Privacy policy

STLD splits shared expenses between people. A shared ledger has to reach everyone in the group, so there is a server and an account. This page says exactly what that server holds, what never leaves your phone, and who else handles your data.

STLD is made by TinyApp Technologies LLP (“we”). The app is not released yet and has no users; this policy describes the app as it is being built and will be dated again before the first release.

What is saved to your account

• Who you are. Your name, email address and provider ID from Google or Apple, whichever you signed in with, and your profile photo if your provider has one. There is no password, so there is none to store.
• Your ledger. Your groups, the people in them, expenses, payments, comments and the activity feed.
• Attachments. Images and PDFs you add to an expense.
• A location, only on an expense you choose to attach one to.
• Push tokens for the devices you sign in on, so notifications reach them.
• AI usage. How many AI uses you have had, what each cost to run, and taps on an AI button after your free uses are gone.

What stays on your phone

A full copy of your ledger, so the app works with no signal. Also your search index, your queue of changes not yet sent, and settings the server has no use for, such as which tips you have dismissed.

If you turn on the app lock, your phone checks your face or fingerprint. STLD is only told whether the check passed.

What we never collect

• Your voice. Speech is turned into text on your phone. The audio never leaves it; only the text is sent, and only when you ask STLD to fill in an expense from it.
• Your contacts. The app never reads them. You add people by typing a name.
• Your location, unless you attach one to an expense yourself.
• Bank or card details. STLD records who owes what. It never moves money and is never told how you paid.

Who can see your groups

Everything in a group is visible to every member of that group, including attachments. That is what a shared ledger is, so it is worth being plain about: a receipt you add is a receipt your roommates can open. Nothing in a group is visible to anyone outside it.

We do not sell or share your personal information, and there is no advertising in the app.

AI

When you scan a receipt, speak an expense or type one as a sentence, what you gave us is sent to Anthropic, our AI provider, to fill in the fields. So that it can match names and categories, the group’s member names, categories and currency are sent with it. When you ask for a written spend summary, the group’s totals and member names are sent.

Anthropic does not use this to train its models; that is its default for this kind of use. It is not deleted the moment we are finished with it, though, and we would rather say so than imply otherwise: Anthropic keeps a copy for up to 30 days to investigate abuse, and longer if something is flagged. If that changes, this page will change with it.

Filling in an expense yourself sends nothing to the AI.

Crash reports

When the app fails, Firebase Crashlytics records the kind of failure, where in the code it happened, your device model, operating system and app version, and an identifier for this install of the app. We deliberately do not send the error’s message, because a message can carry what broke it, such as an amount or somebody’s name.

Who handles your data for us

• Supabase hosts the database and sign-in, on servers in India (Mumbai).
• Cloudflare stores attachments (R2) and serves this website.
• Anthropic reads what you send to the AI, as described above.
• Google Firebase delivers notifications and collects crash reports. Notifications also pass through Apple’s push service on iPhone.
• Google and Apple sign you in.

Some of these providers may process data outside India, including in the United States.

Keeping and deleting

Your ledger is kept for as long as your account exists. An attachment is kept until its expense or its group is deleted.

You can delete your account in the app under Account, or by emailing [email protected]. Read how deleting your account works for what happens to your groups.

• Erased straight away: your account, your link to Google or Apple, your email address, photo, settings, push tokens and AI usage. Your account stops working at once, and any backup copies are gone within 30 days.
• What stays: a placeholder with your display name remains in each group you were in, and the expenses, payments and comments you added stay with it. An expense you paid for is part of what other people owe each other; removing it would quietly change their balances. Your identity goes; your share of the arithmetic stays.
• When it is refused: while you owe or are owed money in any group. The app lists which groups, so you can settle up first.

Your choices

You can export any group as a spreadsheet from the app, and change or delete anything you added. To ask for a copy of what we hold about you, or to correct it, email [email protected].

Children

STLD is not directed at children and is not for anyone under 13.

Changes

If this policy changes in a way that affects what is stored or who can see it, the app will tell you, rather than leaving the change here to be found.

Contact

[email protected]. See also the terms of service.