Privacy policy

STLD splits shared expenses between people. A shared ledger has to reach everyone in the group, so there is a server and an account. This page says exactly what that server holds, what never leaves your phone, and who else handles your data.

STLD is made by TinyApp Technologies LLP (“we”). The app is being tested by a small group of people through Apple’s TestFlight and Google Play’s testing tracks before its first public release; this policy describes it as it is now, and will be dated again for that release.

What is saved to your account

Who you are. Your name, email address and provider ID from Google or Apple, whichever you signed in with, and your profile photo if your provider has one. There is no password, so there is none to store.
Your ledger. Your groups, the people in them, expenses, payments, comments and the activity feed.
Attachments. Images and PDFs you add to an expense.
A location, only on an expense you choose to attach one to.
Push tokens for the devices you sign in on, so notifications reach them.
AI usage. How many AI uses you have had and what each cost to run.
Two things the server cannot otherwise see: that you tapped an AI button after your free uses were gone, and that you shared a group’s invite. Each is stored against your account as the kind of event and when, nothing more; they help us decide pricing.

What stays on your phone

A full copy of your ledger, so the app works with no signal. Also your search index, your queue of changes not yet sent, and settings the server has no use for, such as which tips you have dismissed.

If you turn on the app lock, your phone checks your face or fingerprint. STLD is only told whether the check passed.

What we never collect

Your voice. Speech is turned into text on your phone. The audio never leaves it; only the text is sent, and only when you ask STLD to fill in an expense from it.
Your contacts. The app never reads them. You add people by typing a name.
Your location, unless you attach one to an expense yourself. (Google Analytics works out your country and region from your IP address; see Usage analytics. The app never asks your phone where you are for it.)
Bank or card details. STLD records who owes what. It never moves money and is never told how you paid.

Who can see your groups

Everything in a group is visible to every member of that group, including attachments. Other members see your name, never your email address. That is what a shared ledger is, so it is worth being plain about: a receipt you add is a receipt your roommates can open. Nothing in a group is visible to anyone outside it.

We do not sell or share your personal information, and there is no advertising in the app.

AI

When you scan a receipt, speak an expense or type one as a sentence, what you gave us is sent to Anthropic, our AI provider, to fill in the fields. So that it can match names and categories, the group’s member names, categories and currency are sent with it. When you ask for a written spend summary, the group’s totals and member names are sent.

Anthropic does not use this to train its models; that is its default for this kind of use. It is not deleted the moment we are finished with it, though, and we would rather say so than imply otherwise: Anthropic keeps a copy for up to 30 days to investigate abuse, and longer if something is flagged. If that changes, this page will change with it.

Filling in an expense yourself sends nothing to the AI.

Crash reports

When the app fails, Firebase Crashlytics records the kind of failure, where in the code it happened, your device model, operating system and app version, and an identifier for this install of the app. It also records short codes for what the app was doing just before, such as “expense saved” or “sign-in refused”, and a fixed reason code for failures the app caught. We deliberately do not send the error’s message, or anything you typed, because a message can carry what broke it, such as an amount or somebody’s name.

Crash reporting is on in release builds of the app, including TestFlight and Google Play test builds, and off in development builds.

Usage analytics

We use Google Analytics for Firebase to learn where people get stuck when they start using STLD, whether anyone finds the receipt scanner, and how many people are still using it a week later.

What it is sent is a short, fixed list of things that happened, and how:

that the welcome screen was shown, that you started or finished signing in and with Apple or Google, and what you answered when asked about notifications;
that a group was created, an expense added (typed in, or from a receipt, your voice or a sentence), a payment recorded, an invite shared (and whether by the share sheet or by copying), a group joined, or a Splitwise file imported;
that a receipt scan or a voice or typed entry was started, and whether it was read, found nothing, was saved for later or failed;
which screen you opened, by its name in the app, such as “the group screen”.

Google also records an identifier for this install of the app, your device model, operating system and app version, and your country and region, worked out from your IP address. It is not given anything finer, such as your city.

It is never sent your name, your email address, any amount, currency or description, a group’s name, anything you typed or said, what is on a receipt, or anything that identifies a group, an expense or your account. It belongs to this install of the app, never to your account. STLD has no advertising, does not collect your phone’s advertising identifier, and does not use this to show you ads or to track you across other apps.

Analytics is on in release builds of the app, including TestFlight and Google Play test builds, and off in development builds. Google keeps it for two months, and does not use it for advertising or share it for its own products. Deleting your account also resets the analytics identifier on that phone.

Who handles your data for us

Supabase hosts the database and sign-in, on servers in India (Mumbai).
Cloudflare stores attachments (R2) and serves this website.
Anthropic reads what you send to the AI, as described above.
Google Firebase delivers notifications, collects crash reports and, through Google Analytics for Firebase, the usage analytics described above. Notifications also pass through Apple’s push service on iPhone.
Google and Apple sign you in.

Some of these providers may process data outside India, including in the United States.

Keeping and deleting

Your ledger is kept for as long as your account exists. An attachment is kept until its expense or its group is deleted.

You can delete your account in the app under Account, or by emailing [email protected]. Read how deleting your account works for what happens to your groups.

Erased straight away: your account, your link to Google or Apple, your email address, photo, settings, push tokens and AI usage. Your account stops working at once, and any backup copies are gone within 30 days.
What stays: a placeholder with your display name remains in each group you were in, and the expenses, payments and comments you added stay with it. An expense you paid for is part of what other people owe each other; removing it would quietly change their balances. Your identity goes; your share of the arithmetic stays.
When it is refused: while you owe or are owed money in any group. The app lists which groups, so you can settle up first.

Your choices

You can export any group as a spreadsheet from the app, and change or delete anything you added. To ask for a copy of what we hold about you, or to correct it, email [email protected].

Children

STLD is not directed at children and is not for anyone under 13.

Changes

If this policy changes in a way that affects what is stored or who can see it, the app will tell you, rather than leaving the change here to be found.

Contact

[email protected]. See also the terms of service.