PIN and storage protection
The app can be locked with a four-digit PIN: turn on “Passcode” in Settings and pick a code. From then on every launch starts by asking for it.
Wrong entries are counted: the first five are free — everyone mistypes — and after that a pause appears between attempts: half a minute, a minute, two, four, and five minutes at most. The pause survives closing and reopening the app.
There is deliberately no “Forgot PIN?” button on the lock screen. Such a button usually offers to wipe the data — which hands whoever found your phone exactly what they want. If you have forgotten your own PIN, you will have to import your backup into a clean browser.
And honestly about the limits: a PIN locks the way in, it does not encrypt your records. Anyone who can open the browser's developer tools will see the data without the code. This protects against someone picking up your unlocked phone, not against a specialist deliberately after your spending.
“Protect storage” is a different thing that happens to sit nearby. It asks the browser not to delete the app's data when the device runs out of room. It is not about privacy and does not guard against a manual cleanup.