No IDB or Background Sync — iOS Safari compatibility.
public/sw.js v5 — caches /m navigation for offline reading (network-first + cache fallback), pre-caches the /offline page, navigation fallback. The POST outbox is intentionally NOT in the SW (simpler in client-side JS).
AdminNavRegistry + AdminController::toggleCategoryPin (POST /admin/nav/toggle-pin) — AJAX endpoint, Rule::in($registryKeys) against IDOR.
DMS — markdown editor toolbar component, smart Enter handling in lists, paste/upload of images via an intercepted clipboard event, emoji picker, TOC sidebar built from heading levels, fulltext search index per item (dms_items.searchable_text denormalized).
CI — gitleaks allowlist (false positive from test fixtures), Dependabot ignores larastan major (2.x breaking).
Pre-push hook — memory_limit=512M for Pest (the default 128MB ran out of memory on 500+ tests mid-run).

What's next

Background Sync API for a true background flush of the offline outbox (Android Chrome) — the current implementation requires the user to open the PWA. Possibly unnecessary, most mobile usage is short sessions.
Apple Sign-In (requires a paid Apple Dev account $99/yr + JWT signing via socialiteproviders/apple).
DMS notification rules — task deadlines, inactive document, broken cross-reference.
Admin sidebar drag-and-drop ordering of pinned categories (currently insertion order). Plus per-item pin (not just per-category) as extra granularity.
Tester PRO expiration notifications — email 30/7 days before pro_expires_at + in-app banner.
Test coverage for the 2-year boundary of the tester license + Socialite callback mock + offline outbox flush smoke test + admin sidebar toggle endpoint IDOR test.
Landing whats_new widget texts for v2.3 (currently shows v2.2). Update via /admin/translations.

Highlights

Sign in with Google and Microsoft

/login and /register now have "Continue with Google" and "Continue with Microsoft" buttons. OAuth 2.0 via Laravel Socialite (Google natively, Microsoft via socialiteproviders/microsoft). The multi-tenant Microsoft endpoint covers personal accounts (Outlook, Hotmail, Live) as well as business Office 365 / Microsoft 365.

Auto-link policy: if a Treziqo account with the same email exists and Google has verified it (email_verified=true), it's linked transparently without an interstitial. A Microsoft email is trusted implicitly (the Graph API doesn't return this flag, but the primary mail and aliases go through MS verification).

A new OAuth registration = plan = BASIC + a 14-day trial (mirroring the standard email registration). After the trial, the EnsurePlanActivated middleware opens /checkout for you. 2FA is respected via RequireTwoFactorChallenge — if you have it turned on, you go through the challenge even after an OAuth login.

Connected accounts in Settings

In /settings → security there's a new "Connected accounts" section — an overview of OAuth connections (Google, Microsoft, later Apple) with the provider's email + the date of last use. You can disconnect (requires your current password, mirroring sessions/revoke), or add another provider with the "Connect Google/Microsoft" button.

Unlink trust mechanics: if you explicitly disconnect a provider, the next sign-in attempt via that provider won't let you back in through auto-link — instead you get the message "you previously disconnected it, sign in with your password and connect it in Settings". Without this guard, unlinking would be toothless.

Plus an audit history — every connection / disconnection of a provider is recorded in "Account history" (at the end of /settings → security). You can see when Google was first linked (automatically vs. manually), when someone disconnected it, when Microsoft was added. It serves as an informative trail against a third-party provider being added unnoticed.

Mobile app — account creation, per-day balance and onboarding

Three improvements to the mobile hub /m:

/m/accounts/create — a lightweight 3-field form for creating your first account (bank + currency + opening balance). Intentionally not the desktop modal with 12 fields (IBAN, SWIFT, company ID, icon, color, …); mobile = minimum clicks. The "Add new account" button is always on /m/accounts and conditionally on /m (only when the user has no account — typically after wiping demo data).
Per-day balance in /m/transactions — next to the date of each group, the day's total is shown. A green + for a surplus, a red − for a deficit; mixed-FX groups hide the balance (it wouldn't make sense). A quick overview of whether the day ended in profit or loss.
Onboarding step "Your profile & Settings" — the guided tour now also shows you the user menu in the bottom-left corner (avatar/name → links to /settings, /notifications, log out). Mobile users often look for where to enter their details and password.

Tester PRO license for 2 years

Tester registration codes now grant PRO for 2 years (tester_redemptions.pro_expires_at = redeemed_at + 2 years, backfill for existing records). After expiration, User::isActiveTester() returns false and the EnsurePlanActivated middleware sends you to /checkout (you have to pay for BASIC/PRO, otherwise FREE). The audit record stays in the DB.

In /admin/testers there's a new "PRO valid until" column with a color indicator (red = expired, amber = approaching, gray = OK).

The welcome email is split into two variants:

welcome template (regular registration) — info about the demo data (~130+ transactions, previously it inaccurately said ~42), the way to /settings.
welcome_tester template (NEW) — its own text without mentions of the 14-day trial / PayPal, with the info "PRO free until {pro_expires_at}" instead.

Mentions of PayPal-specific payment methods were removed from welcome (the wording "you'll complete the payment" — more robust for future payment methods).

Improvements

Emails

Template key tracking for all 16 notifications. A new trait AppliesTemplateKey in app/Notifications/Concerns/ adds the X-Email-Template-Key header automatically. The admin /admin/email-log no longer shows template_key=unknown, but the specific template (welcome, helpdesk_reply, payment_received, …).
Recipient parsing fix. The LogSentEmail listener read array_keys($to)[0] on an array of Symfony Address objects → numeric index 0 → the admin saw the recipient as "0". Fix: Address->getAddress() with a string fallback.
Backfill of historical records. Migrations 080000 + 100000 filled in recipient='0' for pre-fix entries: helpdesk_reply from helpdesk_replies.sent_to_email (via a ±60s time-window match), welcome / registration_verify from users.created_at (only a unique match → update; ambiguous ones skipped as '0').
Waitlist confirmation email — removed the "Before we launch" section with a link to /preview (the link was internal and shouldn't have been in a public email).
Mobile grid for /admin/email-log — a reworked layout for small screens (template badge + recipient + subject columns at better breakpoints).

Admin

/admin/users "Last seen" column (formerly "Last login") with new semantics — it's updated on every authenticated request (5-min throttle via Cache::add), not only on a typed-credentials sign-in. An active mobile user who opens the app every day but doesn't sign in again (remember-me cookie) no longer has a value that's 7 days old.
Admin nav — "Testeři" → "Kódy" (CS) / "Testers" → "Codes" (EN). A more generic name for future code types (referral, promo).
/admin/email-log recipient column — if the email matches an existing user, their nick + a link to /admin/users/{id}/edit is shown next to the plain email (1 batch query per page).

Wizard / forms

"I have a code" in /register — the toggle renamed from "Mám tester kód" / "I have a tester code" to the generic "Mám kód" / "I have a code". Future-proof for promo / referral / discount codes.
"Goal of the period" dashboard widget — minimum width 1/3 → 1/4 (3 of 12 cols), so you can fit more widgets side by side on an ultra-wide display.

Privacy v2.1

Google LLC added to the table of processors (§7.2) with an opt-in note: data goes to Google only if the user voluntarily uses Sign-In. §3.3 (authentication data) extended with the OAuth provider ID and the email_verified flag. §8.2 mentions US transfer mechanisms. Microsoft Corp. is planned for the next privacy update, v2.2 (after stabilization on PROD).

Under the hood

Migrations of the day (10): 2026_05_10_010000 (waitlist email cleanup), 020000 (tester_redemptions.pro_expires_at + 2y backfill), 030000 (welcome_tester template + demo data hint seed), 040000 (demo transaction count fix), 050000 (PayPal mention removed from welcome), 060000 (admin nav rename), 070000 (users.last_login_at add), 080000 (email log v1 backfill), 090000 (last_login_at backfill from login_history), 100000 (email log v2 backfill — helpdesk_replies + users time-window), 110000 (rename last_login_at → last_seen_at), 120000 (oauth_accounts table), 130000 (Privacy v2.1 update).
oauth_accounts table — a (provider, provider_id) unique constraint guarantees that the same Google identity can't link 2 different Treziqo accounts. A per-row email_verified flag + last_login_at per provider.
TrackUserActivity middleware — Cache::add 5-min throttle, no extra DB read on the users table (the auth user is already loaded by the Authenticate middleware).
Pre-push hook bump — Pest runs with memory_limit=512M (the default 128MB ran out of memory mid-run at 500+ tests). Aligned with the Larastan step.
Sentry capture for OAuth errors — an explicit \Sentry\captureException in the flow catches callback failures (invalid_client, expired secret, scope problems) with a full stack trace, instead of Log::warning swallowing them.
Drop legacy build pipeline — Vite, PostCSS, Tailwind config, server.php, dead Laravel scaffolding (Channels, BroadcastServiceProvider, ExampleTest, public/js/app.js 19,763 lines of dist code, public/css/app.css) removed after the switch to the Tailwind CDN runtime. -19,887 lines.
Larastan dead branch fix in LogSentEmail (is_string($first) && $first !== '' was a dead branch per the Symfony stubs — getTo() is array<Address>, never a string).
5 new tests — tests/Feature/Auth/OAuthUnlinkTest.php (IDOR guard, current_password gate, audit event, settings render). In total 512 tests, 1,467 assertions in 47 files.

What's next

Apple Sign-In as the next OAuth provider (requires a paid Apple Developer account + JWT signing). A Privacy v2.2 update with Microsoft Corp. among the processors, now that Microsoft is live. Tester PRO expiration notifications (email 30/7 days before pro_expires_at + an in-app banner). Test coverage for the 2-year tester license boundary + a Socialite callback mock.

Highlights

Waitlist landing page

A new home page ahead of the public launch — a Hero with a mock dashboard, a problem comparison, 3 features (cashflow forecast, scenarios, AI assistant), audience cards, how it works, a bonus "Premium free for 2 years for the first 50", a trust block, FAQ and a final form with segmentation (what you're dealing with / who you are). The full "app preview" version moved to /preview (noindex, reachable by URL for selective sharing). After the public launch the content will return to /.

HelpDesk

A public form at /helpdesk (auth-aware — a signed-in user gets a pre-fill, a guest fills in everything). An admin grid in /admin/helpdesk with filter pills per status, a detail with the reply chain, an inline reply form. The client gets an immediate auto-confirmation ("we've received your request, we'll get back to you within a few hours") and admin replies go straight to their email. The ticket history shows up in /admin/users/{id}/edit. If the user fills in a phone number, it's saved to their profile.

LinkedIn integration + Social Media hub

A new tab /admin/social as a hub for social networks. LinkedIn is live — two OAuth apps (personal profile + the Community Management API for company/Showcase pages), a modal in /admin/articles with multi-target publishing + editable text. Placeholders for Instagram, Facebook, X and TikTok are ready for future integrations.

Updated legal documents

Terms of Service, Privacy and Cookies are all at version 2.0, effective from May 8, 2026. Privacy explicitly names the real processors — Hetzner DE (hosting), SvetHostingu CZ (SMTP), PayPal LU (payments), Sentry US (monitoring with GDPR scrubbing), Anthropic US (Claude AI), OpenAI US (DALL-E hero images). Details on HSTS, SSL Labs A+, the retention timeline, the AI opt-in toggle, the ÚOOÚ contact.

Marketing consent at registration

A second optional checkbox in /register — consent to receive news. The audit records when + from which IP + when withdrawn + from which IP. In /admin/users/{id}/edit the admin sees a block with timestamps and a "Revoke consent" button. After withdrawal, consent_at stays as an audit record (GDPR Art. 7).

Improvements

Email audit log — /admin/email-log shows what the app sent to whom (template + recipient + timestamp, no body content). A listener on the Laravel MessageSent event.
Auto-generation pause — the admin in /admin/articles can pause the daily cron for News Radar. The RSS fetch keeps running, and so does the manual "Generate".
Tester code admin management — a "Codes" section in /admin/testers for create/edit/deactivate. A code is immutable after creation, max_redemptions can't be lowered below redeemed_count.
Confirmation email after waitlist signup — a DB-backed template in /admin/email-templates, a signed unsubscribe link (per-IP GDPR audit).
419 Page Expired prevention — the landing page is no longer cached (it shared 1 CSRF token among everyone), a JS pre-submit token refresh for long-lived tabs (/register/verify), a branded errors/419.blade.php as a fallback.
Cookie banner — dark mode support + new text in line with the current policy (only essential cookies, no tracking).
Legal documents dark mode — all inline styles in legal/show.blade.php have html.dark overrides (headings, code, blockquote, table, hr).

Under the hood

Larastan baseline 1 → 0 entries (the Audit Sprint 2 goal achieved — WidgetRegistry::default_item_count dead code removed).
LinkedIn DB layer per platform (no generic ENUM) — different OAuth scopes and target types would make an abstraction leaky.
Email templates pattern: EmailTemplate::REGISTRY maps key → notification class + category + trigger description.
HelpDesk: helpdesk_replies.sent_to_email snapshot (audit even after the user's email changes).
9 new test suites (HelpDesk × 11, Waitlist × 17, AuthFormSmoke × 5, LinkedinIntegration × 18, TesterCodeAdmin × 10) + a smoke gate against UI regressions in the guest layout.

What's next

LinkedIn credentials rotation + deployment to the PROD .env (from FTP/Forge); Forge Quick Deploy will run the migrations with an automatic seed of the new translations + email templates. After the deploy, test: registration with the marketing checkbox, waitlist signup with the confirmation email, HelpDesk submit + admin reply, /admin/social/linkedin Connect.

Treziqo v2.0 — Investments Phase 2, three dashboard widgets, form refactor

A major bump, because investments get a complete second layer: tracking the number of units, automatic price pulls from CoinGecko, time-series charts with XIRR, historical backfill of valuations. Plus three new widgets on the dashboard (net worth, crypto prices, goal of the period) and a unified form layout for editing investment products.

Highlights

📈 Investments — Phase 2 complete

Five steps finished in one day — the investment module now has the same depth as transactions / cashflow.

Step A — Units tracking & initial holdings: on a product you can enter the initial number of units + date + value (optional, all-or-nothing for the 4 cost-basis fields, or just the units alone). Contributions gained a units field for tracking purchases of ETFs/stocks/crypto unit by unit.
Step B — CoinGecko autocomplete + daily pull: for crypto products you pick the coin via a search field (BTC, ETH, …), a daily cron downloads the current price and creates a valuation. No manual "Refresh price" on an ordinary day.
Step C — Cost basis counts initial holdings: the analytics chart "Contributed" includes units_initial_value (= the starting cost basis from before Treziqo)
- subsequent contributions. Without this, a user who has 0.5 BTC from the past would see 0 on the left of the timeline.
Step D — XIRR per portfolio: money-weighted annualized return like Excel's XIRR — Newton-Raphson + bisection fallback. Shown in the stats strip right next to Yield % ("the actual annual return accounting for the timing of deposits"). No separate window, no cookie consent dialog.
Step E — Historical backfill of valuations: after you fill in the CoinGecko coin
- units_initial_date, a queue job (BackfillCryptoHistoryJob) downloads the entire daily price chart history and creates valuation rows. A realistic value(t) = holdings(t) × price(t), not a flat extrapolation.

📊 Net worth widget on the dashboard

"Are you getting richer or poorer?" in one metric. The hero card adds up cash, investments and liabilities across all currencies (FX conversion into your portfolio currency):

Cash — bank accounts (investment and liability accounts excluded, so nothing is counted twice)
Investments — either the latest valuation or the cost basis fallback
Liabilities — the current remaining principal

Click into dashboard edit and you'll find it as "Net worth". For those who had liabilities and investment products spread across Revolut, KB, mintos and a crypto wallet, it's the first place with one number that makes sense.

🪙 Crypto prices widget

A conditional widget — it appears only when you have at least one crypto product linked to CoinGecko. For each coin: icon + symbol + price in your currency

24h change %. Cached for 30 min, no spam for the CoinGecko API.

🎯 Goal of the period hero widget

It takes your largest active SAVING budget and builds a big motivational card from it. You see:

how far you are from the goal (progress bar)
how much of the period has passed (a separate time bar)
a verdict: "On the ideal pace", "Ahead of pace by X", or "Behind by Y, still Z to the goal"

It hides itself if you don't have a SAVING budget.

🎨 Form layout refactor — investment edit

/investments/{id}/edit had grown with auto-pricing, units_initial, tags and was starting to get chaotic. The new layout:

2/3 main content: Basic details, Currencies and account, Classification, Auto-pricing (crypto), Initial holdings, Additional
1/3 sticky side panel: Visual (icon + color), Status (active + order)
Footer: Cancel | Save

Each section uses the <x-ui.card> component, dark mode throughout. Ergonomics similar to Stripe / Linear edit screens.

Improvements

Analytics scoped to a product uses the product's native currency (one product in EUR → chart in EUR, not CZK). No FX mismatch with the product's show card.
"Compute from CoinGecko" removed from the Initial holdings section — it was confusing, because it computed current_price × units (= the current value) and saved it into units_initial_value (= the historical cost basis). Result: the cost basis was overwritten with the current value. For a current valuation, use "Refresh price" on the detail page.
Quick-add cards (Deposit/Withdrawal/Valuation) on the detail page no longer stretch vertically when open (items-start instead of the CSS grid default stretch).
The filter on /analysis is collapsed by default — you see the preset pills, the scope filter (accounts/categories/tags) is under the "Advanced filter" toggle. Matches the UX of /transactions.
Per-institution totals in the investments widget — when you have several products from the same bank, grouped totals are shown.
CoinGecko attribution across the module according to the brand guidelines (mandatory when using their data).

Fixes

Net worth "Cash" double count — investment accounts were counted separately in cash AND their products again in investments. Filter is_investment=false in cashAt() + cache key bumped to :v2.
The Yearly goal widget called a non-existent budgets.show — TREZIQO-3 on Sentry, a dashboard 5xx for users with a SAVING budget. Changed to budgets.edit.
Contributions before units_initial_date were double-counted in the cost basis (they were added to units_initial_value). Filter in InvestmentAnalyticsService::fillBucketsForProduct + a sister filter in buildPortfolioCashflows and buildObservations.currency_skew.
CoinGecko Demo vs Pro tier — the wrong auth header for the given tier returned 401. Auto-detection from services.coingecko.api_key + tier config.
Dark mode readability in investments — chart axis, labels, muted text, auto-pricing block, units_initial block, currency cards.
The AI insight on the dashboard was alarmist (it wrote "worth paying attention to" about numbers that were normal). The system prompt now has a "CAUTION RULES" section — no derived metrics, no alarmism unless the budget status is warning/over.
Git push via the Windows OpenSSL bundle switched to schannel (the Windows native cert store) — permanently fixes "unable to get local issuer certificate" without a TLS bypass.

Under the hood

NetWorthService — a new service, on-the-fly summary (cash + investments
- liabilities, FX via FxConverter latest mode). Cached 1h per user. The 12-month trend chart is intentionally left out of v0 (the N+1 detector flagged iterative queries) — it will come in v2.0.1 with batch SQL or cron-driven snapshots.
CryptoPriceService::marketSnapshot — the batch /coins/markets returns price + 24h change + image URL in a single call (vs. 2 requests originally).
Form refactor via the existing <x-ui.card> + unified $inputCls / $labelCls / $hintCls fragments. No custom wrapper, dark mode throughout via brand-* / accent-* tokens.
units_initial_value=0 semantics — if a user fills in zeros in the cost basis fields, analytics ignores the initial filter (= cost basis = sum of contributions). Without this, contributions would be skipped en masse.

What's next

Net worth trend chart (12 months or more) — requires a persisted snapshots table + a daily cron, not live computation.
Pest 2 → 3 upgrade.
Net worth widget chart, once we have historical data to show.

Treziqo v1.19 — Sentry monitoring, savings for investment products, analysis filter rebuild, mobile drilldown

A day of two tracks: seeing what's happening on PROD (errors, availability, release linker) and improving the everyday flow through the app — a smarter filter in Analysis, unified transaction entry on mobile, a savings goal linked directly to an investment product. Plus progress on the audit infrastructure (Larastan baseline 102 → 1).

Highlights

🛡️ Sentry — error monitoring on PROD

Treziqo now knows when something breaks on PROD, without you having to watch the logs. Sentry catches runtime errors with a GDPR-safe scrubber (no emails, passwords, 2FA codes or PayPal data in the reports), and the release linker connects an issue directly to a specific commit hash.

A bonus reassurance: today the /quick page broke after a deploy (a Blade compilation error in a duplicated @foreach) — Sentry caught it within 1 minute with the exact stack trace. Without it nobody would have seen it until someone complained. The hotfix was deployed within 5 minutes.

💸 Savings budget linked to an investment product

A savings goal (emergency fund, DIP, vacation…) can now be linked directly to a specific investment product. You see in one place:

how much you've saved (the real balance from investments)
how much is left to reach the goal
when you'll hit the goal at your current monthly contribution
a hierarchical breakdown — you can have a "Car" goal with sub-goals (down payment + 1st year of fuel).

In /budgets the "Goals" section is split by type (cash vs investments), and the chart on the dashboard reacts to a negative balance (savings rate < 0 → red).

🔍 Analysis filter — a complete redesign

The /analysis filter had a different format than /transactions — unified today. Key changes:

Categories have icons and a grid layout (like the transactions filter, not a text dropdown)
The top 14 most used are shown by default, "Show all categories" expands a grouped grid (expense + income mixed, frequency desc)
Tags can finally be filtered (chip toggle with colors from the palette)
Hidden accounts are hidden from the list by default, the "Show hidden accounts (N)" toggle brings them back. Selected hidden accounts from the URL stay visible.
"Apply filter" button — previously you could only submit by clicking a period pill.

📱 Mobile dashboard — drilldown to an account

Clicking a specific account in /m jumps straight to /m/transactions filtered to that account (previously it was a jump anchor to /m/accounts). The plus button in the /m/transactions?account_id=X header carries the filter over to /quick — the wallet is pre-set to this account's first wallet, so you don't have to pick it at the bottom.

The "My accounts" header is now a clickable link to /m/accounts (with a chevron indicator).

🏷️ Mobile /quick — more tags within reach

In quick entry, the top 10 tags were visible by default. If you have more (e.g. the starter set has 13 investment purpose tags), the rest was hidden. Now there's a "Show more tags (N)" toggle — analogous to "More categories".

Improvements

The news article disclaimer moved from AI generation to a render-time block in the view. It's no longer stored in the DB for every article (the identical text was a needless row), and the Claude prompt has a few tokens fewer.
Sentry release linker — Forge Quick Deploy exports SENTRY_RELEASE with the commit hash, so every issue in the dashboard has a clickable link to the specific commit + diff.
UptimeRobot public callout next to SSL Labs A+ on /security — users see that we have external uptime monitoring (not just an internal health check).
The budgets dashboard widget reacts to the negative status (savings rate < 0 → red instead of "On track").
Investment contribution contribution_date stored as DATETIME (previously DATE — the time was lost for historical records).
The /transactions filter uses the shared category grid component (single source of truth with /analysis, ~70 lines fewer).

Fixes

/quick 500 on PROD (TREZIQO-2) — Blade compilation of @php $palette = ...; @endphp inside a duplicated @foreach generated broken PHP. Hotfixed by extracting it into an <x-quick.tag-chip> component (outside the foreach scope).
Pre-existing broken @click in the import_export wizard categories (@php(...) with nested closures + unpaired }}/{{) — fixed to the {!! json_encode(...) !!} pattern.
News Radar disclaimer — stripped from existing articles in the DB (idempotent migration, new render-time block).

Under the hood

Larastan baseline 102 → 1 (-99 %) in 7 commits, deterministic category-by-category cleanup. Real bugs found during the cleanup:
- MobileHomeController iterated a JSON column as an Eloquent relation (= /m/ai would have crashed)
- SettingsController GDPR export loaded a non-existent currencies relation
- 13 lines of dead code in FinanceTools::runForecast
Pre-push hook 4/4 — after view:cache, run php -l over all rendered compiled views. Laravel's view:cache didn't report per-file parse errors (it ended "successfully" even for broken ones). The pre-push hook would have caught today's TREZIQO-2 before the push.
16 new smoke render tests — /quick, /quick/transfer, /budgets(+create), /accounts, /investments(+create), /liabilities(+create), /transfers, /settings(+notifications+tags), /family, /notifications. Pest 369/369 ✓.
<x-form.category-multiselect> + <x-form.tag-multiselect> — shared components for the filter UX (analysis + transactions).

What's next

Active filter chips outside the collapse panel in /analysis (the way it is in /transactions)
Hidden accounts toggle in /transactions too (the same bug, just elsewhere)
Pest 2 → 3 upgrade
Larastan 1 → 0 (the last WidgetRegistry default_item_count baseline entry)

Treziqo v1.18 — Multi-currency portfolio + FX rates + tracking-only investments

A day about portfolios across currencies: Treziqo now downloads exchange rates from the ČNB and the ECB on its own, adds up your investments in the currency you choose, and lets you record deposits/withdrawals even without a physical transfer from an account (pension savings, historical backfill, payouts outside the bank). Plus the whole audit sprint 2 brought to completion — DB integrity, audit gates, the FormRequest pattern across 12 controllers.

Highlights

💱 Multi-currency portfolio

On /investments there's a new "Total portfolio" widget with a currency picker. Choose CZK / EUR / USD / PLN — all investments are converted at the current rate and you see one overall total.

Next to the currency code in the per-currency boxes there's also a live rate: "EUR = 24.5200 CZK", so you always know what the calculation was based on. Switch the base to USD — the rates are recalculated (CZK = 0.0470 USD, EUR = 1.0300 USD).

If a rate for some pair is missing, a ⚠️ warning appears (typically an exotic currency outside ČNB + ECB coverage).

📈 FX rates from the ČNB and the ECB

Every day at 16:00 Treziqo downloads rates from two official sources: the Czech National Bank (daily fixing around 14:30 — the reference value for Czech accounting) and the European Central Bank via the Frankfurter API (EUR-based reference rates).

Rates are stored historically — a new row per pair every day. That opens up a future feature, "portfolio chart over time" (how exchange rate swings affected the value of your portfolio over the past year).

🐖 Tracking-only investments

The deposit and withdrawal form on the product detail now has a "Tracking only (no bank transfer)" checkbox. Use it when:

Your employer sends a pension contribution outside your bank account
A pension payout goes to an external account
Historical backfill without a physical movement

The record is saved to the investment's history, but it doesn't create a fictitious transfer at the bank.

🗂️ Investments — archive, filter and bulk actions

Filter by investment type — the chip strip shows only the types you have set up (ETF, crypto, savings, …). A click filters the list and the totals.
Archived vs active — products that have served their purpose (paid-out pension savings, sold ETFs) are archived instead of deleted. The default list shows only active ones.
Bulk archive — multi-select in the table + a sticky action bar at the bottom.
Auto icons — a new product gets an icon based on its type (pension savings = 🐖, crypto = 🪙, ETF = 📈, …) without manual clicking.

🛒 Transactions — amount from/to + bulk delete

The filter panel has 2 new inputs: Amount from / to (accepts the Czech format with a comma or the standard one with a dot).

In the bulk action panel (the one that opens after you select transactions), next to changing the category and adding a tag, there's a new red "Delete selected" → a modal with email confirmation → soft delete to the trash. A safeguard against mistakes with a large selection. You can restore from the trash within 30 days.

💾 Our own database backups

Treziqo now makes a daily mysqldump (3:00 a.m.) with a retention of 14 days / 8 weeks / 6 months. In /admin/backups you have a UI with the history + the option to download a backup manually. No paid Forge service, our own implementation.

Improvements

Faster dashboard — 10 redundant queries (currencies + account_currencies fan-out across widgets) merged into 2 fixed queries per request.
A+ on SSL Labs achieved (HSTS + bonus security headers). Public security badge on /security.
The /security page split into 9 smaller cards (HTTPS, passwords, encryption, 2FA, GDPR, audits, …) with full markdown support.
Investment contribution in the history shows date + time (previously only the date because of the DATE column type — fixed to DATETIME).
Bulk actions on investments — multi-select archive works the same way as for transactions (sticky action bar at the bottom).
Tracking-only forms have hidden inputs with x-bind:disabled — fixes an HTML5 form validation race condition (the form couldn't be saved because of a "hidden" required field).
The confirm dialog modal no longer breaks on a narrow viewport (mobile / zoom).

Fixes

FK audit on prod — we discovered 50 missing FK constraints in the production DB (how they disappeared is unknown). A repair migration cleaned up 16,930 orphaned rows (deleted users, dead tags, …) and added all FKs back according to the migration definitions. A stealth bug for several months — everything needed for a rollback is in the daily backup.
News Radar — CS article doesn't match EN — Claude sometimes picked a different master story from the RSS feeds for the CS version. Fix: a master anchor in the CS userMessage keeps the same story.
Admin News "generate article" double-click created 2 concurrent dispatch jobs (= 2× cost). A 90s Cache::lock prevents it.
Investment withdrawal "Tracking only" couldn't be saved (HTML5 form validation blocked the submit).
Currency picker dropdown opened below the whole card instead of below the button (a relative ancestor was missing).

Under the hood

Audit Sprint 2 completed — all gates (gitleaks, composer/npm audit, Larastan level 5, UiConventionTest, rate limit audit, pre-push hook, N+1 detector, component catalog) in operation. 12 controllers + 15 FormRequest classes with the Rule::in($accessibleIds) IDOR pattern.
fk:audit + fk:orphans-check artisan commands for future FK regression checks.
Larastan baseline 151 → 116 errors (the target was 125, we got below it). No behavior change, just dead null guards / nullsafe on non-nullable / @var phpdoc.
347 tests green (up from 285 before the audit).

What's next

Portfolio chart over time (FX history is already being collected daily)
CSP (Content-Security-Policy) — a separate sprint
Pest 2 → 3 upgrade (phpunit dev-only CVE)
Larastan 116 → 80 (remaining errors in computed columns / array shapes)

Treziqo v1.17 — Notifications Phase 2 + audit + News Radar pipeline

41 commits split into three main themes: Phase 2 of notifications with new kinds and control levers (snooze, quiet hours, templates), a mobile transaction editor unified with the quick entry /quick, and a big audit sprint 2 — security automation in CI, four real CVEs removed, and the News Radar pipeline tuned for stable daily article production.

🔔 Notifications Phase 2 — more kinds, a calmer channel, opt-in from the module

Phase 1 (v1.16) introduced the framework. Phase 2 adds the ones users were waiting for most, plus dampers and ergonomics.

New notification kinds:

Low account balance — "Send me an alert when the balance on my main account drops below 5,000 Kč." Works per-period armed/disarmed (no spam, only on the transition across the threshold), with a first-tx fix for brand-new accounts.
Loan installment in X days — "Remind me of my mortgage installment 3 days ahead." Per liability or globally across all of them.
Recurring payment executed — "Let me know when the Netflix subscription is recorded automatically." Per recurring item or as a group.
Monthly report — total spending for the month + top 3 categories + comparison with the previous month. First Monday of the month at 8:00.

Control levers:

Templates when creating a rule — instead of an empty form you click "Large expense over 10,000 Kč" / "Monthly report" / "Liability installment in 3 days" and a sensible setup is prefilled. Fewer decisions.
Snooze a single notification — in the inbox you click "Snooze" (1h / 1 day / 1 week) and the notification comes back to you when it's relevant.
Quiet hours — "Let me sleep at night." The email channel remembers a window (e.g. 22:00–07:00), collects notifications during it and delivers them in the morning. The in-app inbox always runs.
Per-module shortcut — on the account / liability / recurring detail there's a "Notify me" button that opens the wizard with a prefilled scope. No trips through /settings.

Inbox improvements:

History filter by kind + period (last 7 days / 30 days / custom range)
Resend the verification email to an external recipient if the first link expired (click from /settings)

📱 Mobile transaction editor — editing like quick entry

Editing an existing transaction on mobile copies the /quick pattern: a minimalist screen, a category picker chip strip with drill-down into subcategories, no popup picker. If you need something unusual (semantic_type, tags, transfers), there's an escape hatch to the full desktop version.

Plus mobile cleanup:

/m/accounts as a mobile view — a transaction filter from the account page with a notification shortcut in the hub
Footer Blog link hidden on mobile (it took up an extra row)
Added translations for the amount/category labels in the edit form
A small ring-2 fix on the category chip, which bled into the label

🛡️ Audit sprint — security automation in CI + 4 real CVEs removed

Audit sprint 1 introduced automation for what used to be manual:

gitleaks — secret scan in every PR and in main's history, default rules for AWS / GCP / Stripe / PayPal / Anthropic keys
composer audit + npm audit — CVE check in CI, fail-loud on high+critical advisories. The first run immediately caught 5 real CVEs → Dependabot opened PRs automatically
Larastan level 5 in CI with a baseline of 151 errors (don't make it worse, reduce it gradually)
Dependabot weekly — Monday auto-PRs for composer / npm / GitHub Actions, minor+patch grouped, major separately

Audit sprint 2 resolved real findings:

psy/psysh LPE CVE fixed via laravel/tinker 2 → 3
vite 10 advisories (path traversal, server.fs.deny bypasses, WebSocket file read) — vite 6 → 8 + plugin v3 + npm-minor-patch atomically
rollup Path Traversal — fixed transitively via vite 8
postcss XSS — fixed transitively via laravel-vite-plugin v3
@tailwindcss/vite removal — a dead runtime dependency, used nowhere (the build chain runs purely through PostCSS), needlessly pulling the vite chain into the prod surface

After the sprint: production runtime CVE risk = 0. The npm prod tree is empty (pre-built assets), the composer prod tree is clean. The remaining phpunit CVE is dev-only (never installed on PROD thanks to composer install --no-dev), tracked for a follow-up sprint.

📰 News Radar — a stable daily pipeline and observability

The daily pipeline (RSS triage → Claude scoring → Claude article writer → admin review) got three key fixes:

A dedicated log channel news-YYYY-MM-DD.log with structured events (started, triage_started, items_selected, article_created, claude_invalid_json, cs_translation_created, failed, …). The morning triage of "why wasn't an article generated" takes a tail -100 instead of SSH detective work.
Per-job timezone on the schedule — dailyAt('07:30') now runs exactly on Prague time regardless of DST or the application's UTC.
Anthropic API timeout 60 s → 180 s + retry — it repeatedly failed with cURL 28 (a triage batch with 40 items × ~10k input tokens really takes 30–80 s). Configurable via the ANTHROPIC_TIMEOUT env, the retry pattern applies only to network errors (cURL / DNS / TCP), 4xx/5xx are not retried.

Source cleanup (v3 + v3.1): disabled non-working / commercially risky ones — BBC Business (T&C: non-commercial RSS), Reuters Markets (404 + Reuters Connect license required), CNBC (anti-bot 403), ČNB Aktuality (404), OECD (403), IMF News (0 items), BIS / FSB (parser limitation with the dc:date namespace), Finextra Regulation slug. Kept the working institutions (ECB ×8, Eurostat ×2, ESRB ×2, EBA, Fed ×4, BLS ×3, BEA, CFPB, SEC ×2, FINRA ×2, BoE ×3, Finextra Headlines/Payments/Retail, ČNB Press EN, ČNB cnBlog, Měšec.cz). Plus the admin /admin/news-sources now filters to active by default, with a tab for paused ones for auditing.

Diagnostic columns on news_sources (last_fetch_http_status, content_type, body_sample, items_before/after_filter, drop_reason) — after every fetch the admin sees where the data got lost, instead of a plain "0 items".

🛠️ Under the hood (interesting for developers)

C2 FormRequest pilot — StoreTransactionRequest + UpdateTransactionRequest as a template for the gradual refactor of 35 controllers with inline validate(). 13 security-focused tests (IDOR × 3, mass-assignment, authorization × 2, validation × 3, tag ownership × 2, happy path × 2). Tests: 285 → 317 (+32 tests, +52 assertions).
Per-job timezone override in the scheduler vs. the global APP_TIMEZONE — keeps the application in UTC internally, only the news cron runs on Prague time. Fewer surprises.
composer audit --no-dev in the CI workflow — symmetry with npm audit --omit=dev, silences dev-only CVE noise (phpunit via pest), real CVEs in require still fail the build.
docs/claude/audit-2026-05-04.md §8 — captures the P0 + P1 audit conclusion as a permanent audit trail.
8 PRs merged today (#11–#18) plus 8 commits directly to main (gitleaks fix, package-lock cleanup, audit doc, …).

What's next

BIS / FSB parser fix — the debug columns after the first PROD fetch will reveal the specific namespace issue (dc:date, atom prefix), then extend the parser.
/admin/system log viewer — an admin UI with a log tail (news / mail / paypal / laravel) and queue state, so diagnostics don't need SSH.
Pest 2 → 3 upgrade (PHPUnit 11+) — a definitive fix for the phpunit CVE in the dev surface.
B1 + B3 UI guideline — rules for <x-ui.btn> / <x-ui.card> / <x-ui.badge> + a real migration of 3–5 statuses as a reference implementation.
Larastan baseline 151 → 125 — gradual reduction by category (parameter types, nullsafe, missing return types).
World Bank API fetcher + IMF/OECD scraper — extending News Radar with non-RSS sources.

Treziqo v1.16 — Notifications + SEO + security

A big day. 48 commits across three main themes plus smaller things: our own notification system with an opt-in flow, a complete SEO baseline (sitemap, JSON-LD, per-locale OG cards, hreflang), a security audit + 5 fixes + a binding security.md standard, and a pile of UX polish on the landing page, /security, /news and /settings.

🔔 Notification system — your own rules for your finances

Centralized in /settings → Notifications. You set up rules for which notifications you want to receive and where.

What Phase 1 can do:

Budget exceeded — "Send me an alert when food goes over 80 % of the budget". Works per-period armed/disarmed — it fires only on the transition across the threshold, so there's no spam if the budget keeps climbing. It re-arms at the start of a new month.
Large transaction — "Notify me when more than 10,000 Kč leaves my main account". Per-account, per-direction (income/expense/both), per-currency.
Weekly report — every Monday at 8:00 you get an email with totals, your top 3 expense categories and the number of transactions for the past week.

Channels: in-app inbox (the bell at the bottom right, a badge with the unread count) + email. External recipients (e.g. a partner) go through an opt-in flow — they get a confirmation email with a 24h token, and only after they click do notifications start arriving. No Treziqo-as-spam.

Pause / delete / edit at any time. Soft delete with notification history.

Planned for Phase 2: low account balance alert, liability installment due in X days, monthly report, per-module shortcuts (a "Notify me" button on the budget / account detail).

🔍 SEO baseline — Treziqo visible in Google and in social shares

A comprehensive rebuild of the SEO infrastructure according to our own binding standard (docs/claude/seo.md):

/sitemap.xml — the canonical list of public URLs for Google (16 pages, daily-cached).
robots.txt — Disallow for non-public paths (admin, dashboard, settings, mobile hub) + Sitemap directive.
<x-public-head> + <x-seo-meta> unified components for SEO meta — title, description, canonical, robots, OG, Twitter Card, JSON-LD, hreflang. Applied to landing, news, security, legal, blog.
JSON-LD structured data — Article / NewsArticle schema on articles (Google Rich Results / Top Stories eligibility), WebSite + Organization on the home page (knowledge panel signal), WebPage on legal pages.
Per-locale OG cards 1200×630 — beautiful brand card previews when sharing the homepage / security / news. CS version for Czech Twitter, EN for global.
Hreflang mapping CS ↔ EN on all public pages (articles, blog index, landing, news, security).
/admin/seo panel — admin editing of SEO copy per page (homepage / news / blog / security) per locale with character counters + global OG image upload.
Article SEO columns — seo_title, meta_description, og_image_url as a separation from the visible H1/lead. The News Radar pipeline (ArticleWriter) generates both sets automatically.

As of today: Treziqo has a verified Search Console property + submitted sitemap (GSC tab /sitemap.xml). The first crawl + indexing is in progress.

🛡️ Security audit + 5 fixes + a binding `security.md` standard

A full audit by 5 parallel specialists (auth/authz, injection, external surfaces, XSS, crypto/secrets). Result: 5 findings fixed + rules formalized in docs/claude/security.md.

Fixes:

2× Stored XSS — raw output of recurring_items.icon in the inbox (manager → member XSS via a 40-char string bypassing the icon picker) and a categories.name JSON breakout in <script> blocks (a 49-char </script><script>...</script> payload in a max:100 field). 41× json_encode in Blade replaced with @json.
GDPR PII in the PayPal log — the webhook payload (subscriber email, name, billing address) was logged for every event, in a channel without rotation. Cleaned up + daily driver + 14d retention + manual cleanup of the historical log on prod.
SMTP transport — the admin form allowed encryption=null → STARTTLS-optional → AUTH PLAIN plaintext attack vector. Required validation + sendTest guard.
Session policy — an explicit 30-day setRememberDuration() instead of the Laravel default of ~5 years. Doc updated, the 24h hot session stays.

Meta-principle in security.md: every security fix must end with a rule in the documentation, an item in the audit checklist, a test or a validation pattern. Of today's 5 findings, 4 would have been prevented earlier if that doc had existed.

Plus a User::deleting cascade hook for recurring items (fixing prod orphans after demo users were deleted — a missing FK CASCADE constraint on recurring_items.user_id).

🎨 Improvements across the site

/security redesign — card icons set into the top-right corner (larger radius), numbers 1–6 removed, emoji prefixes in titles gone. Subtitle rewritten to "Treziqo takes the privacy and security of financial data seriously. We don't sell your data to advertising partners or use it for marketing profiling."
/#features corner-icon redesign — the same pattern as security, 9 cards with icons in the corner instead of at the top of the tile.
/news per-month filter — a sticky right sidebar (desktop) / horizontal pills (mobile) switches between months instead of one flat list.
/admin/articles clickable status badge — a dropdown with the allowed transitions (publish / archive / back to draft / republish), instead of a group of buttons in the Actions panel.
FAQ markdown rendering — **bold** text in translation strings now renders as <strong> (no literal asterisks). Plus 3 new questions: notifications, what is /blog (News Radar), AI Finance Assistant.
Hero brand cards — landing screenshots + the register slideshow replaced with new mockups with a claim on a gradient background (CS + EN per locale). Cache-bust ?v={mtime} for instant refresh.
Material Symbols Rounded font loaded in public-head (a more modern variant with variable axes) — coexists with Material Icons.
rocket_launch → arrow_forward on the primary CTA — fewer AI/startup vibes, a neutral "move forward".

🛠️ Under the hood (interesting for developers)

docs/claude/notifications.md (394 lines) — design doc + Phase 2/3 backlog
docs/claude/seo.md (599 lines) — binding SEO standard
Forge deploy script extended with EmailTemplateSeeder + NewsSourceSeeder (they were missing, drift on prod)
/up health endpoint + Forge health check setup
Per-locale OG image schema — general_settings split into default_og_image_path_{cs,en}
Notification system 8 commits — schema → engine → evaluators → cron → opt-in → inbox bell → /settings wizard → tests (9/9 pass)

What's next (Phase 2)

Notifications — low balance alert, liability installment, monthly report, per-module shortcuts
Tailwind CDN → Vite bundle (Core Web Vitals improvement, a separate performance epic)
News Radar pipeline — admin clustering view for choosing sources per topic (once there's more fetched data)
AI Finance Assistant — port AI budget alerts into the unified notification system as the ai_budget_insight kind

Treziqo v1.15 — News Radar live

A full day of iteration on our own global blog, which writes an original article on personal finance / fintech / macroeconomics every day. All with human editing, authoritative sources (ECB, Fed, BIS, BLS, CFPB…), and as of today bilingual — EN as primary, CS as secondary.

📰 Treziqo News Radar — from RSS to a published article

A pipeline built from scratch in a single day (commits fbf1416 → 347e291):

Fetch — 49 curated sources (ECB Press / Banking Supervision / Yield Curve, Fed, BIS, BLS CPI / Employment, BEA, CFPB, ESRB, EBA, ČNB, Bank of England, Eurostat, SEC, FINRA…). RSS 2.0 + Atom 1.0, no third-party parser dependency. Cron 6× a day, a per-source fetch_interval protects against spam.
Triage — Claude Sonnet rates every fetched item (relevance 0–100, topics, region, risk flags); the selection with a threshold of 60+ moves on.
Regional quotas (since 2026-05-03 v2) — minimum 2 GLOBAL / 2 EU / 2 US, max 1 CZ. Without quotas, ECB/Fed dominated just because they publish more often.
Topic deduplication — items whose topic the blog already covered in the last 7 days get -20 % on their effective score. A soft signal, not a hard skip — breaking news gets through even with the penalty. The writer gets "avoid repeating unless materially new" in its prompt.
Writer — Claude Sonnet writes ONE article from 6 sources in a 6-section structure (What happened / Why / Impact on personal finances / Regional view / Sources / Disclaimer). In English for the EN version, in Czech for the CS version. No verbatim copying, no financial advice, always a citation list.
DALL-E hero — a photo-realistic 16:9 fintech editorial scene (modern desk + relevant financial elements + subtle map/currency hints), style=vivid (ChatGPT default). Claude generates a custom per-article prompt together with the article.
Admin review — /admin/articles has a list + edit with a 2-column layout. Single-form pattern: Save / Publish / Archive / Back to draft also save the content in progress, so no more losses from "I clicked Publish before Save".

The public /blog has locale tabs English / Česky, filter chips per type, and the blog article page has section decorations (icons + a colored left border per topic — What happened 🔵 / Why 🟡 / Impact 🟢 / Regional 🔵), social sharing (X, Facebook, LinkedIn, email, copy link) and hreflang tags for correct Google indexing.

🌍 Dual-language pipeline (EN primary + CS secondary)

Treziqo News Radar is primarily a global blog → EN is the dominant language (US/EU/UK financial markets, most sources are in EN). The CS version is a bonus for the Czech audience.

The pipeline calls the writer twice — first EN (master, master_id=NULL), then CS (translation, master_id=$en->id). They share the hero image, sources, topics and region target. DALL-E is called only once → cost optimization.
Cost: ~$0.21/day (1× triage + 2× writer + 1× DALL-E) instead of $0.13 for CZ only.
The articles.master_id self-FK links the pair; Article::siblingInLanguage() finds the sister version in both directions.
The blog article page has a crosswalk link "Číst česky / Read in English" next to the author; hreflang <link rel="alternate"> in <head>.
For manual translations of existing CS articles: the admin edit has a "Language" panel with a "Create translation (EN)" button — it creates a draft linked via master_id, copies the hero / summary / sources / topics, and leaves the content to be rewritten by hand.

🎨 Blog article redesign

Hero: object-contain on a dark gradient background, max-h: 560px. You see the whole image without cropping, at all aspect ratios.
Social sharing inline below the header: X (Twitter), Facebook, LinkedIn, email, copy link. SVG icons without third-party libraries, copy link with a 2 s "Copied!" feedback (Alpine + clipboard.writeText).
Sections with icons — a markdown <h2> decorator assigns each heading an icon + a colored accent based on its content ("What happened" → blue, "Why it matters" → yellow, "Impact" → green, "What to do about it" → pink, "Regional" → turquoise, "Key points" → purple).
Author: Treziqo editorial team — we replaced the "AI-assisted" badge (people don't read content labeled as AI; an editorial team is a trust signal).

🏠 "Latest articles" dashboard widget

A new widget on /dashboard (col_span 4, 3/5/10 items) — top published articles from News Radar: hero thumb 80×45, title + summary preview, date, click = blog.show. Footer "View all articles" → /blog. Filters by current locale (a CS user sees only CS, an EN user only EN).

⚡ Improvements

49 sources in the News Radar registry (expanded from 26 in the MVP). EBA, ESRB, BLS CPI / Employment / Latest, BEA, CFPB, ECB Banking Supervision (Press / Pub / Speeches), ECB Yield Curve, ECB Research Bulletin. World Bank API + IMF / OECD as placeholders for the v2 fetcher (disabled for now).
Background queue for News Radar — generating an article takes 30-60 s and the sync request was returning 504. Converted to GenerateNewsArticleJob, FetchAllNewsSourcesJob, GenerateHeroImageJob. The worker runs via the scheduler every minute --stop-when-empty (no Forge Daemon setup).
Hero image upload in the admin — JPG / PNG / WebP, max 5 MB, next to "Regenerate with AI". Cache-bust suffix ?v=<updated_at> against browser cache (the DALL-E .png overwritten by a new .png upload). Deletes old variants for the same slug.
Topic deduplication — the pipeline remembers the topics of articles published in the last 7 days; items that overlap get a -20 % score penalty and the writer gets an "avoid repeating" hint.
Admin sub-nav — quick links to all admin sections (users / categories / blog / news sources / SMTP / etc.).
Security upgrade — a styled <x-confirm-dialog> everywhere instead of the native confirm(). Single-form pattern in admin/articles edit (Save + Publish together).

🐛 Fixes

OPENAI_API_KEY null after php artisan config:cache — env() in PHP services returns null after caching. Moved to config/services.php, read via config('services.openai.api_key').
504 Gateway Timeout on admin Generate Article — the pipeline takes 30+ s, a sync request hit the nginx timeout. Converted to background queue jobs.
Broken feeds — the original MFČR, Eurostat, SEC and FINRA URLs were HTML landing pages, not RSS. Disabled + replaced with the correct feeds.
Dashboard widget mixed languages — a CS user saw the EN article alongside the CS version. Filter per app()->getLocale().
Landing nav "Blog" in the EN locale didn't keep the tab — now a ?lang=en parameter in the link, EN landing → EN blog tab.

🛠️ Under the hood (for developers)

articles.master_id self-FK + composite index (language, status, published_at) for blog/index queries.
Article::siblingInLanguage(string) — finds the sister version in both directions (master ↔ translation).
App\Services\News\TopicCoverage — recently covered topics from published articles (window in days).
ArticleGenerator::applyTopicCoveragePenalty() — in-memory penalty without DB writes (a test verifies that relevance_score stays unchanged).
App\Support\ArticleHtmlDecorator — preg_replace_callback on <h2> markup, maps keywords → icon + Tailwind color.
49 new sources via idempotent migrations — firstOrCreate on URL, no duplicates on repeated seeding. Disabled fields keep the audit row.
Intent-based action routing in ArticleController::update() — single form, match($intent) on publishAfterSave / archiveAfterSave / backToDraftAfterSave.
234 tests (10 new in the News section) — RegionalQuotasTest, TopicCoverageTest, dual-language in PipelineIntegrationTest.

🔒 Security

Whitelist intent validation in ArticleController::update() via Rule::in([save, publish, archive, back_to_draft]).
hero_image upload validates image + mimes:jpg,jpeg,png,webp + max:5120 KB.
No secrets in the log — the News Radar pipeline throws 200-character truncated error messages (mb_substr 500 truncates; no API keys, FTP credentials, etc. in logs).
Signed URLs are not reused — the DALL-E temp URL is valid for ~1 h, we download it immediately and store it locally. No external link to storage.
Crosswalk hreflang ensures Google doesn't treat the EN and CS versions as duplicate content.
x-confirm-dialog everywhere instead of the native confirm() — confirm() can be disabled/automated in some browsers (an anti-pattern for destructive actions).

Treziqo v1.14 — mobile is a standalone product

A day-long iteration focused on mobile UX. The goal was to stop looking at the phone as a "smaller screen" and start treating it as its own entity with its own flow, its own layout, and its own gestures. Plus 35 new system categories for better reporting.

📱 New mobile hub `/m`

After login on a mobile UA → /dashboard redirects to /m (previously straight to /quick). /m is intentionally minimalist — no widgets, KPIs, charts:

2 big tiles aspect-square with 56px icons: Add transaction (gradient → /quick) + Transactions (neutral → /m/transactions)
Inline search under the tiles (mobile keyboard hints — inputmode="search" + enterkeyhint="search")
"My accounts" section — only visible accounts, max 4 + a "+N more" link to /accounts. Next to the heading, a 👁️/🚫 icon masks balances with asterisks (privacy mode for moments when you show your phone to a friend). The state is persisted in localStorage.
5 recent expenses + 5 incomes chronologically (a click leads to the mobile detail, not to the desktop edit form)
"Ask AI" ✨ field below the recent incomes — submitting opens the AI chat in a new window with the question pre-filled and auto-sent
"Full version" footer → POST /m/desktop sets the force_desktop session and redirects to /dashboard

<x-layouts.app> on all mobile.* and quick.* routes hides the hamburger and the floating search FAB — the desktop sidebar/search don't belong in the mobile flow.

📜 Mobile-only views: transactions, detail, search

Clicking a transaction in the mobile flow never goes straight to the desktop edit form — always through a mobile read-only view (no sudden sidebar/hamburger when "I just want to take a peek").

Route	Purpose
`GET /m/transactions`	List of all transactions, paginate(30), grouped by day, sticky day header
`GET /m/transactions/{id}`	Read-only detail (hero amount + date/account/note/tags) + an "Edit" button → desktop edit
`GET /m/search?q=`	Mobile-only search (transactions only, top 50), click → mobile detail

⚡ `/quick` smart defaults — 90 % of entries = 3 taps

Three layers of efficiency in quick entry:

Chip strip of the 8 most-used categories for the current type — sticky ⭐ recent (5 last-used per type) + frequency top-up. The drill picker is collapsed under the "More categories" toggle.
Predefault wallet — the last-used wallet (with a guard: it must be in the accessible scope, otherwise fallback).
Auto-update — after a successful save, it automatically remembers the choice for next time.

Plus: hidden accounts (is_hidden=true) are no longer offered in /quick — quick is "fast daily entry", and a hidden account is a signal of "I don't use this in the regular flow".

🗂️ 35 new system categories

Breaking down your finances is the foundation of good reporting. Added to the global set (user_id=NULL):

New root "Subscriptions" 💳 → Streaming services (Netflix/HBO/Disney+), Music subscription (Spotify), Cloud storage, Software (Adobe/MS 365), News & magazines.

Housing → Garden, Moving, Building fund / HOA (CZ-specific must-have), Property insurance, Municipal fee

Transport (car maintenance) → Vehicle inspection, Tires, Car wash

Health → Tanning salon, Manicure, Pedicure, Massage, Optician, Supplements, Vaccination

Entertainment → Hobby

Travel → Travel insurance, Visa, Car rental

Children → Diapers & hygiene, Pediatrician

Pet (existing root, selectable) → Pet food, Vet, Pet supplies, Pet insurance

Business → AI tools (ChatGPT/Claude/Midjourney)

Charity → Membership fees

Income → Side hustle (freelance/gigs), Refunds (e-shop refunds)

EN translations are complete in Category::NAME_EN (the locale=en accessor switches automatically). The migration is idempotent (INSERT WHERE NOT EXISTS) — safe for a repeated post-deploy hook.

🐛 PWA fixes — no more "it logs me out, but the password is correct"

Three regression bugs in the PWA flow were a source of frustration. Step by step:

PWA start_url=/login showed the login form even to a logged-in user → the user thought "it logged me out" → logs in again → throttle:login 429. Fix: RouteServiceProvider::HOME = '/dashboard' (instead of the non-existent /home) + guest middleware on GET /login → a logged-in user is redirected to /m.
Alpine x-init race condition — the login form sent remember=0 on a quick Enter, so the PWA got only a 24h session instead of the 14-day remember. Fix: a synchronous inline <script> + onsubmit fallback (defense-in-depth).
A manual Cookie::queue override of the remember cookie was the source of subtle cookie scope drift. Removed — Laravel's default 5-year cookie works out of the box.

Plus:

Avatar upload 413 in /settings/profile — Laravel validation raised to 3 MB (below nginx's 4 MB with a margin for multipart overhead) + Czech validation messages + a global PostTooLargeException handler in Exceptions\Handler → the user never sees a raw nginx 413, always a nice flash message.
Dynamic favicon and apple-touch-icon route from GeneralSetting->logoUrl(). Deleted static public/favicon*.png + apple-touch-icon.png — they overrode the HTML <link> tags and the manifest; iOS in particular takes apple-touch-icon.png for the PWA home-screen icon.
Service Worker v4 — bumped cache version + cleaned the deleted favicon paths from STATIC_ASSETS.
/quick category filter — pickerSearchActive was a getter in the category-picker mixin, which ...spread copied as a static value (false) forever. Getter → method.

🎨 Small things

Sidebar 📱 toggle — next to dark/light there's a new phone icon (only on mobile UA); a click returns you to /m and clears the force_desktop flag. If the user accidentally clicks "Full version", there's a way back.
/quick X header leads back to /m (not to the desktop dashboard).
/quick footer cleaned up — removed the "Full dashboard" toggle (a duplicate path to the /m "Full version").
Footer Privacy/Cookies/Terms hidden sm:inline — on mobile the 4 links "overflowed" into multiple rows; security kept visible as a trust signal.
Brand logo under the "Full version" button on /m (a quiet visual signature, opacity 60 %).
Favicon hint in /settings/profile — the text "max 2 MB" updated to "max 3 MB" (via a new translation key v2 — the seeder's firstOrCreate wouldn't overwrite the old one).

🛠️ Under the hood (for developers)

Helper is_mobile_ua() in app/Helpers/is_mobile_ua.php — shared UA detection (Android / iPhone / iPod, NOT iPad). DashboardController + nav.blade.php share one source of truth.
DB migration pattern: smart defaults for /quick (users.last_quick_account_currency_id + users.quick_recent_categories JSON) + 2 waves of system categories. All idempotent with INSERT WHERE NOT EXISTS guards.
CLAUDE.md hard rule respected: groupBy + Carbon::parse closures are assembled in the controller ($grouped, $dayLabels, $balanceLabels), Blade only iterates over the finished map — @php(...) with nullsafe / arrow fn / \u{xxxx} sequences breaks the compiler regex.
AI chat prefill flow — aiChat() init() detects the URL param ?prefill=…, sets the input + auto-calls send(), then history.replaceState() cleans the URL (a refresh no longer re-posts the same question).
Category::NAME_EN extended with 35 new mappings. The getNameAttribute() accessor switches by locale = the simplest per-locale translation without per-row translation tables.

🔒 Security

All new /m/* routes in the auth + activated + 2fa middleware group — no unauthenticated access.
IDOR guards on all new endpoints — Transaction::accessibleTo($user) scope on showTransaction, the transactions list, search. No find by ID without scope.
User::pushRecentQuickCategory() validates $type against a whitelist (['expense', 'income']) + integer cast on $categoryId before persisting.
last_quick_account_currency_id read-time guard — if the target wallet is no longer in the user's accessibleAccountIds, fallback to the first wallet (no leak of someone else's wallet).
PostTooLargeException handler flushes sensitive inputs (avatar, password, password_confirmation, current_password) from withInput.
Migrations all scoped to user_id=NULL (system categories) — no changes to user data.

Treziqo v1.13 — billing has grown up

A big commit pack focused on the ecosystem around paid plans. The goal was to make Treziqo a platform we're not afraid to open to the first paying customer: fair treatment after cancellation, transparent emails, an audit trail, monitoring.

🤝 After cancellation, your plan runs out the paid period (grace period)

When you cancel a paid plan, you don't lose access immediately. Your plan stays active until the date the next payment would have happened — typically until the end of the month you paid for. Only then do you fall back to Free.

Reason: you paid $3.49 for the month, so it's fair to let that month run out. You shouldn't lose features in the middle of a paid period just because you changed your mind halfway through.

How it works:

Click Cancel subscription in /checkout → the PayPal subscription is canceled, but cancellation_effective_at = next_billing_time.
In /checkout and /settings#tariff you see an amber banner with the end date: "Your plan stays active until DD.MM.YYYY".
PRO/BASIC features work normally until that day. After it, you fall back to Free, and your data stays.
Mid-grace you can change your mind — the PayPal Smart Buttons are visible again in /checkout, a click → a new subscription, and the old grace is cleared.

For admins: everything is written to plan_audit_events (action PAUSED + GRACE_SET), so the support team can see in /admin/billing-stats the number of users in grace + the utilization rate (% who reconsider the cancel).

📧 Heads-up emails before trial and grace end

Instead of a sudden "now your /checkout is locked", we send a reminder 3 days before.

Trial ending warning — if your 14-day trial runs out in 3 days and you haven't paid yet, you get an email with a link to checkout. Tips in the email help you finish subscribing quickly.

Grace ending reminder — if the end of grace is approaching after you canceled a paid plan, you get an email "Your plan ends DD.MM.YYYY, click to resume". A second chance.

Welcome email after completed registration — onboarding tips: add an account, import transactions, set up a budget. Separate from the payment confirmation (that comes later).

Refund email — when PayPal processes a refund (from our side or from PayPal), we automatically inform you with the details (refund ID, amount, reason, ETA to your account).

🛡️ Safer checkout flow

Throttle 20 requests / 10 min on all mutating /checkout/* endpoints (cancel/confirm/recheck/switch/activate). Defense-in-depth against session-hijack DDoS on the PayPal API.
Plan switch blocked during an active subscription — if you have a PayPal sub and want to switch BASIC↔PRO in /checkout/switch, you get the message "Cancel first, then buy the new plan". Previously the local plan could diverge from the PayPal billing price.
Custom_id security check in PayPal callbacks — an attacker with a stolen subscription ID can't activate it as their own.
Webhook signature verify fully functional (strictly in production with PAYPAL_WEBHOOK_ID set).

📊 Admin observability — `/admin/billing-stats`

A new admin page for the support flow "why is a user writing to me that they don't have PRO" + tracking business growth.

Current state (period-independent):

Active subscriptions
In grace period
Paused (outside grace)

Metrics for the period (today / week / month / all):

Activations
New subscribers (excludes resubscribes)
Cancellations
BACKUP_GRACE used (when the PayPal API failed and we fell back to the backup heuristic)

Plus:

30-day bar chart of activations vs cancellations (green up / red down)
Revenue per currency (CZK/USD/EUR)
Recent feed: BACKUP_GRACE incidents (PayPal API health) + orphan adoptions (security audit)

🔍 Audit trail for plan changes

Instead of grepping paypal.log, we now have a SQL table plan_audit_events. Every state change on a user's subscription/plan is logged:

ACTIVATED — first activation or reactivation
PAUSED — cancel / suspended / expired / payment failure
GRACE_SET — deferred pause after a user cancel
GRACE_CLEARED — a mid-grace resubscribe cleared the grace
PLAN_SWITCHED — the user switched BASIC↔PRO
SUB_ADOPTED — an orphan PayPal subscription assigned via /checkout/recheck (security-relevant)
BACKUP_GRACE_USED — PayPal API down, grace estimated from the last payment

Each record has actor_type (user / admin / webhook / system) + actor_id + metadata JSON. Immutable, indexed per (user_id, created_at) and (action, created_at).

💸 Refund tracking

We now capture PayPal PAYMENT.SALE.REFUNDED (and REVERSED) webhook events — we flag the original Payment row as status='refunded', and the refund metadata is merged into raw_payload._refund (refund tx_id, amount, reason, ETA). The user gets an email confirmation.

Previously a refund would go through in PayPal, but our DB would still show "completed" → admin/support wouldn't see the real state.

🎨 Small things

/checkout view with a grace banner, status_grace label in /settings#tariff + last payment + estimated next billing date
/admin/ai-usage added to the admin nav menu (it was missing, which was confusing in navigation)
/admin/payments vs /admin/billing-stats — clarified subtitles: Payments = operational log of specific transactions, Billing stats = strategic metrics and trends
Plan badge next to the Bloomberg ticker on the dashboard — FREE / BASIC / PRO + TRIAL indicator
Locale-aware pricing on landing/register/checkout: cs → CZK, en → USD/EUR
Backup grace heuristic — if the PayPal API fails during cancel calls, fallback to last_payment.paid_at + 30 days. Audited as BACKUP_GRACE_USED. The user paid and deserves grace even when our infra misbehaves.

🛠️ Under the hood (for developers)

Test coverage of subscription/billing/checkout: 0 → 129 tests (UserPlanHelpers matrix, SubscriptionService cancel happy/fail/idempotence, PayPal webhook signature/CANCELLED/SUSPENDED/dedup, CheckoutCancel/Confirm/Recheck integration, billing-stats smoke).
User::flushPlanCache() — resets cached hasProPlan/isPlanPaused/isPlanActivated after update(). Called by SubscriptionService::activate/pause automatically. Eliminates the footgun "stale helper value within a request".
CheckoutController::verifyAndActivate(allowOrphan) — a shared helper between confirm() (strict, JSON) and recheck() (relaxed with orphan adoption, form+flash). Eliminated ~95 lines of copy-paste.
Migration pattern for force-updating existing translations rows — TranslationSeeder is firstOrCreate (protects admin overrides), so overwriting hardcoded text goes through an ad-hoc update() migration.
Webhook route still stateless — withoutMiddleware([EncryptCookies, StartSession, VerifyCsrfToken, SetLocale, ...]). Trust mode for non-production (without PAYPAL_WEBHOOK_ID).

⚠️ Before production — operational checklist

PAYPAL_WEBHOOK_ID in .env — without it, the webhook is in trust mode = a security hole
PAYPAL_MODE=live + the admin has created live billing plans in PayPal Business + entered paypal_plan_id in /admin/plans
Forge cron php artisan schedule:run active → automatically picks up the new daily commands (subscription:notify-grace-ending 09:00, subscription:notify-trial-ending 08:30)
Sandbox end-to-end test: subscribe → payment → webhook ACTIVATED → cancel → grace banner → resubscribe → activated cleared grace

Treziqo v1.12 — the dashboard has a new look

A big visual update. The goal was twofold: give the dashboard a "Bloomberg for personal finance" feel, and free up vertical space by removing unnecessary chrome. Keep everything that worked, just give it more character.

🎨 KPI strip — a galactic area

The four cards (Total assets / Cashflow / Due in / Negative days) now form a single visual area with a cosmic background. Two variants: pastel for light mode, a purple-blue galaxy for dark mode. The cards are frosted glass (backdrop-blur-md), so the background shows through between the icons.

Halo icons — each KPI icon now has a gradient halo with a glow shadow in the theme color (cyan / emerald / amber / dynamic). A small thing, but it makes a difference.

Disambiguating "Risky days" — the KPI card was renamed to "Negative days" (the number of days in the last 30 with daily cashflow < 0). "Risky days" remain in the Cashflow widget as a forecast metric (days below the threshold). The same name for different metrics was confusing.

⏰ Bloomberg ticker + 60 mottos

To the right above the action buttons there's a new date/time ticker: a pulsing green dot, day · date · live time with seconds, monospace font, glass badge. Locale-aware (cs/en). Inspired by Bloomberg's terminal layout — information density without shouting.

Under the greeting, one of 60 financial mottos (cashflow, budgets, financial health) rotates on every refresh. Pull-quote style with a purple left border. Examples:

"Cashflow is the pulse of your financial life."
"Wealth doesn't start with a higher income, but with a better overview."
"Money likes quiet, a plan, and patience."

🧭 Top bar removed, search as a floating icon

The sticky top bar is gone — freeing up vertical space for the dashboard itself. In its place:

Floating search FAB (a circular purple icon with a gradient + halo glow) in the bottom-right corner. Click or press / to open modal search across all modules (transactions, budgets, recurring, investments, liabilities).
Profile, theme toggle, locale, inbox moved down into the left menu. Clicking the profile opens a dropdown with Settings, Administration (super_admin only), and logout.
The "System" and "Administration" sections in the menu are gone — Settings and Admin now live in the profile, and the sidebar is cleaner.

🪟 "What if" drawer with a live preview

The "Run scenario" button in the hero no longer points to /scenarios — it opens a 4-step wizard right on the dashboard:

Pick the scenario type (cut expense / extra payment / one-time income / big purchase / income loss / boost savings)
Pick a specific entity (liability, category, or enter an amount)
Set the amount + horizon (3 / 6 / 12 / 24 months)
The server returns an impact summary (end-balance delta, total saved, number of risky days) + the option to apply the overlay to the cashflow widget

For a more detailed simulation with custom rules, use "Open advanced scenario" → the full flow at /scenarios.

📊 Layout grid — the triad on one row

The default widget order was reworked:

Row	Widgets
1	Accounts (12)
2	Cashflow (6) + AI insight (3) + Budgets (3) = triad
3	Liabilities (4) + Power tools (4) + Recent transactions (4)
4	Investments (12)
5	Yearly stats (12)

The Recent transactions widget is now as wide as Liabilities/Power tools (col_span 4) — inside, Income/Expenses are stacked (5 + 5).

Spacing is compressed overall: widget header py-3, body p-4, gap-4, padding above the greeting reduced from 24 to 4 px. Less whitespace, more content above the fold.

🔧 Small things

Filter SUM in transactions: on /transactions, after filtering by type (Income / Expenses / Investments), an aggregated row appears below the table with the grand total for the whole filter (per type × currency), not just for the visible page.
"Goal achieved" for saving goals: a SAVING budget (e.g. "Save at least 20k/month") at 307 % no longer shows red as "Over budget" — it shows a green "Goal achieved" with a ✓ icon.
AI tab in the admin: /admin has a new "AI usage" tab (auto_awesome icon) after Plans — an overview of token consumption per user + monthly cost.
Bold in the AI insight widget: Anthropic returns markdown **xxx**, which previously showed as raw text with asterisks; now it renders as bold (escape HTML + replace).
Plurals for "day/days" in dashboard widgets fixed (KPI strip + Liabilities and installments widget).
Logo + name at the top of the left menu instead of the gradient T (custom upload via /admin/company → fallback /img/logo.png).
Subtitle rewritten to "Treziqo.com — don't just track where money went. Understand where it's leading you."

🛠️ Under the hood (for developers)

Topbar shell removed, the sidebar has a top-0 h-screen flex flex-col structure (brand → flex-1 nav → bottom panel)
WidgetRegistry extended with col_span = 3 (match() in dashboard.blade.php)
New endpoint POST /dashboard/scenario/preview (DashboardScenarioController) — maps the high-level drawer payload to ScenarioRunner rules
kpi-strip.blade.php has 2 separate background image divs (light / dark via Tailwind dark:hidden)
Plurals fixed via separate trans keys (*.one/.few/.many) instead of trans_choice() — the Laravel native one doesn't work because the lang/ directory doesn't exist in the project; we use the DB-backed t() helper
Migration 2026_04_28_190542 force-updates dashboard.subtitle (firstOrCreate in the seeder wouldn't update existing rows)
60 new translation keys dashboard.motto.1..60 (cs+en)

⚠️ Breaking / behavior changes

The dashboard.kpi.risky_days key is no longer used in the KPI strip (renamed to dashboard.kpi.negative_days). The old value "Rizikové dny" remained in the DB for the Cashflow widget (dashboard.cashflow.risky_days has its own key).
Mobile layout: without the top bar, the hamburger is a floating button at the top left (top-3 left-3), and the main content has pt-12 padding compensation. If you have custom mobile CSS, check that nothing overlaps the floating button.

Treziqo v1.11 — from forecasts to scenarios

The eleventh version moves Treziqo from forecasting (what happens on its own) to simulation (what happens if you do X). The key new feature: Module 11 — Scenarios & simulations with a baseline vs scenario overlay chart, impact cards, and a 12th tool for the AI Assistant. Plus the long-postponed bulk category migration for consolidating duplicates after imports, and a balloon payment for 47+1 leases.

PRO-only feature for scenarios. Calculated statelessly per request — no snapshot table, always fresh.

🧠 Module 11 — Scenarios & simulations at `/scenarios`

A new PRO page under "Analysis" in the sidebar. Built on the same service as the cashflow forecast, but adds a layer of rules:

3 rule types:
- Extra liability payment — a one-time or monthly extra payment toward a specific loan
- One-time event — income or expense on a specific day (e.g. "50k bonus in June")
- Recurring item change — cancel or adjust the amount (change_amount) of an existing recurring item
3 horizons: 6 / 12 / 24 months
Overlay chart — blue baseline vs purple scenario on one chart, you see the difference instantly
3 impact cards:
- End-balance delta (vs baseline)
- Risk-day delta (how many days below the threshold)
- Scenario end balance (with baseline for comparison)
Per-rule breakdown — how many events were modified, plus error codes if any (e.g. "recurring item is missing", "action is not defined")

Stateless v1: scenarios aren't saved to the DB. Any page refresh → the editor is empty. Persistence (sharing scenarios, saved comparisons) is postponed to v2.

🏢 Personal vs company what-if via scope tabs

If you have company accounts with a filled-in tax ID (/accounts → Company tax ID), scope tabs appear on /scenarios — Personal | Company X. You model which account the change affects:

Auto-switch — when you pick a company recurring item from the list, the scope automatically switches to the company (better UX than "please pick a scope before you pick an item")
Dropdown filtering — after a manual scope switch, selected items that don't belong to it are cleared
Option labels — EasyFm SWKLID (84 700) — KB Firma in the dropdown, so you see each item's scope at a glance

🤖 The AI Assistant got its 12th tool — `runScenario`

The AI can now run a simulation and return concrete numbers:

"What happens if I add 5,000 CZK to my monthly loan payment?" → the AI calls runScenario(horizon_months=24, scope=personal, rules=[liability_extra_payment(5000, monthly)]) → answers: "Within 24 months you'll pay it off 12 months earlier, save 18,400 CZK in interest, and your end balance will be 78,200 CZK higher."

Plus scope integration: listLiabilities returns a scope field per liability (personal or company:taxID), so Claude can pass the scope on to runScenario — company what-if works out of the box.

🔄 Bulk category migration at `/categories/migrate`

Consolidate duplicates after imports / category refactoring in one move:

Pick the source categories — a checkbox listing with counts of transactions, recurring items, budgets, installments
Pick the target category (it can also be a newly created one)
Optionally add a tag — e.g. "migration 04/2026" to find it later
See the impact before commit — record count per group, plus a warning about collisions (e.g. "two budgets on the same category")
Atomic transaction — either everything moves, or nothing. Rollback on error.
Source categories are deleted after a successful migration

Affected modules: transactions, recurring items, budgets, liability installments, defaults in users.default_*_category_id.

🎈 Balloon payment (47+1 leasing)

When creating or editing a liability (typically a car lease), you can add a balloon payment — a final large payment after N monthly ones. The payment schedule automatically places it on the last month:

Enter the balloon amount (e.g. 100,000 CZK)
Monthly installments are calculated so that the balance right before the balloon equals the balloon
Last installment = balloon_amount + remaining interest

📏 Per-account threshold for risk days

The global threshold in /settings → Preferences stays, but you can now override it per account:

Koruna account: threshold 5,000 CZK (reserve)
Euro account: threshold 200 EUR (different currency, different logic)
Without an override, the global default applies

Used in risk-day alerts on /cashflow and in scenarios.

🔧 Per-diem fix for loans

Problem: Per-diem (interest for the partial first month before the first installment) was applied to all existing loans, so i30 úvěr Týna showed a first installment of 20,698 CZK instead of the real 1,873 CZK. Reason: the loan was signed 2.5 years ago, and per-diem was counted from start_date all the way to today (~750 days).

Fix: Per-diem now applies only if accrual_window_days <= 45 (a typical limit for genuinely newly originated loans). Existing loans have their first installment long behind them — per-diem isn't used for them.

💄 Scenarios + UI fixes

The iterative debugging of module 11 was rich. What got fixed:

Validation strip — Laravel $request->validate() stripped per-rule fields (recurring_id, action), and the service reported "recurring_id_missing" for every rule. Fix: use $request->input('rules') raw.
Alpine x-if recreates the DOM — when switching the rule type, x-model.number didn't sync with the parent state. Fix: x-if → x-show, DOM stable, bindings preserved.
Alpine inline const — the Alpine evaluator doesn't know const in inline handlers. Fix: arrow function syntax instead of IIFE-with-const.
json_encode in an HTML attribute — quotes in the JSON broke attribute parsing. Fix: plain Blade {{ }} instead of :placeholder="{!! json_encode(...) !!}".
@vite() removal — Treziqo uses Tailwind+Alpine via CDN, so @vite() was unnecessary. Plus PROD had a leftover public/hot from a local npm run dev → the browser on PROD tried to load https://webdevjanzitko.test:5173/.... Fix: remove @vite() from the layout.
EUR 0,00 in red — floating-point precision (0.000001 < 0). Fix: an number_format($balance, 2) === '0,00' test instead of < 0.
Recurring detail — "Back to list" was missing, and there was a duplicate bottom link. Fix: link at the top next to the breadcrumb, bottom one removed.
/categories/migrate empty selects — HTML5 filtered <template x-for> inside <select>. Fix: server-side @foreach.
/categories/migrate hidden tag dropdown — overflow-hidden on the outer container clipped it. Fix: overflow-visible + min-h-[500px].

⚠️ What you need to set up after deploy

Step	Where	Detail
1. Per-account threshold	`/accounts` edit	The "Minimum balance (alert)" field — leave it empty = the global default applies
2. Balloon payment	`/liabilities` edit	The "Balloon payment" field for existing leases + regenerate the payment schedule
3. Category consolidation	`/categories/migrate`	Go through duplicates from imports — if you have any

The post-deploy hook runs seeders + migrations automatically. No manual admin task.

🛠 Under the hood

Data model: accounts.min_threshold (decimal nullable), liabilities.balloon_amount (decimal nullable). No snapshot table for scenarios (stateless v1).
ScenarioRunner: stateless service, signature run(user, horizonMonths, rules, scope). 3 rule types with detailed error codes. IDOR check on liability_id / recurring_id against the user. Scope validation via CashflowForecastService::validateScope (shared with cashflow + AI tool).
CategoryMigrationService: atomic batch migration via a DB transaction. Affected entities: transactions, recurring_items, budgets, liability_installments, users.{default_income,default_expense,default_transfer}_category_id.
LiabilityAmortizationService: balloon support + per-diem 45-day window guard.
AI tool 12: runScenario(horizon_months, scope?, rules) in the FinanceTools::execute() routing. Scope param + listLiabilities exposes scope per liability for Claude orchestration.
Vite removal: the @vite() directive in resources/views/components/layouts/app.blade.php was removed. The stack is now purely CDN — Tailwind runtime, Alpine 3, Chart.js per page. If you ever want the build pipeline back, see reference_treziqo_no_vite_build.md in memory.

Thanks for using Treziqo. Send bugs and ideas to info@treziqo.com.

Treziqo v1.10 — from tracking to forecasting

The tenth version moves Treziqo from a tracking app one step closer to a proactive financial assistant. The key new feature: a cashflow forecast 30 / 60 / 90 days ahead with risk days and integration into the AI Assistant. It also adds a split between personal and company cashflow by tax ID — if you have several LLC accounts, each company gets its own tab and internal transfers aren't double-counted.

PRO-only feature (both the cashflow page and the AI tool). Calculated statelessly per request — no snapshot table, always fresh.

📊 Cashflow forecast at `/cashflow`

A new PRO page under "Analysis" in the sidebar. A forward projection of your balance, built on the data you already have in the app:

3 horizon tabs: 30 / 60 / 90 days
3 summary cards: today's balance / projected / number of risk days
Line chart of the projected balance with a dashed reference line for your minimum balance
Timeline list of days with events (no 90 empty rows) — you see which day your paycheck, mortgage payment, or rent arrives
Risk-day alerts shown at the top — "On 14 May your balance drops below 5,000 CZK", not only after it happens

Inputs to the projection (all scoped to you):

current balances of all bank accounts included in the forecast
active recurring items (/recurring) expanded into the horizon
scheduled liability installments (/liabilities schedule)

🏢 Personal vs company cashflow (by tax ID)

If you use Treziqo for your own LLC alongside your personal cashflow, you now have a clear separation:

/accounts edit — a new "Company tax ID" field (leave it empty for a personal account) + an "Include in cashflow forecast" checkbox for exclusion (e.g. a child's account, savings, external)
/cashflow scope tabs — next to "Personal", a tab for each company appears (accounts with the same tax ID are aggregated)
An internal transfer company → personal (typically salary paid out from the LLC) shows up as +income in the personal scope and as −expense in the company scope, not twice on both sides

Default: no tax ID = personal. Existing accounts stay "included" (no breaking change).

🤖 The AI Assistant got its 11th tool — `getCashflowForecast`

The AI can now give you a concrete answer:

"Will I make it to payday on my budget?" → the AI calls getCashflowForecast(horizon_days=30) → answers: "By 14 May your balance drops from 25,000 to 8,200 CZK. Biggest hit: mortgage on 15 May (-10,000). Risk days: 0."

For company cashflow, just say "how will the company stand in 60 days?" — the AI uses the scope company:taxID (determined from the accounts).

💡 AI examples — lightbulb in chat

Discoverability of the AI's own capabilities. In the chat form there is a 💡 lightbulb next to the input — a click opens a sheet with 16 example questions in 6 categories (Cashflow / Spending / Accounts / Liabilities / Investments / Budgets). Clicking a question pre-fills it into the input.

Plus small things in the AI chat:

Markdown rendering of answers — Claude formats with **bold** and tables, so you now see bold text, formatted tables, blockquotes (previously raw text was shown)
"New conversation" in the sidebar opens an empty chat (previously it returned the last conversation — a UX bug)
max_tokens 1024 → 4096 — answers no longer get cut off mid-word
Material Icons fix in Ctrl+C copying — no auto_awesome lightbulb send in the copied text

🛡 Defensive layer

The risk-day threshold is newly per-user in /settings → Preferences — "Minimum balance (forecast alert)". Default 0 = classic overdraft prevention; you can raise it to 10,000 as a reserve.
IDOR scope on accessibleTo($user) across the scope filter (both for the UI and for the AI tool)
Internal transfer detection — if a RecurringItem has target_kind=INTERNAL_TRANSFER, scope-aware logic decides between expense / income / net 0 (both accounts in scope cancel out)

🧹 Refactor under the hood

The refactor backlog audit from 2026-04-25 was completed for 5 of 7 items (the remaining 2 carry a red flag "don't do without a plan"):

LiabilityPaymentService extract — ~190 lines of duplicate logic between storePayment and storeDrawdown moved into a dedicated service. Plus createLinkedTransaction from the controller → service.
liabilities/show.blade.php from 923 → 56 lines (orchestrator) + 5 partials.
landing.blade.php from 400 → 160 lines + 6 anonymous components in components/landing/.
Constants class in App\Support — unified 24 occurrences of 99999999.99 and 999.999 across 5 controllers.
ResolvesTags trait — extracted from the Transaction, Investment, QuickTransaction controllers.
CashflowForecastService helpers — advanceCursorToToday(), collectOccurrences(), liabilityIsInScope(), validateScope() after a follow-up audit.

🧪 Test infrastructure

9 new Liability feature tests (payment + drawdown happy paths, IDOR, edge cases) — coverage for the service we refactored.
14 new Cashflow service tests (scope filter, internal transfer net 0, threshold severity, paused/inactive recurring).
Smoke tests for GET /liabilities/{id} and GET /cashflow as a safeguard for the Blade splits.
CI fix — phpunit.xml forces DB_DATABASE = treziqo_testing, the CI MySQL service now matches (previously it failed with 1049).

Suite: 11 → 38 tests, 11 → 113 assertions.

⚠️ What you need to set up after deploy

Step	Where	Detail
1. PROD `.env` (optional)	`/finora/.env`	`ANTHROPIC_MAX_TOKENS=4096` (or keep the config default)
2. Per-user threshold	`/settings → Preferences`	"Minimum balance (forecast alert)" — default 0, raise it to a reserve
3. Tax ID of company accounts	`/accounts` edit	Fill in "Company tax ID" — without it, the account stays in the personal scope
4. Account exclusion	`/accounts` edit	Uncheck "Include in cashflow forecast" for a savings / child's / external account

🛠 Under the hood

Data model: accounts.ico (varchar 16 nullable) + accounts.include_in_forecast (bool default true) + users.cashflow_min_threshold (decimal 14,2 default 0).
CashflowForecastService: stateless per-request projection. Public API: project(user, horizon, scope) + availableScopes(user) + validateScope(user, scope). No snapshot table — postponed to v2 (once scenarios and behavioral patterns arrive).
Scope key format: personal or company:{ICO}. Constants SCOPE_PERSONAL + SCOPE_COMPANY_PREFIX in the service.
AI tool 11: getCashflowForecast(horizon_days, scope?) in the FinanceTools::execute() routing. Returns a summary + top 3 events (selector via flatMap → sortByDesc → take).
Frontend markdown: marked@11 + DOMPurify@3 as CDN scripts on /ai. After the typewriter loop finishes, the message is replaced via splice with an html field (rendered + sanitized). The copy button copies m.text (raw markdown), not HTML.

Thanks for using Treziqo. Send bugs and ideas to info@treziqo.com.

Treziqo v1.9 — AI answers your questions about your finances

The ninth version adds an AI Finance Assistant connected to your data. Ask in natural language (Czech or English) — "How much did I spend on food this month?", "What active loans do I have?", "Where do I spend the most?" — and Claude (by Anthropic) answers with concrete numbers from your accounts, not generic phrases.

PRO-only feature. No external dashboards, no mailing lists — Claude sees only your data, scoped on the backend via accessibleTo($user).

🤖 Chat at `/ai`

A full-featured chat UI with conversation history:

6 example prompts on an empty conversation — a click pre-fills the question
Sidebar with the history of the last 50 conversations (mobile drawer) — switch with one click, hover-delete
Copy-to-clipboard on assistant answers — hover button, visual "Copied!" feedback
Typewriter effect — the answer appears gradually, character by character (a UX bonus, not true streaming)
Privacy disclaimer banner the first time + a footer disclaimer under every page

The chat persists in the ai_conversations table. You can come back the next day — the context stays.

🛠️ 10 tools — what the AI knows about your finances

In every query, Claude has ten typed functions scoped to you at its disposal:

Tool	Example question
`getTransactionSum`	"How much did I spend on restaurants in April?"
`getAccountBalances`	"How much money do I have across all accounts?"
`listLiabilities`	"What active loans do I have?"
`getLiabilityProgress`	"How much of the mortgage is left to pay off?"
`getCategoryBreakdown`	"Top 5 categories where I spend the most?"
`getCashflowSummary`	"What is my cashflow this year?"
`getBudgetStatus`	"Which budgets have I exceeded?"
`getInvestmentPortfolio`	"How are my investments doing?"
`getInvestmentContributions`	"How much have I put into Conseq this year?"
`searchTransactions`	"Find me transactions with the text 'refund'."

Claude can combine them within a single answer — multi-tool reasoning. "Where did I spend the most in April, and did I exceed my budget?" → it calls getCategoryBreakdown + getBudgetStatus and returns a concrete answer.

📊 AI insight widget on the dashboard

A new widget on /dashboard — an automatic 1-2 sentence summary of your financial situation this month, generated directly from current data. Example:

"This month you spent 47,000 CZK, 18 % more than last month. Restaurants cost you the most (12,000 CZK) — maybe bring lunch from home more often?"

Lazy load — no API call when the dashboard renders, fetch after DOMContentLoaded
4 h cache per user — repeated refreshes don't load the API or the Anthropic quota
Refresh button forces a new generation (skips the cache)
"Ask for more" link opens /ai with the full chat

🔔 Proactive budget alerts (email)

When you exceed a budget, Treziqo sends you a smart email — not just "X % over", but a concrete AI summary of why. Example:

"You exceeded the 'Food' budget by 22 % (3,200 CZK over the limit). Main expenses: Restaurants 2,100 CZK, Online food 800 CZK. Try cutting back on food delivery — an average of 450 CZK per order × 6× a month cost you 2,700 CZK."

Sent daily at 9:00 AM (if you have any exceeded budget)
Anti-spam: we won't send you the same alert again sooner than in 7 days
Opt-out: the same toggle as for the whole AI assistant in /settings

🛡️ Privacy and control over your data

PRO-only — the feature is available only to PRO plan subscribers
Opt-out toggle in /settings → Preferences → "Enable AI assistant". It's on by default, but you can turn it off at any time. When it's off, /ai shows you an info banner instead of the chat.
GDPR transparency: a privacy disclaimer banner in the chat + a readme on what gets sent. Anthropic has an EU data residency option (can be arranged if needed).
RBAC scoping: on the backend, every tool scopes the DB query via accessibleTo($user) — Claude never sees other users' data, not even admin data. Even if Claude sent someone else's ID, the server filters it out.
Rate limit: 30 queries/minute per user (anti-spam), no daily cap for PRO. The free tier (if opened up in the future) would have 10/day.

📈 /admin/ai-usage — cost control (super_admin only)

A new admin overview — how many Anthropic API tokens each user consumes and how much it costs in USD:

Period switcher: today / week / month / all time
5 stat cards: active users, conversations, tokens in/out, total cost
Per-user breakdown sorted from the biggest spender

Cost is calculated from current Anthropic rates (Sonnet 4.6: $3 / 1M input, $15 / 1M output). When prices change, update a single constant in AiUsageController.

🔧 Small things

Privacy policy gets a section on the AI assistant (data flow, Anthropic as a processor, EU data residency)
Sidebar nav: a new "AI assistant" item with a ✨ icon for PRO users
Settings/Privacy toggle: a gray "Enable AI assistant" box explaining what gets sent

⚠️ What needs setup before launch

Step	Where	Detail
1. Anthropic account	console.anthropic.com	Generate an API key (`sk-ant-api03-…`)
2. Payment method	console.anthropic.com/settings/billing	Tier 1 = $5 → 50 reqs/min limit. Without billing, the free tier gives only 5 reqs/min
3. PROD `.env`	`/finora/.env` (via FTP)	`ANTHROPIC_API_KEY=sk-ant-…`
4. SvetHostingu cron	Admin panel → Cron	URL `/cron/ai-alerts?token=CRON_TOKEN` daily at 09:00
5. Privacy policy update	`/admin/legal-documents`	Add a section on the AI processor

💸 Cost expectations

Scenario	Per query	100 queries/month
Chat query Sonnet 4.6	~$0.012	~$1.20
Dashboard insight (4h cache)	~$0.014 × ~6/day	~$2.50/month per user
Budget alert (1× per 7 days per budget)	~$0.015	~$0.06/month per user

For a PRO user at 149 CZK/month (~$6.50), this fits within the margin. Track it via /admin/ai-usage.

🛠 Under the hood

Data model: new table ai_conversations (user_id, messages JSON in Anthropic format, usage_tokens_in/out, last_message_at, soft delete). Plus the column users.ai_enabled (default true).
Stack: Anthropic Messages API via the raw Http:: facade (no extra composer package). Prompt caching (system + tools, 5min TTL) — ~50 % savings on repeated queries within a session.
Agent loop: max 5 iterations of the tool_use chain, a hard cap against an infinite loop. Multi-turn with persistence. An askEphemeral() variant for one-shot without DB (dashboard insight).
Defense-in-depth: Route middleware('pro') + ChatController user gate (anti-curl bypass) + per-user ai_enabled + rate limit (30/min throttle, 10/day soft cap free) + IDOR scope on accessibleTo/forUser.
DEV gotcha: Windows curl + OpenSSL 3.0 sometimes fails on the CAINFO override for the Anthropic CA chain → escape hatch ANTHROPIC_INSECURE_SKIP_VERIFY=true hard-gated to app()->environment() = local|testing (PROD ignores it).
JSON {} vs [] gotcha: a PHP empty array serializes as a JSON array, but the Anthropic API wants an object for tool.input_schema.properties and tool_use.input. Workaround (object) [] + a walk normalizer in FinanceAiAgent::normalizeMessagesForApi().
CRON endpoint: /cron/ai-alerts?token=CRON_TOKEN (CRON_TOKEN guard via header/query) → runs artisan ai:budget-alerts. Idempotent via a cache key per (user, budget) with a 7-day TTL.

Thanks for using Treziqo. Send bugs and ideas to info@treziqo.com.

Treziqo v1.8 — Same picker everywhere, in-depth analytics, control over reports

The eighth release straightens out three areas that were all over the place: category selection works the same on /transactions/new, /edit, and in /quick (drill-down picker), /analysis can filter by account + category and shows the actual transactions below the charts, and you can hide categories from stats in /categories — transactions in them stay visible and searchable, but don't affect the dashboard or reports.

🎯 Drill-down category picker — unified UX

We had four different category picker variants across the app (different UX for a new transaction, for edit, for a quick transaction, for filters). They are now unified into a single widget with consistent behavior everywhere:

Click a category without children → selects it
Click a category with children → opens the drill (shows its subcategories)
At the top of the drill view, "Select: <Parent>" is highlighted — in case the user wants the parent itself
"← Back" goes up one level
A chevron on the card indicates it can be drilled into (mouseover hint)
A pre-populated edit form auto-opens at the parent level of the selected category — the user immediately sees what is selected

No dual-click chaos — clicking a parent always drills in, never selects it. To select the parent, there is an explicit yellow "Select:" tile.

Implementation: a new Blade component <x-form.category-picker> applied to /transactions/new, /transactions/{id}/edit, /quick. The multi-select in the /transactions filter panel and in /analysis stays <x-form.multiselect-search> (a different use case).

📊 `/analysis` — account/category filters + a table of actual transactions

Analytics gained two big capabilities:

Filters under the period picker

Under the existing pills (Day / Week / Month / …) there are two multi-selects: Accounts and Categories. Categories automatically expand the subtree — pick the parent "IT & software" → the backend includes "Google Workspace + Microsoft + Antivirus + Eclipse" all together.

A hint under the categories shows how many subcategories were added: (+12 subcategories). The filter survives a period change — pick account + category, click the "Month"/"Year" pill, and the filter stays. The URL is bookmarkable (/analysis?preset=year&account_ids[]=5&category_ids[]=1467).

It applies to all 4 widgets (summary, cashflow, donut, year-over-year) — consistency guaranteed.

Table of actual transactions under the widgets

When the filter has at least 2 narrowing conditions (e.g. preset != all + account, or account + category), a paginated table of the transactions that make up the current analysis appears under the widgets. Columns: Date (click = edit), Account, Category (with parent › child), Note + tags, Amount.

Without this gate, the default "year" would load thousands of rows and the page would stretch unbearably. With 2+ conditions, you can be sure you're seeing the specific movements that make up the chart above.

🙈 Hiding categories from stats

In /categories, each of your categories has an eye icon. Click = visibility_off — the category switches to "invisible" mode for reports:

Transactions stay searchable and editable in /transactions, /search, and in the trash
Dashboard TOP 5 + yearly balance ignore them
Dashboard TOP 10 expenses/income of the year ignores them
/analysis donut + cashflow + year-over-year ignores them
The row in /categories gets an opacity-60 visual indicator

Typical use case: historical data contains categories like "Owner contribution" / "Investment deposits" / "From savings accounts" booked as income/expense, but they aren't real operating cashflow and would skew reports. For new data, semantic_type handles these cases via investment_transfer/liability_payment, but history needs a per-category dismiss button. No inheritance — each category on its own.

🗂️ Bulk-move categories under a different parent

When /categories holds a flat list of ~150 categories (typically after a bank import) and you want to organize them under logical parents ("Car & transport", "Travel", "Electronics"), just tick the checkboxes on the rows and pick the target parent in the fixed bottom bar.

Checkboxes work on nested categories too
The backend normalizes the selection: if you tick a parent and its child, the child is dropped from the set (otherwise moving the parent would split the tree)
The target dropdown offers only categories of the same type (income/expense/investment don't mix) and excludes descendants of the selected ones (cycle guard)
The "Top level" option = move to the top level (the type doesn't change)
With >5 categories selected, a confirm dialog appears before the action

🏷️ Bulk-attach a tag to transactions

Next to the existing bulk-changeCategory in /transactions, there's a second action: "Add tag". Select N transactions with the checkboxes, pick a tag from the dropdown, click "Add tag". The backend silently skips transactions that already have the tag, as well as those that would exceed the limit of 4 tags/tx — a flash message reports the breakdown: "Tag added to 47 tx (3 already had it, 0 skipped due to the limit)".

↩️ Back to the filtered list after editing

You had /transactions?types[]=expense&account_ids[]=5&date_from=2026-01-01 filtered, clicked edit → saved → and landed back on a clean /transactions with no filter. Annoying.

Now the filter is saved to the session when you visit the list, and after update() / destroy() you are redirected back to the original filtered URL. Searching in /search → click a row (rows are now clickable!) → edit → you return to the search results.

🔧 Small things

Clickable row in /search — the whole transaction row is now a link, and the edit icon lights up on hover. A click goes straight to the edit form (or /transfers for transfers — the show controller smart-redirects).
#ID after the category name in /categories — helps you find your way around a large tree, search in the admin, debug.
Transaction count badge on each category in /categories — receipt_long N linking to /transactions?category_ids[]=X. See at a glance which category you use the most, or which one is empty and can be deleted.
"Confirm import" button in the summary after an import — when rollback is blocked (manual transactions on newly created accounts), an explicit dismiss closes the grace period, and the section + global banner disappear.
Pagination in Czech — instead of "Showing 1 to 50 of 16180 results", paginators across the app now show "Zobrazeno 1 až 50 z 16 180 záznamů". Finally.

⚠️ Changes and upgrade

Feature	FREE	BASIC	PRO
Drill-down category picker	✅	✅	✅
/analysis account + category filter	✅	✅	✅
/analysis table of actual tx	✅	✅	✅
Hide category from stats	✅	✅	✅
Bulk-move categories	—	—	✅ (PRO has custom cats)
Bulk-add tag	✅	✅	✅
Back to filter after edit	✅	✅	✅

No migration tasks for existing users. After the upgrade:

If your reports contain categories that confuse you (e.g. "Owner contribution" in income), click the eye icon in /categories → a flash message confirms the hiding. You can click it back at any time.
In /analysis, try filtering by account + category — the chart recalculates and below it you'll see the specific movements.
To restructure your category tree, use the checkboxes + bottom bar to bulk-move categories under logical parents.

🛠 Under the hood

New Blade component <x-form.category-picker> — a drill-down single-select widget for /transactions/new, /edit, /quick. Architecture: no nested x-data, no x-modelable (timing race with pre-populated forms). Mixin pattern via a categoryPickerMixin() JS function spread into the outer Alpine x-data.
Data model: new column categories.excluded_from_stats (bool default false), idempotent guard Schema::hasColumn().
New Eloquent scope Transaction::scopeNotExcludedFromStats() — DRY across 5 aggregation queries (Dashboard TOP 5, yearly balance, TOP 10 leaderboard, Analysis donut + cashflow). Previously duplicated inline 4× and forgotten in TOP 10.
POST /categories/bulk-move — defense-in-depth pipeline (ownership / type-match / cycle guard / selection normalization). 3 layers of protection against unwanted tree flattening or IDOR.
POST /transactions/bulk action=add_tag — idempotent (insertOrIgnore for race-safe handling of concurrent requests on the composite PK tag_transaction(tag_id, transaction_id)).
/analysis subtree expansion — BFS over a pre-loaded parent_id map from 1 SELECT, no N×depth roundtrip. RBAC scope: silent drop of unauthorized IDs in array_intersect.
AnalysisController::index went through a refactor: 5 fixes from code review (HIGH: insertOrIgnore on bulk-tag race, accessibleAccountIds Collection vs array_intersect TypeError; MEDIUM: scopeNotExcludedFromStats DRY, dead $accessibleIds param, _tree_node :class outside Alpine scope).
Memory gained a new pitfall feedback_blade_x_component_in_js_comments.md — the Blade compiler parses <x-component> syntax even in JS docstrings inside <script>, which breaks the compiled view (we hit it 2× during today's refactor).

Thanks for using Treziqo. Send bugs and ideas to info@treziqo.com.

Treziqo v1.7 — Try it free, plan precisely, confirm quickly

The seventh release changes three things that touch your daily routine: sign-up now comes with a 14-day trial without payment details, the liability payment schedule handles refixation and per-diem calculation of the first installment (accuracy against the bank < 1%), and recurring payments in "Remind only" mode are collected in a new inbox with quick confirmation and the option to adjust the actual date and amount.

✨ 14 days free — sign-up without payment details

Pricing for new users is changing:

Plan	CZK	EUR	USD
Trial (first 14 days)	free	free	free
Basic	69 Kč / mo	€2.99 / mo	$3.49 / mo
Pro	149 Kč / mo	€5.99 / mo	$6.99 / mo

After sign-up you get 14 days free — no card, no PayPal. Just click and you can do everything.
Early activation — at any time during the trial, click "Activate plan" on the dashboard and confirm PayPal. You don't lose your remaining free days — the PayPal trial cycle additionally runs 14 days, so you can have your first ~28 days with us covered without being charged.
When the trial expires without activation — the account is suspended (your data stays), and the app asks you to confirm payment. After activation you pick up right where you left off.
Existing subscribers stay on the original price (49/99 Kč). A loyalty bonus.

In the /admin/users administration you see each user's trial status (days remaining / expired / has a PayPal subscription / no trial) as a micro-badge below the plan badge.

📅 Liability payment schedule — precision and flexibility

We introduced the amortization plan back in v1.6. v1.7 brings it to production quality:

Per-diem calculation of the first installment

Banks usually charge interest from the drawdown date, not from the signing of the contract — and the first period is often shorter than a full month. A standard annuity calculates it as 1/12 of a year, which means a systematic deviation of hundreds of crowns for loans taken out mid-month.

New fields when editing a liability:

Drawdown date — the day the money physically arrived (typically 1–3 days after signing). If you leave it empty, it falls back to the signing date.
Day-count convention — act/365 (default, most Czech loans) / act/360 / 30/360. You'll find it in your contract in the "interest" section.

The algorithm calculates the very first installment as interest = balance × rate × days / N; the second and later installments use the standard annuity. When the plan is regenerated (with paid rows already present), per-diem isn't applied again — the balance already reflects the previous payments.

Example: ČSOB loan 1 M @ 4.99% p.a., signed March 19, first installment April 14.

Before the fix: interest 4,158 Kč (−805 Kč off from reality)
After the fix: interest 3,418 Kč (−64 Kč off from reality) — the error dropped by 92%

Interest rate changes (refixation, refinancing)

Mortgages typically change both the rate and the installment when the fixation period ends. Instead of regenerating the whole plan with new parameters, you now add a rate change with an effective_from date:

In the liability detail, the "Interest rate changes" section:

A table of existing changes (date + rate + new installment + note, delete)
Add form: effective date, new rate (% p.a.), new monthly installment, optional note

For each installment in the plan, the algorithm then picks the latest rate change with effective_from ≤ due_date, otherwise the default from the liability edit. After adding one, click "Regenerate future installments" — installments before effective_from run at the old rate, and from that date on at the new one.

Plan from the start + mark past installments as paid

For a liability you've been repaying for a while and want to catch up on retroactively:

"Plan from the start…" → a modal with the checkbox "Mark past installments as paid"
If you check it (and the liability has a linked account) → a real payment is created for each past installment (Transfer + Transaction), the money is deducted from the account, and the remaining principal is reduced
If you don't check it → past installments stay as planned/overdue (in red), and you pay them manually via "Pay"

Race-safe: the pre-check of existing payments runs inside a DB transaction with lockForUpdate on the liability — a double submit from the browser won't create duplicate payments.

Editing an individual row in the plan

Every row in the schedule (except skipped ones) now has an edit icon. Clicking it opens a modal:

Due date
Principal (the only editable amount)
Interest = read-only, auto-derived as total − principal − fee
Fee
Total = read-only (the bank deducts a fixed installment; only the internal split changes)

For paid rows, the linked LiabilityPayment, Transaction.transaction_date/amount, and current_principal (by the difference in principal) are synchronized, with automatic status PAID_OFF ⇄ ACTIVE.

Automatic creation of a recurring payment

After the payment schedule is generated, a RecurringItem is created automatically with target_kind=liability_payment:

Monthly frequency, payment day = the liability's installment_day, anchor = the first planned row
Amount = monthly_installment, source = liability.account_id
Mode defaults to remind_only (the user confirms via the inbox)

When an occurrence is generated, a matching planned installment is looked up in the schedule (±3 days + amount ±0.5 Kč) — if it matches, the exact annuity split (principal/interest/fee) is used, the installment is marked paid, and current_principal goes down only by the principal (not the whole amount). Fallback (no match): a custom payment outside the plan.

✅ Pending confirmations inbox (`/recurring/inbox`)

Recurring payments in "Remind only" mode generate PLANNED occurrences that wait for you to confirm reality. Instead of going through each recurring item separately, you now have a central inbox:

Topbar badge (next to the dark mode toggle) shows the number of pending items. Click → /recurring/inbox.
"Confirm pending" button with a count badge on /recurring.
Grid of cards sorted by due_date (overdue at the top, in red):
- Tint per target_kind (investment green, liability red, transfer blue)
- Item icon + name + account(s, with an arrow for transfers)
- Expected amount on the right
- Clicking "Confirm" expands an inline form: actual date (default = due_date), actual amount (default = expected), optional note
- Submit creates a Transaction via service.executeCycle (respecting target_kind) and marks the occurrence CONFIRMED
Skip action next to Confirm for cycles that won't happen (refinancing, one-off exceptions)

🔁 Recurring payments — a new type and visual distinction

Internal transfer (transfer between your own accounts)

A new target_kind=internal_transfer for the typical "salary from the company to personal" or "automatic saving from checking to savings" scenario. Instead of two recurring items (expense + income), a single Transfer record with from_account + to_account + amount.

The card in /recurring shows both accounts with an arrow and a 2-column amount grid — −amount on the source account, +amount on the target. It's visually clear where the money goes.

V1 is same-currency only. Cross-currency (CZK → EUR between your own accounts) is postponed to V2 — it requires a daily exchange rate lookup.

Visual distinction of cards

Cards in /recurring have a light colored tint by target_kind:

🟢 Investment (deposit) — emerald tint
🔴 Liability (payment) — rose tint
🔵 Transfer between accounts — blue tint
⚪ Regular expense/income — no tint

Dark mode variants keep a subtle opacity (900/20 → 30 hover) instead of light (50/60 → 100), so the tint is recognizable but doesn't dominate on the slate-950 background.

📰 News feed and logo branding

Public news feed at /news — all published news grouped by month, full body, no auth. Plus the 8 newest in the login sidebar carousel.
Admin CRUD for news in /admin/news — text management with CS+EN per-row content, draft / publish toggle, ordering via sort_order.
Logo from the admin upload everywhere:
- Transactional email headers get a 48×48 logo (from the /admin/general upload)
- PWA install icon (Android Chrome / iOS "Add to Home Screen") via a dynamic /manifest.json endpoint
- Favicon + apple-touch-icon in all layouts (login, register, news, landing, dashboard) via <link rel="icon" href="logoUrl()">
- A logo change in /admin/general takes effect within an hour (Cache-Control 1h) — no redeploy

🗑️ Safer deletion of transactions from the trash

/transactions/trash now has bulk selection (a checkbox on each row + select-all) and a sticky toolbar with a "Delete selected" button. Clicking it doesn't delete right away — instead:

The backend creates a one-time token (SHA-256 hash, 15-min expiry) and sends the plaintext by email
You click the confirm link in the email → the server consumes the token and deletes the transactions atomically (incl. Transfer-pair handling)

Handy when you want to clean out the trash and also have an email audit trail. Single use + 15-min expiry + scoped to user_id (a token in someone else's email doesn't work).

🔧 Small things

Account order in the transaction form — /transactions/new on desktop now respects the user-defined sort_order from /accounts (mobile already did; now unified)
Dynamic default prices — all pricing spots (landing, register, admin user-plan picker) read from the plan_prices table. Single source of truth = /admin/plans. A price change by the admin shows up in the UI immediately without a redeploy.
PayPal webhook: 400 Bad Request for an invalid signature / missing headers (previously 202). Clean code semantics: 200 ok, 202 benign probe, 400 client error (no retry), 500 our error (retry).
Logout 419 fix — when a user leaves a tab open past the session lifetime and clicks logout, instead of "Page Expired" there's a smooth redirect to /login.
New "School" subcategory under Kids — for school attendance expenses (fees, supplies, lunches, field trips), separate from "Preschool".

⚠️ Changes and upgrade

What's available where

Feature	FREE	BASIC	PRO
14-day free trial	✅	✅	✅
Payment schedule (per-diem, refixation, edit)	—	—	✅
Pending confirmations inbox	✅	✅	✅
Internal transfer recurring	✅	✅	✅
Bulk delete with email confirm	✅	✅	✅
News feed on /login + /news	✅	✅	✅

What to do after the upgrade

Nothing. No migration tasks for existing users:

If you have a liability with a payment schedule, you can add the drawdown date and day-count convention in the liability edit → click "Regenerate" → the plan is recalculated per-diem.
If you want an auto-created recurring installment, generate the liability plan again — the RecurringItem is created automatically (idempotently, it doesn't clone an existing one).
If you have recurring items in remind_only mode, you'll find the PLANNED occurrences in /recurring/inbox.

For existing subscribers

If you signed up before v1.7 and have an active PayPal subscription, you keep paying the original price (49/99 Kč). A PayPal subscription is tied to the original billing plan — it won't be raised without you explicitly switching to the new plan.

🛠 Under the hood

Data model: new columns users.trial_ends_at, liabilities.{drawdown_date, day_count_convention}, recurring_items.{to_account_id, to_account_currency_id}. New tables liability_rate_changes, pending_bulk_actions, news_posts.
Race condition fix in LiabilityAmortizationService::generate(mode=full + markPastAsPaid) — pre-check of existing payments inside DB::transaction with lockForUpdate on the liability row. Previously two parallel requests both saw 0 payments before the first one committed and created duplicate simulated payments.
Single source of truth for prices — the View Composer PlanPrice::activeKeyedByPlanAndCurrency() injects $planPrices into the landing, register, checkout, admin.user-plan views. UserPlan::priceCzk() deprecated.
PayPal billing plans — the admin created 6 new plans in PayPal Business (Basic/Pro × CZK/USD/EUR), all with a 14d trial cycle. The set_v17_paypal_plan_ids migration writes the IDs into plan_prices.
Defense-in-depth security audit (2026-04-25) — Rule::in($accessibleAcIds) on from_account_currency_id in LiabilityController storePayment + storeDrawdown. No CRITICAL/HIGH vulnerabilities.
Laravel 11 gotcha — the base Controller has no middleware() method (moved to the HasMiddleware interface). A defense-in-depth fix in Admin\NewsPostController::__construct threw a 500; removed, the route-level admin group is enough.
Idempotent migrations everywhere — v1.7 adds 9 new migrations (trial_ends_at, drawdown_date, day_count_convention, rate_changes, pending_bulk_actions, force_update_translations, set_paypal_ids, to_account_id on recurring, news_posts). All hasTable/hasColumn guarded.

Thanks for using Treziqo. Send bugs and ideas to info@treziqo.com.

Treziqo v1.6 — Faster work with transactions and more personal accounts

The sixth release is about routine — what you do often, you can now do faster and with fewer clicks. Bulk edits right on the transaction list, a custom icon and color for every account, separate views for regular transactions vs transfers, and several layers of convenience in quick entry. On top of that, a more modern payment schedule for mortgages and loans and a daily safety net for PayPal payments (even if a webhook never arrives).

☑️ Bulk transaction edits

Select several transactions at once (the checkbox on each row or "select all") and bulk actions appear in the toolbar:

Delete selected — instead of deleting one by one, you click once. Deleted items go to the trash (30-day recovery).
Change category — move a whole group of payments under a different category at once. Useful after an import, when you accidentally filed 50 transactions under "Other" and now want them under "Transport".
Change account — move the whole selected group between wallets.

Works on the main /transactions overview and on /transfers (where the transfers are).

🔀 Separate views — transactions vs transfers

We've split the overviews in two, so each has a clear purpose:

/transactions — regular income and expenses (money coming in / going out)
/transfers — transfers between accounts (money moving around)
/investments — deposits into and withdrawals from investments (staying within the investment envelopes)

On desktop you'll also find a sidebar on the left for quickly switching between types without going through the main menu. The mobile version keeps a simpler single screen; the sidebar isn't shown.

🎨 Custom icon and color for every account

When editing an account in /accounts, you now choose:

An icon — from a grid of Material Icons (wallet, credit card, piggy bank, crypto, …) depending on what the account represents.
A color — from a palette that carries over to the dashboard, the transactions list and the quick-entry account picker.

You see the changes immediately across the app — no refresh, no cache flush.

⚡ Quick entry — faster and nicer

The quick transaction entry form got a layer of improvements:

Top-10 tags — instead of typing a note, you're offered your 10 most frequently used tags as clickable chips. One click for a tag, done.
Account picker = icon-only — instead of long text like "ČSOB · CZK", just the clean account icon. You can tell at a glance where the transaction goes.
Currency chip — the currency as a uniform chip next to the amount. Consistent with the account tile style.
Airier layout — larger spacing, subtle shadows. Easier on the eyes.

💰 Payment schedule for liabilities (PRO)

For mortgages, loans and leases you now have a payment schedule in the liability detail:

Amortization — an automatically generated breakdown split into interest and principal based on the interest rate and repayment term.
Manual plan — when you have non-standard payments (an extra amount, a payment holiday month), you can edit the plan manually.
Linked to payments — when you pay in /liabilities, the payment is automatically assigned to the corresponding schedule row.

📅 Daily payment sync from PayPal

Webhooks are fast, but sometimes they don't arrive (firewall, provider outage, network glitch). A daily cron now additionally:

Downloads the payment history for every active subscriber from the PayPal API.
Fills in missing Payment records idempotently (no duplicates).
Sends a log if something doesn't stick — the admin then sees where the gap was.

In practice: even if a webhook gets lost, your payment shows up in /settings → My payments within 24 hours at the latest.

🏦 Better MyBank import

Continued fine-tuning of the wizard from v1.5:

Phase mapping — the wizard steps accounts / categories / commit are clearly separated, so you see which phase you're in.
Per-group cashflow + period — for each MyBank group you see the sum of income/expenses and the period the data comes from.
Earlier duplicate detection — instead of only at commit, duplicates from a previous import are caught already in review.
"Try again" for a FAILED import — if the commit failed halfway (network drop, server restart), you click one button and Treziqo finishes the rest without losing work in progress.

⚠️ Changes and upgrade

What's available where

Feature	FREE	BASIC	PRO
Bulk transaction edits	✅	✅	✅
Separate /transactions vs /transfers	✅	✅	✅
Per-account icon + color	✅	✅	✅
Quick entry — top-10 tags + icon picker	✅	✅	✅
Payment schedule (amortization)	—	—	✅
Daily PayPal sync (admin)	super_admin only	—	—

What to do after the upgrade

Nothing. No migration tasks. Existing accounts keep the default icon and color — you can change them whenever you like.

🛠 Under the hood

PayPal webhook hardening — the endpoint returns 400 Bad Request for an invalid signature / missing headers (instead of the original 202). The status code semantics are now clean: 200 OK (processed), 202 Accepted (benign probe), 400 Bad Request (client error), 500 Internal (our error → PayPal retries).
PayPal getSubscriptionTransactions() — a new API call for the daily payment sync. Idempotent writes via UNIQUE provider_transaction_id.
Domain split of controllers — TransactionController (income/expense) vs TransferController (transfers between accounts). A shared trait for common validations.
accounts.icon + accounts.color — new columns, default values for existing records.
<x-icon-grid-picker> — a reusable Alpine component with a full-text filter over the Material Icons catalog.
/transactions/new desktop sidebar — a sticky type switcher (income/expense/transfer/investment) with safe routing to the right form.
Login screen news feed — news_posts table + NewsPost model + NewsPostSeeder (release-based content). The login right panel renders the top 12 published.
Register hero showcase — an Alpine carousel with 3 locale-aware screenshots + floating info bubbles outside the image bounding box.
Idempotent migrations + post-deploy hook — all new migrations have a hasTable/hasColumn guard; the post-deploy hook runs opcache_reset first, then migrate + seed + cache:clear.

Thanks for using Treziqo. Send bugs and ideas to info@treziqo.com.

Treziqo v1.5 — Pull in your history, invest in multiple currencies, lock down your account

The fifth release is about two big topics: you can finally import a year back from a MyBank export (instead of retyping it by hand) and your investments can hold multiple currencies at once. On top of that we've strengthened personal security — two-factor login, email change verification, an overview of signed-in devices — and added several layers of convenience across the app.

📥 Import from MyBank XML (`/import-export`)

Have a year of history in the MyBank mobile app and don't feel like retyping it by hand? Export it as XML (in MyBank: Settings → Data export) and Treziqo will import it, including accounts, categories and transfers:

Step-by-step wizard — you upload the file, then decide step by step how to map accounts and categories. Before the final save you see an exact summary ("147 transactions, 4 accounts, 8 categories will be created").
Three modes for each account in the export:
- Create new — creates a Treziqo account, including currencies and initial balances from the XML
- Match to existing — use an account you already have in Treziqo; optionally you can overwrite the initial balance with the value from the XML (useful when MyBank holds a more accurate number than Treziqo after a manual edit)
- Exclude — the account isn't created, but transactions can be routed purely through categories (handy for the MyBank "Investment" purse, where the account itself isn't interesting)
Categories with icons — MyBank Groups carry their emoji icons over into the created categories. No need to manually pick "which smiley for travel".
Investment opt-in gate — if you check "the export contains investments", the wizard offers mapping to investment products. Without the check, investment categories are skipped automatically (a user not interested in investments isn't forced to map them).
Transfers between accounts — even when the other side of a transfer is missing (a transfer to a bank you don't track), the movement isn't lost — it's saved as a one-sided record in the system category "Transfer in" / "Transfer out".
You can discard an import in progress — if you change your mind before confirming, click "Cancel" in the /import-export overview and nothing is saved anywhere.
72h rollback — after confirming the commit you have 3 days to reconsider. Click "Revert import" and all created accounts, categories and transactions are deleted again (unless you've edited them manually in the meantime — in that case we warn you).

It's all visible in a new panel on /import-export — completed and in-progress imports in two columns.

💹 Investments in multiple currencies

Had an ETF in USD but want to track contributions in EUR as well? Now you can:

Allowed currencies per product — for each investment product you set a whitelist of currencies you may hold in it. The primary currency is the main one (the total balance is shown in it); the others act as secondary buckets.
Currency choice per contribution — for every deposit and withdrawal you choose which currency it's in. No need to remember exchange rate conversions — we store them along with the transfer.
Secondary currencies in the overview — /investments shows a gray sub-line below the primary amount with invested × current × delta per currency. You see the individual currency buckets instead of a confusing mixed total.
More product types — we added subtypes for collectibles (coins, stamps, art, wine…) + more for pension savings, building savings and crypto.
Tags as "purpose" labels — you can assign tags like "retirement", "kids", "reserve" to products for future reports like "how much have I set aside for retirement across all products".
Bulk deletion — the danger zone in investment settings lets you remove all products at once (with double confirmation, of course).

🔐 Two-factor login + account security

New sections in /settings/security for stronger account protection:

2FA via TOTP — turn on an authenticator (Google Authenticator, Authy, 1Password…) and enter a 6-digit code when signing in. Backup codes are included in case you lose your phone.
Email change verification — if you change your account's main email, we send a 6-digit code to the new address. The change takes effect only after verification; until you enter the code, the old email stays active.
Overview of signed-in devices — /settings/sessions shows the devices, browsers and IP addresses where you have an active session. Sign out unfamiliar devices with one click; your current session stays.
Login history — when and from where you signed in, for auditing.

🌍 Time zone and the full list of currencies

Time zone — in /settings you choose your own IANA zone (Europe/Prague, America/New_York, Asia/Tokyo, …). All times in the app are converted to your local zone — no more "it happened at 2:00" for a transaction from Monday morning.
Full ISO 4217 catalog — instead of 15 manually maintained currencies you get all 180+ world currencies. The picker in account, wallet and product settings supports full-text search ("euro" finds EUR, "yuan" finds CNY).

⚙️ Small things in settings

Multi-column settings hub — /settings is now a clear dashboard with cards (account, family/RBAC, plan, security, …). Plan and family are no longer tucked away in a submenu — you see everything at once.
Categories with ordering — the order in /admin/categories and /settings/categories respects your manual changes. For a long time we sorted alphabetically; now you can keep a "Main" category at the top without any tricks.
3-column category admin — /admin/categories has a new layout (groups on the left, child categories in the middle, preview on the right) — working with a larger budget is faster.

👥 Admin — user archive

In /admin/users you'll find two buttons instead of a single "delete":

Archive — the user loses access, their data remains. Reversible (restore with one click).
Permanently delete — goes through a "trash", requires confirmation with the administrator's password, irreversible. Used for compliance (GDPR "forget me" requests).

⚠️ Changes and upgrade

What's available where

Feature	FREE	BASIC	PRO
MyBank XML import	✅	✅	✅
72h import rollback	✅	✅	✅
Multi-currency investments	—	—	✅
2FA + session revoke	✅	✅	✅
Email change verification	✅	✅	✅
Time zone (per-user)	✅	✅	✅
Full ISO 4217 picker	✅	✅	✅
Admin user archive	super_admin only	—	—

What to do after the upgrade

Nothing. 2FA is opt-in (you stay on password-only until you turn it on yourself). The time zone inherits your previously set one or falls back to Europe/Prague. The multi-currency whitelist on existing products contains only the primary currency — no migrations, no broken rates.

New imports run atomically — either the whole file goes through (all 147 transactions) or nothing does. While an import is in progress, you can discard it at any time. Once you confirm, the 72h rollback window starts.

🛠 Under the hood

IDOR hardening — review of all FK validations on user-owned resources; exists:categories,id replaced with Rule::in($accessibleIds) in TransactionController, QuickTransactionController and LiabilityController (hotfix 2026-04-19). A new mandatory checklist in docs/claude/security.md.
Import pipeline — XML on disk encrypted via Crypt::encryptString, atomic commit pipeline with a race-safe claim (WHERE stage='review'), UNIQUE key import_source_key for idempotent rollback lookup.
Upload MIME validation — mimetypes: whitelist with a fallback to text/html/text/plain (the PHP finfo sniffer misclassifies XML without a prolog).
Transfer salvage — when only one side of a MyBank transfer can be mapped, a solo Transaction is saved with SYSTEM_TRANSFER_FROM/TO. Commit warnings are human-readable (date, amount, currency, account name, reason for exclusion).
Native confirm() replaced with <x-confirm-dialog> — 26 callsites migrated to a consistent modal component with 3 modes (form / formId / onConfirm).
Dependency cleanup — removed axios (CVE-2024-39338, unused), lodash (unused), laravel/sail (we have no Docker setup). A new docs/claude/dependencies.md with a full audit of composer + npm packages.
CLAUDE.md split — architectural notes split into topic-specific files under docs/claude/*.md for faster orientation.
app/Helpers eager-load — global helpers registered via AppServiceProvider (fix for deploy-time autoload).
TransactionObserver — the soft-delete cascade nullifies the FK on investment_contributions.transaction_id and liability_payments.transaction_id (DB ON DELETE SET NULL doesn't trigger on soft-delete).

Thanks for using Treziqo. Send bugs and ideas to info@treziqo.com.

Treziqo v1.4 — Repetition, context and speed

The fourth release brings the things users asked for most loudly: recurring income and expenses (so you don't have to click the same thing every month), tags / flags (like colored labels on top of categories) and global search across the entire app. On top of that, a Trash for transactions for calmer deleting, and sorting + multiselect filters on all lists.

🔁 Recurring income and expenses (`/recurring`)

A new module for everything that repeats — salary, rent, insurance, Netflix, loan payments:

Any frequency — daily / weekly / monthly / yearly, even with a custom step (every 2 weeks, every 3 months).
Start + end — a validity range; ends automatically once the date is reached.
"Pay now" — one click generates the transaction for the current cycle without waiting for the cron.
Link to other modules — a recurring payment can be tied directly to a specific liability (a mortgage payment = automatically also principal repayment) or investment (no more manual monthly ETF contributions).
Web cron — no system crontab needed: a /cron/recurring endpoint with a security token that any scheduler can trigger (SvetHostingu panel, UptimeRobot, cron-job.org).

🏷️ Tags ("flags") — context on top of categories

Tags are a second dimension on top of the category tree. Categories answer "what is it" (Food → Restaurant), a tag answers "where / how / why":

Store context — "Billa", "Kaufland", "Lidl"
Nature — "reimbursable", "business", "luxury", "kids"
Anything — 20 characters per tag, max. 4 tags per transaction

Create them in /settings/tags: your own name + a color from a 9-keyword palette. Or one click on the starter set — 11 preset tags (Billa, Kaufland, reimbursable, business, gift, …) that you can edit or delete right away. Assigning when entering a transaction: colored clickable chips, done in 2 clicks.

What you won't find in M0 yet (coming in M1): filtering /transfers by tags, budget scopes on tags, group-by in analysis. For now tags are "just" visual context — but assigning them already stores the data for future filters.

🔎 Global search (`/search`)

One search bar in the header searches the entire app:

Transactions (description, amount, category)
Budgets (name, category)
Recurring items
Investment products
Liabilities

Results are grouped into five buckets with direct links. No more scrolling around "where did I record that amount in January" — type "120 Kč Starbucks" and up it comes.

🗑️ Transaction trash + permanent deletion

Transactions are no longer deleted permanently right away:

Soft-delete — a deleted transaction goes to the trash for 30 days and disappears from all reports, the dashboard and budgets.
Restore — one click in /transfers/trash and the transaction is back, including all its links.
Permanent deletion — an explicit "force delete" for transactions you never want to see again.

Safer for manual fixes: deleted the wrong transaction? Trash. Want it gone for good? Two clicks. No stress.

📊 Sorting and searching across lists

Six pages got clickable column headers for sorting (date / amount / name / …) and a multiselect full-text filter above the list:

/transfers, /budgets, /investments, /liabilities, /recurring, /categories

Typed text is searched in all relevant columns at once (name, note, category). You can have several filters selected at the same time (e.g. "account A or B" + "category X").

💼 Dashboard — "Investment portfolio" widget (PRO)

A new dashboard card for investors:

Portfolio summary — invested amount, current market value, P&L (profit/loss) as an absolute amount and in %.
Per-product breakdown — each investment product separately, colored by profit/loss.
Hideable — like all widgets, part of the dashboard layout.

Visible only to users on the PRO plan (because it depends on /investments, which is PRO).

⚠️ Changes and upgrade

What's available where

Feature	BASIC	PRO
Recurring income / expenses (Recurring)	✅	✅
Tags / flags	✅	✅
Global search	✅	✅
Transaction trash + force delete	✅	✅
Column sorting + multiselect filter	✅	✅
Investments dashboard widget	—	✅
Recurring → liability / investment (cross-module)	—	✅*

* The Recurring module itself is BASIC, but linking to /liabilities and /investments naturally requires the PRO plan (those modules are PRO).

What to do after the upgrade

Nothing. Everything keeps running — no migration tasks, no manual intervention. Set up recurring items whenever you want. Set up tags when it makes sense. The trash works automatically from now on.

🛠 Under the hood

PayPal webhook hardening — the /webhooks/paypal endpoint is now stateless (no session middleware), with a code matrix: 200/202 for protocol errors (benign probe, invalid signature, missing headers) vs 500 for internal errors (DB, cache, transport) — so PayPal retries legitimate events and we don't lose them. Detailed stage logging into a separate paypal.log with full diagnostics (headers, raw body, payload, reason).
<x-form.swatch-picker> — a reusable component for keyword-based color palettes (Tag::COLORS, later categories and statuses). Follows Option B from CLAUDE-UI.md §14 (no runtime bg-{$color}-100 composition).
Unified <x-confirm-dialog> — migration of 28 confirm() callsites to a consistent modal component with 3 modes (form / formId / onConfirm). No more blocking browser dialogs.
<x-sortable-grid> + <x-multiselect-search> — grid convention described in CLAUDE-UI.md, deployed on 6 lists.
Global /search — an orchestrator across 5 models with optimized queries (LIKE on indexed columns + per-bucket limit).
Web cron — endpoint with a hash_equals() token check, idempotent cycle execution, race-safe cursor update.
TransactionObserver extended — force delete cascade for attached tags; recurring_item links are nulled via ON DELETE SET NULL.

Thanks for using Treziqo. Send bugs and ideas to info@treziqo.com.

We've reworked the investment data model. Instead of a special transaction type, every deposit and withdrawal is now a regular transfer between two accounts — exactly like when you move money between ČSOB and your savings account.

What this means

Investment account = envelope. Every investment product (Bitcoin, ETF, building savings…) sits in some investment account. You can name it however you like ("Investments", "Crypto", "Pension") and it hosts one or more products.
A deposit into an investment creates a transfer from your bank account to the investment account. The bank account balance goes down, the investment account balance goes up — just like in real life.
A withdrawal from an investment goes the opposite direction. And yes, it also supports a transfer into a different currency with an exchange rate (product in USD → back to a CZK account).

New controls

On the investment product detail (/investments/{id}) you have three buttons:

Deposit — pick the source account, amount and date. The money is "poured" into the envelope.
Withdrawal — pick the target bank account. If the currency differs, just enter both amounts (we calculate the rate automatically).
Revaluation — unchanged; used to record the market value.

You'll recognize an investment account by…

…the new "Investment account" toggle being checked when you edit it in /accounts. If you create your first investment product and don't have such an account yet, we automatically create an "Investment" account for you in the product's currency. If you want more envelopes (crypto separately, savings separately), create another account manually and check the flag.

What happened to the old data

Since we were running in test mode, all old investment transactions were deleted (with the command php artisan investments:clear-legacy --force). New deposits and withdrawals now run on the new model.

Why the change

The original "investment as a special transaction type" was a pragmatic shortcut — it was enough for basic tracking, but it distorted the balances of regular accounts (when you sent money to an ETF, the ČSOB wallet showed the correct balance only thanks to a special deduction in the code) and it complicated adding withdrawals with an FX rate.

The new model is physically correct: money never disappears, it only moves. As a result, all existing mechanisms (transfers, FX rate, dashboard, budgets, analysis) work on investments exactly the same as on regular transfers, with no exceptions.

Technical notes

accounts.is_investment (BOOL) — new flag.
investment_products.account_id (FK) — which investment account the product lives in.
transfers.type — new column with the values internal_transfer / investment_contribution / investment_withdrawal.
investment_contributions.transfer_id (FK) — link to the Transfer pair.
The balance formula is back to initial + income − expense (without the special investment deduction — no longer needed).

What's still to come: in the dashboard widget we want to show invested / market value / P&L separately for investment accounts. This is phase 3 — the next iteration.

Treziqo v1.2 — Investments, Liabilities and cross-module integration

A big inward-facing sprint: new Investments and Liabilities modules plus deeper integration with budgets, the dashboard and analysis, so that every money movement finds its counterpart in the right report.

💼 Investments (new module)

A full-featured /investments for tracking investment products (stocks, ETFs, crypto, real estate, building savings, …). You track:

Contributions — how much you have actually put into the product
Valuations — the current market value
Link to transactions — a contribution can also be recorded as a transaction of type "Investment", and the system links everything together on its own.

Savings goal budgets now count these investment contributions too — so the goal "Building savings 21,000 / year" finally works even when you send the money through /investments.

🏦 Liabilities (new module)

A new /liabilities section for mortgages, consumer loans, leases, credit cards and family loans:

Tracking of principal, interest and fees in every payment
Automatic calculation of the overpayment (what the liability actually cost you on top)
Repayment progress bar, status lifecycle (active → paid off)
Automatic recording of the payment as a transaction — one click in /liabilities and the payment shows up in the dashboard balance, the "Loan payments" budget, /analysis and /transfers. No more double entry.

The system category "Loan payment" takes care of correct classification — you don't have to assign it manually.

🔗 Budget → transaction list (drill-down)

On a budget card in /budgets there's a new 📄 icon. Clicking it takes you to /transfers, pre-filtered exactly by the budget's scope:

Categories expand including all subcategories (a budget for "Food" also shows transactions from "Restaurants", "Groceries", …)
The period, account and assigned family member are filtered automatically
Transaction types (income / expenses / investments) are selected according to the budget's direction

So when you wonder "what actually counted toward this limit", one click gets you a list of the specific items.

⚠️ Behavior change — balance and investments

Important for users who recorded investment transactions on regular accounts (type "Investment" on a checking/savings account):

Before v1.2: investment transactions did not reduce the balance (the fiction that the money physically stayed in the account).
Since v1.2: the balance is reduced by investment transactions too — matching the reality that the money physically left the account to buy an asset.

After the upgrade you may see a lower balance on accounts where you recorded investments as direct transactions. Your total net worth (balance + investment value) doesn't change — it's just split into two real parts. The investment value remains visible on the dashboard in a separate "Invested" row on the account card.

If you want to restore the previous state, adjust the wallet's initial balance by the corresponding amount.

🛡️ Security hotfix

IDOR fix when assigning an account to a liability — account validation now also checks ownership (not just existence in the DB). A detailed audit identified and fixed 7 integration gaps between the new modules and existing reports.

🛠 Under the hood

Transaction semantics: a new semantic_type field (liability_payment, investment_transfer, regular_expense, …) distinguishes "why" a transaction was created, complementing the existing transaction_type (income/expense/investment), which drives aggregation.
Auto-infer: categories have a default_semantic_type, and the transaction form fills in the semantic type automatically based on the chosen category (with a direction guard against invalid combinations).
Soft-delete consistency: TransactionObserver nulls foreign keys in investment_contributions and liability_payments when a transaction is moved to the trash (FK ON DELETE SET NULL doesn't trigger on its own on soft-delete).
Perf: Liability::paymentSums() runs a single SUM aggregate instead of three separate queries, no N+1 on the liabilities list.
Drill-down API: Budget::drillDownParams() is the central source of truth for mapping budget → URL params, including recursive category descendants.

Thanks for using Treziqo. Send bugs and ideas to info@treziqo.com.

Treziqo v1.1 — Budgets, custom analysis and a dashboard that fits

The second release since v1.0. We're adding Budgets, significantly expanding Analysis, and you can now fine-tune the dashboard down to the last detail — hide entire widgets, individual account cards, and even sub-blocks inside the yearly overview.

🎯 Budgets (new module)

A full-featured /budgets module with CRUD. A single unified model covers every scenario:

Spending limit per category — e.g. "Culture 30,000 / year".
Limit for a specific account — e.g. "Company card 10,000 / month".
Limit per family member — e.g. "Son 300 / month" (you assign the budget to a member and they see only theirs in /budgets).
Savings goal — e.g. "Building savings 21,000 / year, so I get the state bonus". Calculated from income.

Filters can be combined freely (category + account + member at once = a precisely targeted budget).

Progress bars are colored by status: green → orange (once the set threshold is exceeded, 80% by default) → red (over 100%). A savings goal over 100% is blue = bonus.

Period: month / quarter / year (the range is calculated automatically from the chosen date) or a custom range.

Budgets are per-currency — a CZK budget tracks only CZK transactions, so it doesn't break because of missing exchange rates.

📊 Analysis — filter however you like

Analysis got a period switcher: day / week / month / quarter / year / all time / custom from–to range. The charts (cashflow bars + line, category donut, YoY comparison) adjust their granularity automatically — a short period is bucketed by day, a long one by month or year.

Drag & drop and hiding widgets now work in /analysis too — just like on the dashboard, you choose the order and hide what you don't want to see.

Year-over-year is no longer just "year versus year". It compares any chosen period against a period of the same length one year earlier.

🏠 Dashboard — polished down to the detail

Investment accounts

If you have an account with investments only (no regular income or expenses, initial balance 0), its card now shows the value of investments in that currency instead of "0 Kč". Mixed accounts (investments + regular transactions) show both.

Hide what you don't need to see

Click "Customize dashboard" and in edit mode you get three levels of hiding:

Entire widgets (Accounts / Recent transactions / Year overview) — via the eye icon on the right of the widget header.
Individual account cards — the eye icon on the card, same principle.
Sub-blocks inside widgets (new) — for example, turn off just "Recent expenses" and keep only income, or in "Year overview" hide the TOP investment categories and keep only the balances and TOP transactions.

Everything persists. Click "Done" and the layout is saved — neither logging out nor restarting your browser will mess it up.

Layout reset

The "Reset" button returns everything (order, hidden widgets, hidden cards, hidden sub-blocks) to the default state.

🛠 What's happening under the hood

Budgets: new budgets table with unified scope FKs, BudgetPolicy for RBAC, per-currency progress calculation.
Analysis: AnalysisController accepts ?preset=...&from=...&to=..., MySQL DATE_FORMAT + DATE_SUB(... INTERVAL WEEKDAY DAY) for weekly aggregation.
Dashboard: new users.dashboard_hidden_blocks (string IDs per sub-block) complements the existing dashboard_hidden_accounts (numeric IDs per account) and dashboard_layout (widget order + visibility).
Hideable-block Blade component (<x-dashboard.hideable-block id="..." />) — reusable for future widgets.

Thanks for using Treziqo. Send bugs and ideas to info@treziqo.com.

Treziqo v1.0 — first stable release

Welcome to Treziqo! This is the very first public version. Here's what the app can do.

💰 Personal finance management

Accounts and wallets — track any number of bank accounts; each can have several currency wallets (CZK, EUR, USD ...).
Transactions — income, expenses, investments and transfers. Categorization, notes, labels.
Categories in a hierarchical tree structure — you can build your own tree (Expenses → Transport → Car → Gas).
Dashboard — top income/expenses for the period, account balances.
Analysis (PRO) — cashflow chart, category donut, year-over-year comparison.
Import/Export (PRO) — upload a CSV from your bank or download all your data.

👨‍👩‍👧 Family (PRO)

Invite your partner or kids to your PRO subscription — you share accounts and categories.
Each member sees only what they have permission for (per module or per account).
Privacy-first: a child doesn't see transactions entered by their mother, even on the same account. The manager (you) sees everything.

💳 Payments and plans

Basic (49 Kč / 3 USD / 2 EUR per month) — basic finance management.
Pro (99 Kč / 5 USD / 4 EUR per month) — everything in Basic + analysis + custom categories + import/export + family.
Payments via PayPal subscription — secure, with automatic renewal. You can cancel anytime.
Payment history in /checkout — you see every payment with its date, amount and transaction ID.

🔒 Security and privacy

GDPR-ready: self-service export of your data as a ZIP (all accounts, transactions, categories, payments) and self-service account deletion (30 days to restore).
Password stored as an encrypted hash — we never see the plaintext.
Essential cookies only — no tracking, no advertising scripts.
HTTPS everywhere.

🌍 Multiple languages

Čeština and English — switch with a single icon in the top bar.
Prices switch automatically by language (EN → USD, CZ → CZK), or you can lock the currency in settings.

📬 Emails and notifications

Payment confirmation — after every billing cycle you get an email with the details.
Plan activation — as soon as PayPal confirms the payment.
Subscription cancellation — an email with the option to restore your subscription.
Password reset — the standard secure flow.

⚙️ For advanced users

Dark mode (automatic based on your system, or manually via the top bar).
PWA — the app behaves like a native one even in the browser; you can install it to your home screen.
Admin panel (super-admin only): management of users, translations, legal documents, price lists, payments.

Thanks for trying Treziqo. Send your feedback to info@treziqo.com — we read every email.

Release history

Bank and documents

Recurring payments

Blog and content

AI assistant

Fixes

For developers

Try Treziqo without signing up

More insight into your numbers

Documents and statements

Blog

What's next

The website speaks Czech to search engines too

Savings, investments and categories

Fixes

What's next

Mobile is now a full-fledged app

Sign-up and plans

Web

Privacy and measurement

Security and fixes

What's next

Bank statements: amounts that add up

Recurring payments

AI assistant

Plans, payments and sign-in

Currencies, news and privacy

What's next

Numbers you can trust

The AI assistant answers more reliably

Security and reliability

What's next

Snap a receipt, Treziqo does the rest

Improvements

Under the hood

What's next

AI reads statements even from banks Treziqo doesn't support yet

Import of ČSOB credit-card statements

Analysis no longer mixes currencies

Improvements

Under the hood

What's next

Share your bank statement straight into Treziqo (Android)

Withholding tax on savings-account interest

Improvements

Fixes

Under the hood

What's next

Tailored landing pages — families, entrepreneurs, investors

Drip email sequences + event-driven triggers

Budget alerts — redesigned email

Page management in admin

Improvements

Fixes

Under the hood

What's next

A 5-layer learning system for import categorization

Bank statements are now the primary import path

Account history — security audit log

Statement import — partial commit + UX polish

Improvements

Fixes

Under the hood

What's next

My currencies — no more 300 currencies in every select

Unified forms — liabilities, recurring payments, budgets, accounts

Redesigned checkout

Improvements

Fixes

Under the hood

Stripe Billing as a second payment provider

Auto-valuations for stocks and ETFs

Editing contribution history

Fixes

Improvements

Under the hood

What's next

Highlights

DMS — operational documentation under one roof

RBAC — a helper is an is_staff flag, not a 4th role

RBAC — a helper is an `is_staff` flag, not a 4th role

Mobile `/quick`