Privacy

A group holds the first names you enter, the expenses (amount, label, date, currency, who paid, who it is shared between), the settlements recorded, and the payment details you choose to add: an IBAN, or a PayPal, Revolut, Wise or Lydia handle.

If you attach a receipt to an expense, the photo is kept on our server for as long as the expense exists, and is deleted with the group. It is not encrypted, no more than the label and amount of the expense itself: encrypting it while “Restaurant, €84” sits in the clear beside it would be theatre. It is readable only by those who hold the group link.

If you back up your groups, we keep your access keys in a form encrypted by your browser. We cannot read them: the key that opens them is derived from your subscription key, of which we hold only a fingerprint.

If you turn reminders on, your browser gives us a notification address. It carries no name, no email address and no phone number: it is an opaque address, specific to that device, which we match to whichever member you are in that group. The notifications we send contain NO content, not even an amount: they wake the device, and the detail waits for you in the app. Nothing about your accounts passes through the notification services of Apple, Google or Mozilla.

No account is created. We ask for no email address, no password, no phone number. We do not know who you are.

No tracker, no analytics, no advertising identifier. The site loads no third party script. The only cookie we set remembers the language you picked, and nothing else. We sell nothing and share nothing for commercial purposes.

Most of it lives on your device, in your browser storage. That is what lets the app work with no network.

A copy is kept on our server, in Europe, so members of the same group can sync with each other. The server computes no balance: it stacks and redistributes.

Anyone holding the full share link. That link carries an access key, and holding it is enough: that is the price of working without accounts.

You can take a link back at any time from the group, which cuts off access for everyone holding the old one.

If you use receipt reading, the photo you provide is passed to Anthropic, which analyses it to extract the lines and returns the result to us. This transfer only happens on that specific action, never otherwise.

We do not keep the photo: only the lines you confirm join your group. This feature is optional, and everything else in the service works without it.

For as long as the group is useful. A group with no activity at all for a very long time may be erased by the operator during maintenance; active groups never are.

From a group, at the bottom of the page: "Delete this group". The expenses, the members and the payment details are then wiped from the server, for good, along with the device that asked for the deletion.

What this cannot do, and we would rather say it: the devices of other members that already synced keep their local copy. No service can pull back data already passed to someone else.

You have the right to access, rectify, erase, restrict and object. Rectification and erasure happen directly in the app, without writing to us. For anything else, write to the address given in the legal notice. You may also refer the matter to your supervisory authority.