Privacy Policy

If you have questions about anything below, email support@sharedfinance.app.

1. Who runs Shared Finance

Shared Finance is operated by Shared Finance ("we", "us", or the "controller" for UK / EU GDPR purposes).

Support email: support@sharedfinance.app
A postal address for the operating company will be published here once its registered office exists.

2. What data we collect

We only collect what the app actually needs to work. Nothing is sold, and we do not use your data for advertising.

We do not collect precise location, contacts, health data, browsing history, or advertising identifiers. We do not track you across other apps or websites.

Automatically collected

Subscription savings comparisons. When you choose Find savings, the app downloads a public catalogue from our Supabase service and compares it with bills from your current space on your phone. The catalogue request sends no account sign-in token, bill amounts or profile, household or bill identifiers; ordinary connection information such as your IP address reaches the service. Public catalogue data may be kept on your phone for up to 24 hours. The country, plan and eligibility answers you confirm stay in the open screen's memory; they are not saved to our servers or sent to subscription providers. We do not request provider passwords or automatically change subscriptions. The app reads your App Store storefront through Apple's StoreKit to determine whether an external offer link is available. If you choose to open a provider or approved affiliate page, your browser contacts that destination under its privacy and cookie policies. A link marked as an affiliate link may include a fixed referral code that identifies Shared Finance and may earn us commission. We do not add your bill amounts or app identifiers to the URL and do not record clicks or conversions in the app. Affiliate commission does not determine which deal we recommend. No affiliate programmes are configured initially.

Delivery-membership comparisons. After you choose a market in Delivery memberships, the app downloads a separate public catalogue of reviewed membership terms from Supabase, without an account sign-in token, your spending, selected country, or profile or space identifiers. Ordinary connection information such as your IP address reaches the service. Public terms are usable from the phone's cache for at most one hour and expire sooner if the terms do. The fees, expected order counts and eligibility answers you choose to save for a reviewed plan stay only on this device, separately for your account, selected space and plan revision, and are cleared when you sign out. They are not shared with other household members, our servers, the assistant or providers. Calculations run on the phone and are estimates based on your assumptions. Opening a provider's ordinary link is your choice and contacts that provider under its own privacy and cookie policies; no financial details or app identifiers are added to the link. This feature does not enrol you or change a membership.

Reviewed spending options. When you choose a country in Spending options, the app reads a public catalogue without sending your account token, transactions, categories, merchants or profile and space identifiers. It matches reviewed category and merchant aliases against recent expenses on your phone. Public offers may be cached for up to one hour or their expiry, whichever comes first. A matching offer is not a prediction of savings or confirmation of eligibility. Opening a provider is optional and contacts its website under its own policies; no transaction details are appended to its link.

Grocery store comparisons. When you open a price comparison, the app requests a public, reviewed grocery catalogue from Supabase without your account sign-in token, shopping list, selected area, product choices or profile and space identifiers. Ordinary connection information such as your IP address reaches the service. Public prices may be cached on your phone for up to one hour, or until the catalogue expires if sooner. Your coarse shopping area and confirmed product matches are kept on this phone, separately for your account and space, and cleared when you sign out. Store comparisons and basket totals are calculated on the device. Selecting a comparison store does not mean you bought anything there. Opening a retailer website is optional and contacts it under its own privacy and cookie policies; the app adds no list or financial details to the link. We do not place orders or connect your retailer account.

Country-based website pricing. Our existing website delivery provider, Amazon CloudFront, infers a country from your connection to choose the displayed pricing currency. We do not request GPS permission or send your IP to an additional location service. The pricing endpoint returns only a country code and is not cached. This feature does not store a location history, create a database record, or save a currency preference in your browser. A VPN may affect the result; Apple shows the final storefront price before an in-app purchase.

• Approximate device info used by Supabase to serve requests (IP address, user-agent string). Held for a short period for abuse prevention and then discarded.
• Website visit logs. Since 10 September 2026 our CDN has recorded each request to sharedfinance.app: the date and time, the path, the HTTP status and method, the browser's user-agent string, the referring page, and the country the request came from. It does not record your IP address, nor any cookie or identifier — those fields are deliberately excluded from what the CDN is asked to write, so a visit cannot be tied back to a person or joined up with another visit. We use it for one thing: to know whether anyone is visiting the site and roughly what devices they use, which we could not tell at all before. Deleted automatically after 30 days.
• Local device storage — the app stores a Supabase session token in the iOS Keychain, plus a random code used only to revoke this phone's push registration after logout — and, if you connect a spreadsheet, the Google sign-in that lets the app add rows to it (§4.7) — and small preferences in UserDefaults. These stay on your device. A bank message you share into the app is also held on the device — in the app's own shared storage, so that the part of iOS that receives a share can pass it to the app — until you add the spend or remove the message, and for no more than 14 days, and it cannot be read while your phone is locked. What the message says is worked out on your device, and neither the message nor anything read out of it is sent anywhere unless you tap to add the spend, which saves the amount, name and date you confirm and nothing else. Receipts and statements you share into the app are held the same way, on the device, until you save or check them or remove them, and for no more than 14 days.
• Diagnostics when something fails. When a part of the app fails — most often a statement it cannot read — it records what happened so we can fix it: the operation, an error message, a random install identifier, a session identifier, the app version and platform, plus the outcome, the bank name and a layout signature.
  This can happen before you have signed in — on the sign-in screen, for instance. A report made then is not linked to any account: it carries the install and session identifiers and nothing that names you or a space.
  For a PDF that signature is a derived shape (txt:dayFirst|-|no|bal). For a CSV it is that file's column headings, letters only and cut to 64 characters — csv:Date|Description|Money-out|Money-in|Balance. Headings, not rows: no amount, no payee, no balance and no transaction ever goes in. We spell this out because "no file content" would be the tidier sentence and it would not be true.
  Kept 90 days, then deleted. Readable only by an app administrator.
• What the assistant cost. One row per call to the assistant: which action, which model, how many tokens, whether it worked. No prompt, no answer, no statement text — the content of a call is never stored here, only its size. (The only way the content of a conversation is kept is if you turn on Help improve Tally or send us a conversation — see the table above.) Linked to you for 90 days so we can honour a quota and answer "why was I charged for this"; after that the link to you and your household is erased and the row survives only as a cost. The row itself goes at two years. Each row also carries which version of Tally’s instructions answered the call — a short code, not text — and, for a question to Tally, a random code that ties together the steps of one question.
• Assistant admission records. Before an assistant action or connected AI tool runs, we record your account identifier, the kind of action, an opaque request identifier, its admission time, a short-lived concurrency lease, a weighted usage count and an estimated provider cost before a call and, if complete usage is returned, afterward. These records enforce per-account request and concurrency limits and a shared project budget. They contain no question, answer, tool arguments, financial figures or household identifier. Ordinary app users cannot read them. A daily job deletes the records after 90 days, or they are deleted sooner if you delete your account. The project’s monthly total is stored separately without account identifiers; it is deleted after 95 days.
• What a question to Tally did. One row per question you ask Tally: how many steps it took; which of its tools it used, by name only (“list transactions”, “get balances”) — never what it looked for or what came back; how long it took; how it ended (answered, stopped short, declined); how many changes it proposed and how many of those our checks refused; and how many figures in its reply we could and could not match to the figures it was shown. No message, no reply, no figure, no name, no amount — the row says how a question went, never what it was. We use it to find which kinds of question Tally gets wrong and whether a change to its instructions made that better or worse. Linked to you for 90 days, then the link to you and your household is erased; the row goes at two years. Readable only by an app administrator.
• Whether a reply from Tally helped. If you tap thumbs-up or thumbs-down under a reply, we record which, and — for a thumbs-down, only if you pick one — a reason from a fixed list (“Wrong number”, “Misunderstood me”, “Did the wrong thing”, “Too long”, “Something else”). You can take a rating back by tapping it again, which deletes it. The app also records, without you tapping anything, that you undid something Tally had just done (within a minute), asked the same question again (within two minutes), or changed an expense Tally had just logged (within ten minutes) — that it happened, never what you said or what changed. Each record carries the code of the question it was about (above), the kind of record, the reason if any, and the time. No message, no reply, no amount and no free text — there is nowhere to type one. We use it to find which kinds of question Tally gets wrong. Linked to you for 90 days, then the link is erased; the row goes at two years. Readable only by an app administrator.
• What a connected AI tool asked for. If you connect an AI tool (§4.5), one row per request it makes: which kind of request it was — which of the §4.5 tools it used, for instance — whether it worked, and if not whether the tool asked in a way we could not answer or the fault was ours; how long it took; which connected tool it was, with the name and version it reports for itself. Never what it asked for or what it was given back — no amount, no name, no space name, no date. Where the fault was ours, a short error message with email addresses and long numbers removed. Linked to you for 90 days, then only a count; the row goes at one year. Readable only by an app administrator.
• Which shops and banks are common (public.entity_candidates, public.entity_usage). So the app can show the right logo beside a shop or a bank, once a night we count how many different people, and how many different spaces, use each shop name and each bank name on an account. An app administrator sees a name only once at least three people in at least two spaces use it — never who they are, which spaces, when, or how much was spent. A name used by fewer people is never shown to anyone and not stored anywhere new: it stays in your own records and becomes part of a single count. What is kept is the name, the two counts and a symbol for it (a trolley for groceries, say).
• How far a connection got. Once you have signed in on the connection page, whether you were shown the approval screen or the Premium screen, and whether you left with Deny or with Back — one entry each per attempt, with the tool's registration. Nothing is recorded before you sign in. Linked to you for 90 days; deleted at one year.
• When you first connected a Google spreadsheet. One date, linked to your account, so the free month of a spreadsheet the app keeps up to date is counted once (§4.7). Nothing about the spreadsheet.
• How far connecting a spreadsheet got. If you start connecting a spreadsheet (§4.7), one entry for each step you reach: you started, you picked a sheet, the preview was shown, you connected, the first rows went in, and later whether the app had to repair something it tracks (a column that moved, say), whether the sheet needed you to reconnect it, and whether you disconnected. With the steps go counts only: how many questions the preview asked, how many columns it recognised, how many times you corrected it, how many rows went in, and how long that took from your first tap — plus whether it was Google Sheets or paste-ready rows. What joins the steps of one attempt is a random code your phone makes when you tap to connect, and keeps with that connection. Nothing from your spreadsheet — no content, no heading, no title, no file — and nothing that says who you are: no account, no space, no IP address, nothing about the device. Deleted at one year. Readable only by an app administrator.
• A live export link, if one is on. When it was last read and how many times, for the space’s link (§4.8). Nothing about who or what read it.
• Whether an invite link worked. Someone can be added to a group by name, and then sent a link to claim their share. When that link is opened — in a browser, or in the app — we record one row: which invitation it was, which space it belongs to, when the guest was added, whether there was a share on it at all, which way in was used — their own link, the group's link, or “that was me” from inside the group (recorded since 27 September 2026) — and the time. That is the whole row. No name, no email address, no amount, no IP address, and nothing about the browser or device.
  Opened in a browser, it says an invitation was opened and nothing about who opened it — there is no identifier for the visitor in it, and nothing connects it to a person. It becomes connected to someone only if they sign in and take the share over, which is recorded against the membership it belonged to. We keep it to answer one question we otherwise cannot: whether being added to a group actually leads anywhere, or whether people simply never arrive.
  Nobody can read this through the app or the website — not you, not another member, not the account that opened the link. Only we can. There is no automatic deletion of these rows today, and we would rather say that than print a period we do not enforce.
  A separate, short-lived record of a scrambled IP address does exist for the same page — it is the next item, and it is not part of this row or joinable to it.
• A scrambled form of your IP address, for two hours, when you open a claim link. A claim link is a long random code, and the page that reads it answers anyone who asks. To stop somebody working through those codes in bulk, we count how many invitations each visitor looks up, and refuse a visitor who keeps asking for invitations that do not exist.
  Counting per visitor needs something that tells visitors apart, and the only thing available is the network address the request arrives from. We do not store it. We store a salted one-way scramble of it — made with a secret random value of ours, it cannot be reversed, and it cannot even be recomputed by anyone who does not hold that secret. Against it we keep two counters and an hour stamp. No name, no email address, no session or device identifier, nothing about the browser, and no link to which invitation was opened — this and the measurement above are separate records that cannot be joined to each other.
  These rows are deleted after at most two hours, by a job that runs every hour. The counting window is one hour, so nothing older is any use for the limit, and nothing is kept for a second purpose. As above, nobody can read them through the app or the website. We treat this as personal data even though it cannot be turned back into an address; we rely on our legitimate interest in keeping other people's shares from being enumerated by whoever cares to try.
• A count of join codes you looked up that matched nothing, for two hours. A group's join code is eight characters — short enough to type, and so short enough to guess at — and opening a group's link in the app shows the names of the people added to it who have not joined yet (§3). So we count, per account, how many codes you look up in an hour that do not exist, and stop answering after twenty. The row is your account's identifier, the hour, and the count. It does not record which codes you tried, or anything about the group you did open.
  Per account rather than per network address, deliberately: a phone network can put a whole town behind one address, and one person's typos should not stop their neighbours joining their own groups. These rows are deleted after at most two hours, by the same hourly job as the item above, and nothing reads them but the check itself. It rests on legitimate interests: keeping the names in a group from being found by guessing.

We do not use third-party analytics or crash reporters at this time — the ones above are our own, and none of them leaves our infrastructure. If we add a third-party one, we'll update this policy first and disclose it in the App Store privacy label.

3. How data is shared inside the app

Shared Finance is a couples/household tool, so by design your data is shared with the other members of any space you belong to:

• Your member-directory entry shares your name and avatar with people in the same space. That entry excludes your account email, private billing details and unsubscribe credential.
• Household / group members can see the same expenses, bills (including cancellation requests, outcomes and notes recorded for that space), categories, goals, group-pot contributions (who contributed, how much, in which currency and when), payment labels, settle-up records, shopping lists and check-ins for that space. Check-in plans include who proposed them and who has acknowledged them. On a shopping list they can see which items are marked as one member's own, and, if you tell them you are going shopping, that you are, which shop you named, and when.
• Things you ask Tally to remember are just for you unless you said they were for the space. A shared one is visible to every member of that space, in Settings and to their Tally when they ask it something there; a “just for you” one is seen by nobody else, not even another member of the same space.
• Your Personal space is private to you — except a loan in it that you choose to send to the person it is with (below).
• A loan you choose to share. On a loan, you can send it to the other person by their @username or email address. Nothing appears for them until they accept it and choose one of their own spaces to keep it in. From then on they, and the other members of the space they chose, can see that one loan: the amount and currency, its dates, its note, the payments recorded against it, whether it is settled, and your name as it is on your account. They cannot see any receipt, photo or other attachment on it, your other loans, or anything else in your space, and they cannot change the loan or attach anything to it. Either of you can log a payment; one logged by the person paying waits for the person receiving it to confirm. Either of you can stop sharing at any time. Sending by email does not tell you whether that address has an account: if it has none, the request waits until someone signs up with that address and confirms it, for up to 90 days. Every request that is not answered within 90 days lapses and is deleted, whoever it was sent to, so its lapsing does not tell you whether the address has an account either. If the request reaches someone, it says who entered their details and links to this policy. Notifications go through Apple's push service: they get one when you send it (your first name and the amount), you get one when they answer, and whoever receives a payment gets one when it is logged for them to confirm (with the amount), and the payer when it is confirmed or declined. Each respects the Loans notification switch.
• Row-level security (RLS) rules on the backend enforce this — a user can only read rows for households they are a member of, plus, for a loan someone shared with them and they accepted, that one loan and its payments.
• If you invite someone by email, that invite is stored until they accept or it's revoked.
• If you keep a spreadsheet of a Household (§4.7), its other members are told: a line under your name in the Household's settings says you keep a spreadsheet of this space's spends. They can also see whether it is Google Sheets or rows you paste, and since when. Nothing about the spreadsheet itself, and nothing about which of the space's spends you chose.
• If someone adds you to a group by name. A member of a group can add you by name before you have the app, so that a shared bill includes you from the start. That name — as they typed it, with its avatar letter — is shown to anyone who opens the group's invite link in the app and signs in, so that you can find your place in it and take it. Nothing else about you is shown with it: no amount, no email address, nothing about what you owe or are owed. It is never shown on this website's join page — only in the app, behind sign-in. (Anyone holding that link could already join the group and see everything in it; this shows your name to someone who opens it and does not join.)
• Taking a place in a group. Whoever opens the link picks the name that is theirs and takes over everything that name was part of. If their account has no name yet, it takes the one they confirm — filled in with the name they were added under, which they can change. We keep a record for 30 days of which name was taken, by which account, which way, and when, so that a group's owner or admin can put a wrong pick back within 14 days, while the place has not been used — the person stays in the group, in a place of their own — and so that the join notification can say who joined as whom. The group's owner or admin is told when someone takes a place, and the person is told if their pick is put back.

4. Who else we share data with

We share data only with the processors we need to run the service — and, if you choose to set one up, with an AI tool (§4.5), a spreadsheet (§4.7) or a spreadsheet that reads a live link (§4.8) you set up yourself, each a recipient you pick rather than a processor working for us. We do not sell or rent your data. We do not share it with advertisers or data brokers.

Each processor is contractually required to use your data only to provide the service. Supabase acts as a data processor for us under GDPR; we act as the controller. The last three rows are different in kind: we have no contract with a tool or spreadsheet you connect, and no say in what it does with what it reads or receives — which is why §4.5, §4.7 and §4.8 set out the whole of it before you decide.

4.1 What the assistant sends to Anthropic

The in-app assistant is powered by Anthropic's Claude API. When you use it, we send only what is needed to answer your question:

• the messages you type;
• your space’s chosen budget start day and weekend adjustment, and the actual start and end dates of the budget periods used to answer your question;
• spending totals for the months your question covers — overall, month by month, by category, by shop, by who paid (the name the paying member uses in the app, or “you”), or by the bank account a spend was paid from (the name you gave that account in the app — never its number or its bank) — each in the space’s own currency and in GBP;
• individual transactions relevant to your question — date, merchant or item name, amount (in the currency it was spent in, and in GBP), category, and who paid (the name the paying member uses in the app, or “you”);
• what you have asked Tally to remember in that space — the ones shared with the space and your own, up to 20, newest first — never another member's own;
• your spending rules in that space, up to 15, each as the sentence Settings shows for it: the payee words it matches, the category it files under and the name it shows as, which kind of entry it applies to (a statement or a receipt, say), the account it applies to (the name you gave that account — never its number or its bank), any amount limits and their currency, and whether it is for money in or out.

We also send a merchant name when suggesting a category for a new expense, text extracted from a receipt when you scan one, and a photo of a shopping list — only when you tap Read with Tally for that photo (see Scanning a shopping list below). Four more things Tally writes for you outside the chat — explaining a settle-up, the check-in's conversation starters, filling in a savings goal and drafting a plan from your month — each send what Explaining a settle-up, check-in starters, goals and plans below describes.

Suggesting shopping details. If you tap Suggest details with Tally under the existing assistant consent, we send Anthropic up to 20 item titles and reference identifiers and up to 40 category names. A title can itself contain a number, pack size or a name you typed. The backend checks your access to the chosen space, but does not send its identifier or the request identifier to Anthropic. The request has no link or page HTML field; URL-shaped titles and currency-marked amounts are rejected. It does not send retailer cookies, product URLs or separate price, currency or order-quantity fields. Suggestions for a shorter name, category, aisle and pack wording return to your phone for review. No shopping item is saved by this AI call; only changes you confirm when you finish the item or import are saved. It uses the assistant's ordinary per-account and project safety limits, but no Premium gate and none of your 20 free chat questions.

Scanning a shopping list. When you scan a paper list or pick a screenshot of one, the photo is read on your phone by Apple's on-device text recognition. To read handwriting better, the phone gives that recogniser the names of things your household already buys and lists; that happens on the phone too. Nothing is sent: you check the items it found, and the ones you keep are added to your list like any others. The photo is not saved anywhere. If a list is too messy to read, you can tap Read with Tally for that one photo. The app asks first, then sends that photo — made smaller, and only that one — to Anthropic to read, and the items come back to your phone for you to check before anything is added. We do not store the photo: it is not written to our database, our file storage or our logs, and each further photo needs its own tap. A photo carries whatever else is in the frame, so pick one that shows the list. Anthropic handles it on the same terms as everything else in this section.

When you import a statement and you have agreed to Tally reading your statements, we send the text of that statement so it can be read: the dates, descriptions, amounts and running balances it prints, the name of the bank it came from when the app recognises it (a bank's layout is what makes the text readable), and the word patterns from rows you have already ruled on in a statement review — that a row is a transfer between your own accounts, say, or not a transaction at all — so it is read the way you decided. A long statement is sent in parts, each with a few lines of the parts either side, so a row on a boundary is read once. The file itself is never sent, only the text in it, and the app asks before the first statement is sent — including anyone who turned Tally on before statements were read this way. If you have not agreed, or turn it off in Settings, your phone reads the statement itself and none of its content leaves your device. There is one other way statement content can leave a phone at all — it needs an app administrator's own phone and their own statement, and it is described in 4.4.

When you ask the assistant to do something — "add £5 for TfL travel", "delete the Uber one", "set groceries to £300", "put two packs of Indomie on the BBQ list" — the model reads your words and turns them into a structured action: the merchant, amount, currency, category, date and who paid. The action is carried out on your phone, by the app, through the same steps as tapping the form. In a group, that includes the split: the expense is recorded against the members of that group, shared out evenly, exactly as the form's own "just log the split" does — nothing is charged to your personal or household ledger unless you do that yourself. Our servers never write to your records on the assistant's behalf, and every action shows an Undo. “Remember that…” and “forget that…” work the same way: Tally turns them into a note to keep or remove, and your phone saves or deletes it, with an Undo. Tally keeps a note only when you ask it to, never one it worked out from your spending.

If you speak to the assistant, your voice is turned into text on your phone using Apple's on-device speech recognition. No audio is recorded by us or sent anywhere, and nothing is sent to Anthropic until you press send — or, in a voice conversation, until you pause. When the assistant speaks back, the voice is your phone's own (the same engine as VoiceOver); the words never leave the device to be spoken. More the assistant can do on your instruction. Besides logging, changing or deleting an expense, setting a budget and adding to a shopping list — the list you name, or the one you have open, with a quantity, a unit and a note, and marked as yours if you say so — the assistant can record a loan or a repayment (who and how much, as you say it), add a recurring bill with its payment frequency and full starting date, put money into a savings pot, and tick an item off a shopping list. Each is carried out on your phone through the same steps as tapping the form, each shows an Undo, and none of them moves any money — a loan is a note of who owes whom, nothing more; nothing is ever ordered or bought. When the assistant offers things to add to your list and you tap them, the phone adds them itself — see Your shopping lists below.

If you use Siri ("Hey Siri, log an expense in Shared Finance", or "Ask Tally"), Siri does the listening: your words are turned into text by Apple's Siri under Apple's own privacy terms, not by the app's on-device recogniser, and the app receives only the text. "Log an expense" is saved on your phone through the same steps as the form and sends nothing to Anthropic; in a group, it is shared out evenly between the group's members, exactly as the form's own "just log the split" does, and nothing is charged to your personal or household ledger. "Ask Tally" sends the text to the assistant exactly as a typed question does, and the exchange appears in the Tally tab. "Add to my shopping list" and "What's on my shopping list" are handled on your phone too: the items are added, or read back to you, through the same steps as the app, and nothing is sent to Anthropic. Every Shared Finance Siri or Shortcut action requires the iPhone it runs on to be unlocked. If you use Face ID or an app passcode for Shared Finance, you must also open and unlock the app before one of those actions can read, speak or change your data.

Your shopping list on the Home Screen. If you add the shopping-list widget, it shows the list's name, how many things are on it and the names of the first few — never a price or an estimate. Like any widget it is visible on an unlocked phone, and "hide balances" does not hide item names, so leave the widget off if that matters to you. The same is true while the Shared Finance app lock is on: budget widgets hide their amounts, space names and category names, but the money-free shopping widget keeps showing its list. You can tick an item off from the widget. The widget does not contact our servers: it notes the tick on your phone — which item, in which space, for which account, and when; never the item's name or price — in storage that is not included in backups, and the app ticks the item, exactly as the list itself does, the next time you open it. A tick needs the iPhone unlocked; one made while the Shared Finance app lock is on waits until you unlock the app. A tick the app has not applied within 7 days is discarded, and any waiting are removed when you sign out. The Log expense control (in Control Center, on the Lock Screen or on the Action button) only opens the app on Add expense; it reads and sends nothing.

Importing shopping links. You can paste links or share them into Shared Finance, then tap Read links to have your phone request their public pages without retailer cookies or sign-in. The shop sees your phone’s ordinary connection information. We do not receive the page or send it to an AI provider. You review the available names, prices and currencies and choose a list before saving; the confirmed items and their product links are visible to members of that space. Shared Finance sign-in and permission to edit the space are required. Private retailer carts cannot be read through their links: we do not ask for shop passwords or use your browser’s login. You can paste item text, which is read on your phone, or choose the shopping-list photo flow described above. A URL can include tracking or access parameters, so check it before sharing it with a space.

When you share a supported shopping page from Safari, Safari can provide a small snapshot of visible item names, product links, available prices and currencies, and quantities, plus a page title and capture time. This can include your active Amazon cart after you sign in in Safari. We do not receive your retailer password, cookies, browser storage, address or page body. You review the captured rows before saving; unsupported carts still need pasted text or a screenshot.

Personal price tools and Tally. You can set a personal target price or percentage-drop alert, or pause checks on this phone. Your phone keeps up to 180 observed price readings from the last 90 days, plus your settings and additional comparison links, in protected local storage excluded from backups. These personal records do not sync and are removed when you sign out. The first observation starts a new local baseline. Pack-size suggestions require confirmation; unknown delivery costs remain unknown. If you choose Prepare question for Tally, the app creates an editable draft with item names, reviewed offer prices, currencies, dates, packs, delivery costs and recent readings. It adds no product URLs or raw page text. Nothing goes to Anthropic until you send the question through the existing assistant-consent flow.

Watching a product link. You can paste the link to a product’s page on a shopping-list item. Your phone then opens that page itself — when you open the list, and every few hours when iOS lets the app refresh in the background — reads the price the page publishes about itself, and shows a notification on that phone when it crosses your personal target or, without a target, is lower than the local baseline. Shared Finance’s servers never fetch the page. The shop receives an ordinary request from your phone’s internet connection, as if you had opened the link, without your cookies or any sign-in, and nothing about you or your household is added to it. The link, the last price read and when are saved with the item, so the other members of the space can see them and their phones need not ask the shop again. The assistant is not sent the link. With hide balances on, the notification names the item but not the price. Nothing is ordered or bought.

A day to buy something. You can give a shopping-list item the shop you plan to buy it at and the day you plan to buy it. Both are saved with the item, so everyone in the space sees them, like the rest of the list. If you turn on a reminder for that day, the reminder and its time are kept on your phone only, and the notification is scheduled and shown by that phone — nothing about it is sent to us or to anyone else. Neither the shop nor the day is given to the assistant.

"Going shopping." If you tell a shared space you are going to the shops, the other members get one notification through Apple's push service: your first name, the shop you typed (if any) and the list's name — never what is on the list or what anything costs. It goes only to members who have that kind of notification switched on, and not again if you tap it twice within half an hour.

Siri and Spotlight on your phone — off unless you turn it on. If you switch on Siri & Spotlight in Privacy & security, the app adds your spends, bills and spaces to your iPhone's own search index, so Spotlight and Siri can find them: for a spend, what it was, the amount in the currency you entered, its category, date and space; for a bill, its name, amount, how often and when it is due; for a space, its name, kind and currency. It never includes who paid, notes, or receipts. The index is kept on your phone by iOS, and building it sends nothing to our servers or to Anthropic — but Siri and Apple Intelligence can use it to answer your requests, under Apple's own privacy terms. Turning on Face ID, a passcode or Hide balances switches it off, because Spotlight would otherwise show on an unlocked phone what those settings hide — and it stays off when you turn those back off, until you switch it on again yourself. Turning it off, signing out, deleting your account, or leaving or deleting a space removes those entries from the index. The setting belongs to your account, so turning it on applies to every iPhone you sign in on; each phone builds its own index, from what that phone has loaded, and nothing is shared between them or with us.

The app also supplies its current calendar day and timezone to our server so bill dates and creation-month rules use the same calendar as your phone.

Everything the assistant can look up. When you ask, the assistant can read, from the space or group you name: your recurring bills (name, amount, billing frequency, due day, saved recurrence date and calculated next due date including their years, whether active, and the current month’s recorded-payment dates, counts and status, with overdue status where the available records can establish it), your savings pots (name, saved, target, monthly set-aside), your loans (who, how much, repaid, outstanding — including the other person's name as you entered it; only loans recorded in that space, never one someone else shared with you), your shopping lists (each list's name, the items on it with their quantity, unit, note, estimate and the category they will be logged under, whether an item is marked as yours or as another member's — never which member — and what the list's main budget category would have left after this budget period's spending and the list's estimate, worked out by our server from the budgets and totals it already reads), your category budgets and each member's monthly pay-in, who owes whom in a group or household (each member's net position after the repayments already recorded, and the payments that would square everyone), the lines of bank statements you have imported, money going out as well as money coming in (each line's date, the statement's description — which can name the person or company paid or paying; account and phone numbers are taken out of it, except that a line of money coming in can be sent as the bank printed it — amount, currency, account name, and what you decided about it in the statement review, including which lines were transfers between your own accounts, and the dates those statements cover), and — when you are building a shopping list — the names, prices and shops of things you have bought in the last year, how often you usually buy each and when it is next due, and which things you tend to buy together, so it can offer them to tap. Wherever it names the members of a space, it is told which of them is you, so it can tell you apart from the people you share with. Only what a question needs is sent, and only from spaces you belong to.

A check of your records. When you ask for a review, or ask whether anything looks wrong, the assistant can run a check for likely mistakes: the same spend logged in two of your spaces or entered twice in two currencies, one receipt split across currencies, and a budget or savings pot that looks out of scale with a space's pay-in. The check looks across every space and group you belong to, and sends only the entries it flags — date, merchant, amount, currency and which space — with a sentence about each.

Your spaces and groups. So the assistant can answer about a space or a group you name ("how is the trip going?"), each question also carries the names, kinds and currencies of the spaces and groups you belong to, and a look-up may read another of them, or all of them together, when you ask. It never reads one you are not a member of — the same access rules as the app itself.

Your shopping lists. So “add charcoal to the BBQ list” has a list to go to, each question also carries the names of the space's shopping lists, which one you have open, and how many items are on it to buy — names and a count only, not the items or their prices. What you might add next (“often bought with milk”, “due again”) is worked out on your phone from your own purchases and sent nowhere. When you tap a suggestion — one of these, or one the assistant offered — the phone adds it itself, and nothing is sent at that moment; the next time you ask something, the assistant is told which items you added, so it does not offer them again.

Explaining a settle-up, check-in starters, goals and plans. Four things Tally writes for you outside the chat, each sent to Anthropic on the same terms as the rest of this section:

• Explain this, on a couple's Joint screen or a group's overview, sends the figures already on that screen: each member's display name (yours is sent as “You”), what each paid, their share, whether they are owed or owe and by how much, the breakdown line shown under their name, how your split is set, and who pays whom. The app asks first, as it does for the assistant. A short paragraph comes back; it is shown on your phone and not stored.
• Conversation starters for the monthly check-in are written when you open it, and only once you have agreed to the assistant. The app sends a summary of the month: what was spent and the budget, up to eight categories with this and last month's totals and their budgets, up to six savings goals with what is saved, the target and the date, the names of up to eight repeating charges, how many bills are overdue, and whether the month is settled — no member's name and no individual transaction. Four questions come back, and your phone keeps them for that month.
• Fill in, on a new savings goal, sends the sentence you typed, today's date and your space's currency. The app asks first. A name, a target and a date come back and fill the form on your phone; nothing is saved until you tap Save, and the sentence is not stored.
• Tell me about your month sends the description you wrote, today's date, your space's currency, the names of your space's categories, and whether the space is just yours. The app asks first. A draft comes back — your own pay-in, bills, category budgets and savings goals, using only amounts you wrote; an amount you did not write is dropped before it reaches your phone — and each line is shown for you to check, change or leave out. Nothing is saved until you tap Save, and then each line you kept is saved on your phone, through the same steps as tapping the form, with one Undo for all of it. A figure you gave for someone else (“Sam puts in £1,400”) is shown as a note and never saved. The description is not stored.

Explaining a settle-up, the starters and Fill in cannot change your records. A plan draft changes them only when you tap Save, on your phone, as above. None of them moves money.

We do not send your email address, your account identifiers, or your bank account details. The only names sent are the display names members use in the app — yours and those of the people you share a space with — so the assistant can say who paid and who owes whom; a settle-up explanation sends yours as “You” instead. Your data is not used to train Anthropic's models. If you would rather none of this happened, don't use the assistant, the category suggestion, receipt scanning, Explain this, Fill in or Tell me about your month — the rest of the app works without them, and the check-in starters are only written once you have agreed to the assistant.

4.2 What Resend handles

Resend delivers our outgoing email — invites, reminders and notifications — which means it processes your email address, display name, and the content of that message.

Resend keeps its own copy of the messages it sends for us, in its own systems and under its own retention, which we do not set and cannot shorten. That copy is an invite, a reminder or a notification — never a statement, and never an amount: no email we send contains a figure of any kind, by design.

Resend no longer receives anything you send to us. Incoming mail is handled by our own systems, described next.

4.3 What happens to email you forward us

If you use the statement import address, the email you forward — and its attachments, meaning your bank statement PDFs or CSVs — is received by our own mail infrastructure running on Amazon Web Services in London. It is not sent to any third-party email provider.

The message is held only for as long as it takes to move the attachments into your private storage bucket, normally a few seconds, and is then deleted — deleting the raw message is the last step of the same code that files the attachments. If that code never gets there — it crashed, or we could not hand the message on — a one-day expiry rule on the mail store itself makes it eligible for automatic deletion. A separate rule makes any historical version eligible for permanent deletion one day after it becomes noncurrent. S3 rounds lifecycle dates to midnight UTC and processes deletion asynchronously, so one day is the configured expiry, not a guaranteed 24-hour maximum. Our operational check reports objects or versions that remain.

The statement itself is read as described in 4.1: its text by Anthropic if you have agreed to Tally reading your statements, otherwise on your device. Our servers pass that text on and keep none of it; what we store is the rows you review.

We keep a delivery record, including of mail we turn away. For every message that reaches one of your statement addresses we record the sending domain (for example kuda.com — not the full address), the subject line, the name of each attachment and their total size, and what we did with it. This includes messages we reject: mail from a sender your account has not accepted, mail that fails its sender checks, and mail sent to an address that does not exist.

We keep it so that you, and we, can answer the question “why did my statement not arrive?” — which previously had no answer at all. You can see your own household's record in the app; nobody outside your household can, other than us.

The sending domain, subject and filenames are deleted after 30 days, and the record itself after 90 days. We never record the body of a message, its attachments, or any amount, merchant or balance — everything in this record comes from the envelope, not from reading your statement.

Until 8 September 2026 this incoming mail was handled by Resend, in the United States, and Resend kept its own copy of every message — attachment included. They publish no retention period for inbound mail and no way to delete it. That is why we moved: we could not tell you how long your bank statements were being kept, and we would rather not run on an answer we do not have. Anything forwarded before that date may still be held there. We have not been able to confirm it has been deleted, and this sentence stays until we can. Mail you forward now never reaches them.

4.4 Diagnostic copies of statements — app administrators, own statements only

Reading bank statements correctly is the hardest thing this app does, and when a bank's format defeats it the fastest way to fix it is to look at the statement's text beside the rows the app read from it. So an app administrator — one of the small number of people who run Shared Finance — can send a statement from their own phone, about their own account, to our internal admin console for exactly that comparison. The copy includes the statement's text, the rows the phone read from it, the bank's name and the filename.

Three things about this matter. Two of them the database enforces on its own; the third rests on the app, and it is worth being exact about which is which:

• It is administrators only, in both directions. The database refuses to store a diagnostic copy unless the person sending it is an app administrator, so a copy of an ordinary user's statement cannot be stored at all — not by us, not by mistake, and not by anyone who found the address.
• It can only ever be somebody's own statement — and this one is the app's rule, not the database's. The action exists only inside a screen that reads a file the administrator has opened on their own phone, and they must confirm it is their own before it will send; the database refuses any row that does not carry that confirmation. What the database cannot do is check whether that confirmation is true — no rule in a database can tell whose statement a piece of text is, and we would rather say so than claim a stronger guarantee than we have. There is no way for us to reach into your app and send yours, and no way for you to be asked to send one.
• It is deleted after 30 days, automatically, whether or not anyone looked at it. It cannot be edited once sent, and it is readable only by app administrators — never by other users, and never by a household.

Nothing here changes what happens to your statements: how they are read is set out in 4.1 and 4.3.

4.5 Connecting an AI assistant of your choice

You can connect an AI tool you already use — Claude or ChatGPT, say — to your Shared Finance data. You do this yourself. You sign in and approve the connection on our website, on a page that names the tool asking and the address your data would be sent to, and we never connect one for you. Until you do, none of this applies to your account.

Once connected, that tool can read, from the spaces and groups you belong to, the same things the in-app assistant can look up (4.1): your recurring bills, your savings pots, your loans (not one someone else shared with you), your spending and individual transactions, your category budgets and each member's pay-in, who owes whom and the payments that would settle it, the lines of bank statements you have imported (money in and out, and what you decided about each in the statement review), the check of your records for likely mistakes, your shopping list, and the names and currencies of the spaces and groups themselves, together with each space’s chosen budget start day, weekend adjustment, and the actual dates of the budget periods it reads. It cannot add, change or delete anything, and nothing it does moves money.

That last sentence is not a promise about how carefully we wrote the tools. A connection made this way carries a marker the app's own sign-in never has, and the database refuses a write that carries it — on every table, and inside every one of the routines the app itself uses to record something. A tool that asked to change your data would be refused by the database, not by our good intentions.

What that tool does with what it reads is governed by its own privacy policy, not ours. You are choosing to send your data to that company — Anthropic, OpenAI, or whoever runs the tool you picked — so they decide how long they keep it, where they process it, and what they do with it, including whether it is used to train a model. We are not a party to that, and we cannot undo it for you. Read their policy before you connect.

What we keep about a connection. A record of each request the tool makes — which of the tools above it used, whether it worked and how long it took, and never what it read — and how far each attempt to connect got. We keep it to tell whether connecting an assistant works and to fix it when it does not; §2 lists exactly what is in it and §7 how long it stays.

You can disconnect a tool whenever you like, in the app or on the website. From that moment it can read nothing further.

4.6 Paying for Premium on our website

You can subscribe to Premium in the iPhone app, where Apple takes the payment, or on sharedfinance.app, where Stripe does. Either way we never see or store your card details. Paying us for Premium is the only payment anywhere in Shared Finance; the app still never moves your money.

What we send Stripe. When you start a checkout on our website we create a customer record at Stripe carrying one thing from us: an internal account number, so the payment can be matched to your account. We do not send your name, your email address or anything about your finances. Stripe's own checkout page asks for your email address, your card details and, where tax rules need it, your billing address, and Stripe handles them under its own privacy policy — including the fraud-prevention and financial-regulatory checks a payment provider is required to make.

What we keep. For a website subscription: Stripe's customer and subscription identifiers, the plan, whether it renews and when the current period ends, plus a short record of each notice Stripe sends us about it (the notice's identifier and type, and what we did with it). For an App Store subscription: Apple's subscription identifier, the product and the dates Apple reports. We use these only to give you the Premium you paid for — on every device, and to your household if your plan covers it — and to stop you subscribing twice through both. Your partner can see that your home is covered, never who pays or how.

If you delete your account while a website subscription is still running, we cancel it with Stripe so you are not charged again. We do that the next time Stripe tells us about the subscription, which it does before it takes any renewal payment. To be able to, we keep Stripe's customer identifier — a code, with no name, email or card detail attached on our side — after the rest of your account has gone, for up to 13 months. An App Store subscription can only be cancelled by you, in your iPhone's Settings; deleting your account does not cancel it, and the app tells you so.

4.7 Keeping your own spreadsheet up to date

You can have the app add your spends to a spreadsheet you already keep, in your sheet's own layout. You set this up yourself. Until you do, none of this applies to your account.

Google Sheets. You sign in to Google and pick one spreadsheet, on Google's own screens. Google then gives the app access to that one file only — not your other files, and not the rest of your Drive. If you have no spreadsheet yet, the app can create one in your own Google Drive instead; it is yours in the same way. From then on your phone adds your spends to it: the date, what it was, the amount and the category, and — where your sheet has columns for them — who paid and which account. The spends go from your phone straight to Google; they do not pass through our servers, and we do not hold your Google sign-in or know which file you picked.

Which spends: those in the spaces you choose, and only ones you can already see in the app. In a shared space you can choose everything, or only what you paid.

What happens to them there is governed by Google's privacy policy and your spreadsheet's own sharing settings, not ours. Anyone who can open your spreadsheet can see what the app adds to it, and the app's “hide balances” setting does not reach a spreadsheet.

What the app reads from your spreadsheet, and where that stays. To add rows in the right place and in your format, and to avoid adding a spend you have already typed in, the app reads the spreadsheet you picked: its headings and up to your most recent 2,000 rows. It uses them to learn your layout and your habits — your categories, how you name shops, where your totals are. This happens on your phone. None of it is sent to us or to any AI service. On iPhones that have it, Apple's on-device model may be asked which column is which; it runs on the phone, and nothing leaves it.

Nothing in your spreadsheet changes the app on its own. The one exception is something you choose: after connecting, the app can offer to bring your sheet's categories, monthly budgets, repeating bills, or spends the app is missing into the app, and to suggest categories the way your sheet files them. Each is a separate choice. Whatever you bring across becomes app data like anything you log yourself, kept as §2 and §7 describe. Category suggestions are shared by everyone in a household, so bringing yours across changes the suggestions your partner sees too.

What we keep. On your phone, the connection's settings, and — in the iOS Keychain — the Google sign-in that lets the app add rows, which never leaves the phone and is not included in an iCloud backup.

The free month, counted once. Keeping a Google spreadsheet up to date is free until the end of the month after the one you first connect in, and part of Premium after that. Copying rows to paste yourself is always free. So that disconnecting and connecting again, reinstalling the app or moving to a new phone does not start another free month, we keep one date against your account: when you first connected a Google spreadsheet. Nothing else: not which spreadsheet, not how often it updates, not when you disconnect, and nothing for paste-ready rows. It is kept for as long as your account exists and deleted with it. When the free month ends and you are not on Premium, the app stops adding rows and says so on the spreadsheet screen; the spreadsheet and everything already in it stay yours and stay as they are.

On our servers, one more thing, and only for a Household. If a space you choose is a Household — a space you share with someone — its other members are told that you keep a spreadsheet of it, whether the app adds the rows to Google Sheets or you paste them in yourself. For that we keep a small record: which Household, that it is you, whether the app adds rows to Google Sheets or lays them out for you to paste, and when you connected. The Household's settings show it under your name: “keeps a spreadsheet of this space's spends”. Everyone in that Household can see it, and nobody else. It says nothing about the spreadsheet: not which file, not its name, not your Google account, not what is in it, and not which of the space's spends you chose to include. Your Personal space is never mentioned to anyone.

To keep that record true without knowing anything else, the app confirms it each time it starts, and about once a day while it runs. The time of the last confirmation is kept with it only so that a record nobody confirms any more can be deleted; it is not shown to your partner or to anyone else in the app. The record is deleted when you disconnect in the app, when you leave that Household, or when you delete your account. If you do none of those, but the app is not opened with your account for 45 days — the phone was wiped or replaced, say — it is deleted then. Signing out alone does not remove it, because the connection is still set up on your phone for when you sign back in.

Disconnecting. In the app (Settings, then Records, then Your spreadsheet, then Disconnect), which also asks Google to withdraw the app's access and removes the Household record above; or in your Google Account's security settings. Signing out of the app withdraws its Google access too, so it stops adding rows; the Household record then goes as the paragraph above says. The spreadsheet, and everything already in it, stays yours and stays as it is.

Any other spreadsheet. For Excel, Numbers or anything else, the app can copy your new spends, laid out like your sheet, for you to paste. The rows themselves are never sent to us or to anyone else: they go only where you paste them, and which spends you have already copied is remembered on your phone. Two things are kept on our servers, as they are for Google Sheets: if the spends you choose include a Household's, its other members are told that you keep a spreadsheet of it, exactly as described above (the record says you paste the rows rather than the app adding them to Google Sheets); and the steps of setting it up are counted, with nothing that says who you are, as §2 describes. Stopping it in the app (Settings, then Records, then Your spreadsheet, then Stop) removes the Household record.

4.8 A live link your spreadsheet refreshes (Live export)

Live export gives a space a private link that serves its records as a spreadsheet file. It is part of Premium, and only an owner or admin of the space can turn it on (Settings, then Records, then Live export). Until someone does, none of this applies to that space.

Who fetches it. You paste the link into Google Sheets (with IMPORTDATA) or into Excel (with Power Query). From then on Google’s or Microsoft’s servers — not your phone — fetch it from us each time the spreadsheet refreshes (Google Sheets does so about once an hour), for as long as the spreadsheet uses it. So what the link serves goes to Google or Microsoft, and to everyone who can open that spreadsheet. What happens to it there is governed by Google’s or Microsoft’s privacy policy and the spreadsheet’s own sharing settings, not ours, and the app’s “hide balances” setting does not reach a spreadsheet.

What the link serves, for that one space. Its spends from the last 24 months (the link can ask for up to 10 years): the date, what it was, the category, the amount and currency, its value in pounds and the exchange rate used, who paid — by name and member code — and how it was split. Also the space’s category budgets, bills and savings goals; its members’ names, roles and whether each has an account; each person’s share of a shared expense; and settle-ups between members, including any note written on one. Never an email address, a password, a statement, a receipt, or anything from another space. In a shared space this is everyone’s spending in it, which is why only an owner or admin can turn it on. Anyone in the space who opens Live export in the app can see that a link is on; only owners and admins can see or change the link itself.

Anyone who has the link can read it. The link is the key: it carries a long random code and needs no sign-in, because Google’s and Microsoft’s fetchers cannot sign in. A space has one link at a time. Replacing it, or turning it off, stops the old one at once. It also stops on its own 60 days after it was last used, when the person who made it leaves the space, and when their Premium ends; and it answers at most 120 times an hour. Nothing in the spreadsheet can change anything in the app: the link only reads.

What we keep. For each link: its code, which space it is for, who made it and when, when it was last read and how many times (with a running count for the last hour, for the limit), and when it expires or was turned off. Nothing about who read it — not the reader’s address; like any request, Supabase sees that only briefly to serve it (§2). A link that has been turned off keeps this record, so that an old link can be told apart from one that never existed.

5. International transfers

Your account and financial data are stored in Supabase's eu-west-2 (London) region. Some processing happens outside the UK / EEA:

Transfers outside the UK / EEA rely on the UK Addendum to the EU Standard Contractual Clauses (or the equivalent adequacy mechanism in force at the time of transfer), together with a transfer risk assessment where one is required. The last three rows are the exception: a transfer to a tool or spreadsheet you connect, or to the spreadsheet a live link is pasted into, is made on your own explicit instruction, to a company you chose, and the safeguards above are ours — they do not travel with it.

6. Legal basis for processing (UK / EU GDPR)

We do not process any special-category (Article 9) data.

7. How long we keep your data

Local rule activity: correction and offer evidence is pruned on use after 90 days, with at most 500 evidence entries and 500 recent offers; each matching context retains up to 64 recent capture identifiers to prevent duplicates. Aggregate offer counts remain until cleared. Review measurement keeps the most recent 100 summaries per account and space. Clear a space's activity in Your data, or sign out to remove all local rule activity from this phone. Hashed matching keys are still treated as personal data. This local record is included in the JSON export.

• Account data and financial records: for as long as your account exists.
• Conversations you choose to share with us (Help improve Tally): 30 days, then deleted by a daily job. Turning the setting off deletes, at once, everything kept while it was on. A conversation you sent one at a time stays until its 30 days are up or you delete it (Settings → Help improve Tally → Conversations you’ve sent). One we turn into a test case is rewritten first, with invented names and amounts, and the original is deleted within 7 days. All of it is deleted with your account. The record that you turned the setting on or off is kept for as long as your account exists, as proof of what you agreed to.
• Things you ask Tally to remember: until you delete them (Settings → What Tally remembers, or “forget that…” to Tally), or their space is deleted. Your own are deleted with your account. A shared one stays for the space's other members if you leave or delete your account, without your name on it.
• Rules and learned preferences: until you delete or forget them, or their space is deleted. Shared rules and preferences are visible to members of that space and remain for its other members if you leave. Personal rules are restricted to their owner. Deleting a stated rule removes its definition and application/override counts. Its ID-only revision record (space, owner if personal, revision, category identifier and whether it supplied a display name) remains until the space is deleted, so a spend waiting to sync can retain its explanation. This record contains no payee key, display name, narrative or amount. The rule trace on a saved expense stays with that expense until it is deleted. Deduplication records link rule/revision IDs to expense IDs and disappear when either the expense or rule is deleted. Existing learned statement preferences can be forgotten in Settings; category preferences can be forgotten per payee.
• A bank account's transfer fee: until you remove it, or its account or space is deleted. It is visible to members of that space. It never records a fee by itself: the statement review offers it, and you confirm each one. The link between a statement row and the fee recorded with it is deleted with that statement review, or when the fee spend is deleted; the fee itself is an ordinary expense and is kept like one.
• A loan you share: the @username or email address you entered is kept with the loan until you stop sharing it, send it to someone else, or delete the loan; an email address is removed as soon as they accept. A request nobody answers is deleted, with the address, 90 days after it was sent. The other person stops seeing the loan if either of you stops sharing it, if it is deleted, if the space either of you keeps it in is deleted, or if they delete their account.
• After you delete your account (Settings → Delete account): your account, profile, sessions, preferences and messages you authored are removed. Spaces with no other account holder are deleted. In spaces with other account holders, shared expenses, shares and repayments remain visible to those members. Your profile link and repayment creator identity are removed; an unclaimable Former member ledger identity keeps those records connected without retaining your name, email or account access. Existing financial records, free-text notes and assistant replies shared with the group remain part of its history. Assistant replies can contain details discussed in that shared conversation. Assistant admission metadata linked to you is deleted with your profile; account-free monthly project totals remain for up to 95 days as described above.
• Guest (anonymous) accounts: some early accounts were created without an email address, as a guest. Their data is kept on exactly the same terms as any other account — for as long as the account exists — and can be exported or deleted the same way, in Settings, without telling us who you are. The app no longer offers a way to create one. Since 20 September 2026, a guest account that has gone unused is deleted automatically. A guest account is deleted after 30 days without use if it holds nothing beyond the empty Personal space created when it was made, or after 90 days without use if it holds anything you entered. “Use” means any sign-in, any app launch, or anything written from the account — not only signing in again. We will send two notifications to the phone, 14 days and 7 days before, and opening the app at any point stops the clock and starts it over. We will never delete a guest account that shares a space with another account holder, because that would rewrite their records too, and we will never delete one with a subscription running. If you are using a guest account, Settings → Save your account attaches an email to it, keeps everything you have already entered, and takes it out of this rule for good.
• Photos of a shopping list: not kept. Read on your phone and discarded when you close the scan; a photo you send with Read with Tally is used for that one request and is not stored by us anywhere.
• Settle-up explanations, check-in starters, goal sentences and month descriptions: not stored by us. An explanation, a goal's filled-in fields and a plan draft live on your phone's screen until you leave it (a draft you save becomes your own records, like anything you type); the check-in starters are kept on your phone for that month so they are not asked for twice.
• "Going shopping": which shop and when is cleared when the trip ends — when you log the shop or tap Done shopping — and the app stops showing it after six hours either way.
• Backups: Supabase retains encrypted point-in-time backups on our behalf for a rolling window. Deleted data may persist there for up to that window before being overwritten.
• Server logs: rolling, typically 7–30 days.
• Website visit logs: 30 days, then deleted automatically by a storage lifecycle rule rather than by anyone remembering.
• Waitlist addresses: kept until the launch email has gone out, and deleted within 3 months of that. Ask us sooner and we will remove yours straight away. The address is never used for anything else, never added to a newsletter, and never shared.
• Statements and bank alerts you email in: the file itself — the PDF or CSV sitting in your household's private storage — is deleted as soon as you import or dismiss it, and after 14 days either way, whether or not anyone opened it. A nightly job does this. What outlives the file is the inbox entry: the sender, subject, filename, size, and what happened to it. That entry is the only evidence your bank ever sent anything, so for statements we keep it for as long as your account exists; for bank alerts, which arrive one per purchase rather than one per month, it is deleted 90 days after it is resolved — that is, once you have imported or dismissed it. Transactions your phone read out of a statement and you then accepted are ordinary financial records — the first bullet covers them. The separate delivery record described in 4.3 has its own 30- and 90-day limits.
• Diagnostic statement copies (4.4): 30 days, then deleted automatically. These can only ever be an app administrator's own statement, never yours.
• Failure diagnostics: 90 days, then deleted.
• Push delivery identifiers: the current device registration is kept while it is active and removed with the account. Logout recovery keeps only a one-way SHA-256 hash of the device token and random revocation code, with no profile or account id, for 90 days after its latest accepted presentation; a daily job deletes it. The raw token and code are not kept in that recovery table and neither value is logged.
• Subscription records (§4.6): for as long as your account exists, and deleted with it. The notices Stripe sends us about a website subscription are deleted after 13 months. If you delete your account while paying on our website, Stripe's customer identifier alone is kept for up to 13 months, so that anything still running can be cancelled. Apple and Stripe keep their own payment records under their own policies and legal obligations.
• Assistant cost records: the link to you — your profile, your household, and any error text — is erased at 90 days, leaving a cost record rather than a record of a person. The row itself is deleted at two years.
• Assistant admission records: the account-linked request, action, weighted usage, estimated provider cost and lease metadata are deleted after 90 days by a daily job, or sooner on account deletion; the account-free monthly project total is deleted after 95 days.
• What a question to Tally did: the link to you and your household is erased at 90 days; the row is deleted at two years.
• Whether a reply from Tally helped: a rating you take back is deleted at once; otherwise the link to you is erased at 90 days and the row is deleted at two years.
• Connected-tool records: the link to you, and any error text, is erased at 90 days; the rows are deleted at one year.
• Shop and bank counts: rebuilt every night, so a name that is no longer common enough disappears at the next count. A name an administrator has dismissed keeps only its spelling, so it is not suggested again.
• The scrambled IP behind a claim link's rate limit (§2): at most two hours, deleted by an hourly job. The scramble is one-way and salted, so the address itself is never held at any point.
• Join codes that matched nothing (§2): at most two hours, deleted by the same hourly job.
• Places taken in a group (§3): 30 days, deleted by a daily job, and at once if the account that took the place is deleted.
• That you keep a spreadsheet of a Household (§4.7): until you disconnect, leave the Household or delete your account, and 45 days after the app was last opened with your account if none of those happens first. A daily job does this.
• When you first connected a Google spreadsheet (§4.7): for as long as your account exists; deleted with it. It is the record that the free month was used, so nothing else removes it.
• How far connecting a spreadsheet got (§2): one year, deleted by a weekly job. There is no link to you to erase first.
• A live export link’s record (§4.8): for as long as its space exists, including after the link is turned off or expires; deleted with the space, or with the account of the person who made it.

8. Your rights

Under UK / EU GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Rectify anything that's wrong.
• Erase your account — do this in-app via Settings → Delete account, or email us and we will do it for you within one month.
• Restrict or object to processing.
• Data portability — receive an export of the financial records you've entered in a machine-readable format. Email us and we will provide it.
• Withdraw consent for notifications at any time in Settings.
• Complain — to us, and to the Information Commissioner's Office (below).

To exercise any of these rights, email support@sharedfinance.app. We may ask you to write from the address on your account, or to confirm who you are another way, so that we never hand your data to someone else.

Complaining to us

You can complain to us about how we handle personal data, whether or not you have an account. That includes, for example, someone whose email address was entered to share a loan with them. Tell us in whatever way reaches us; email to support@sharedfinance.app, from any address, is quickest. We will:

• acknowledge your complaint within 30 days of receiving it;
• look into it without undue delay, and keep you told how it is going;
• tell you the outcome and what, if anything, we have done about it.

You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk at any time. You do not have to come to us first.

9. Security

• All traffic between the app and Supabase is encrypted in transit (HTTPS / TLS).
• Data at rest is encrypted by Supabase using AWS-managed keys.
• Access to rows is enforced by row-level security policies scoped to household membership. You cannot read another user's data via the API.
• Sign-in uses Sign in with Apple, Google OAuth, or a one-time magic link — we never store your password.
• You can turn Siri & Spotlight indexing on or off, and enable Face ID / passcode lock and "hide balances", from within the app.

No system is perfectly secure, but we work to protect your data and will notify you and the relevant regulator without undue delay if we discover a personal-data breach that is likely to result in a risk to your rights.

10. Children

Shared Finance is not intended for children under 13 (or under 16 in the EU where applicable). We do not knowingly collect personal data from children. If you believe a child has provided us with data, email support@sharedfinance.app and we'll delete it.

11. Financial-services disclaimer

Shared Finance is a tracking-only app. It records who paid what and shows the running balance between you and your partner. It does not:

• Hold or move money.
• Connect to your bank or execute payments.
• Provide investment, tax, or financial advice.

Any settlement between household members happens outside the app. The one payment in Shared Finance is you paying us for Premium, and Apple or Stripe takes it, not the app (§4.6).

12. Changes to this policy

When we change this policy we update the "Last updated" date at the top. If a change affects what happens to data you have already given us, we will tell you in the app or by email before it takes effect. A change that only concerns something new, which you choose whether to use, applies from when you first use it, and the app says what it involves at that point.

13. Contact

Questions, requests, complaints: support@sharedfinance.app

You can also reach the UK ICO at ico.org.uk.

Home · Terms of Service · Help center