Privacy Policy

1. Summary

This app stores your household and investment records on your own device by default. If you turn on the optional Google Drive sync, transactions and account names are exchanged with a spreadsheet in your own Drive. If you create or join a shared ledger (for a couple or a group), only that ledger’s transactions are stored on our server so that everyone in that ledger can see them. Your personal ledger, journal entries and photos, your period records, and your holdings are never sent to our server.

2. What we never collect

We never collect or store the following, under any circumstances.

• Full bank account numbers, card numbers, or CVC codes
• National ID numbers, passport numbers, or similar unique identifiers
• Login credentials for banks or brokerages (IDs, passwords, certificates)
• Home address, phone number, date of birth, or gender
• Location data, contacts, photo library, call logs, or the contents of text messages
• Transactions, balances, and holdings in a personal ledger are not collected by us (with Drive sync on, transactions and account names go to your own Google Drive)
• Photos and text you add to a journal (stored on the device only — never sent to a server)
• Period records and the mood, symptoms and notes you log with them (stored on the device only — never sent to our server or to Google Drive)

3. What we collect and why

We collect only what is necessary.

• [Only if you sign in] Email address, sign-in provider (Kakao / Naver / Google / Apple), sign-up time, and last sign-in time — to identify your account and check your plan. Signing in is required only to connect a shared ledger or to use the web service; if you use the app alone, we hold none of this. We neither request nor store your name or profile photo.
• [Only if you create or join a shared ledger] That ledger’s transactions (date, type, category, amount, memo, who paid, dues month), the ledger name, your nickname, and your account identifier are stored on our server (Supabase). Only people in that ledger can see them. Personal ledgers are not stored. When you leave a ledger and the last member also leaves, that ledger’s records are deleted from the server.
• [Only if you turn on Google Drive sync] Your Google account email and identifier, the file ID, transaction IDs, and last sync state are kept on your device. Transaction date, type, category, account name, amount, memo, formulas, and deletion state are exchanged directly with Google Drive. Of the basic profile data Google provides, we do not use or store your name or photo. Web access tokens are held in memory only; on mobile, credentials are managed by the Google Sign-In SDK.
• [Only if you request an AI report] A randomly generated anonymous device identifier and aggregated figures (monthly income and expense totals, category ratios, and similar) — to enforce the monthly usage limit and generate the summary. Individual transactions and merchant names are not sent.
• [If you see ads] Google AdMob processes an advertising identifier (Android Advertising ID / iOS IDFA) along with device and app information. We do not collect or retain this ourselves.

4. Period tracking (optional)

This feature works only if you turn it on in Settings. If you do not, none of this applies to you.

The period start and end dates you record, along with the mood, symptoms, cravings and notes you log for a day, are stored on your device only. They are never sent to our server, to Google Drive, to a shared ledger, or to any AI service. The cycle statistics and spending comparisons the app shows are all computed on the device.

This is not a medical device. Predicted ovulation and fertile windows are estimates derived from the average of your past records, and must not be relied upon for contraception or for planning a pregnancy.

Setting a PIN under Settings > Lock makes the app ask for it before opening this screen. Note that this blocks access to the screen; it does not encrypt the data file on the device.

You can delete individual records at any time, or erase all period data at once from Settings. Uninstalling the app removes it as well.

5. Camera and photo access

We ask for camera or photo access only when you add a photo to a journal entry. If you decline, you can still write text entries, and every other feature works exactly the same.

A photo you choose is copied into the app’s own folder and kept on the device only. It is never sent to our server or to any AI service, and it is removed when you uninstall the app.

We do not scan or index your photo library. Only the single photo you pick at that moment is read.

6. Retention and deletion

Account information is deleted immediately when you delete your account. You can request this in the app under Settings > Delete account, or through the account deletion page linked below.

AI usage counts are aggregated monthly against an anonymous device identifier. Uninstalling the app removes that identifier.

When you leave a shared ledger you can no longer see it. If other members remain, the records stay with them; when the last member leaves, the records are deleted from the server.

Disconnecting Google Drive stops syncing. The last connection details stay on your device to prevent duplicates if you reconnect, and are removed when you reset all data. The Drive spreadsheet remains in your own Drive even after you uninstall the app or delete your account. To remove it, delete the file in Google Drive and empty the trash. You can also revoke access under your Google account’s connected apps.

Household and journal data on the device (including photos) is deleted when you uninstall the app. You can back it up in advance with Settings > Export JSON.

7. Service providers

We use the following providers only to the extent needed to run the service.

• Supabase Inc. — sign-in and account storage
• Google LLC (Drive and Google Sign-In) — authentication for the account you choose, and storing and syncing the spreadsheet in your own Drive
• Supabase Inc. — if you use a shared ledger, storing that ledger’s transactions
• Google LLC (AdMob) — serving ads
• Anthropic PBC — generating AI summaries (aggregated figures only)
• Google LLC (Play Billing) — paid plan payments and receipt verification

8. Ads and opting out of personalization

Ads are shown on the free tier. Paid plans have no ads.

If you do not consent, you will see non-personalized ads instead of interest-based ones. You can change this at any time under Settings > Ad privacy settings.

Android: Settings > Google > Ads lets you reset or opt out of the advertising ID. iOS: Settings > Privacy & Security > Tracking lets you decline.

9. Children

This app is not directed at children under 14, and we do not knowingly collect personal information from children.

10. Your rights

You may request access to, correction of, deletion of, or suspension of processing of your information at any time. Contact us at the email address below and we will respond within 10 days of receipt.

11. Security measures

All communication is encrypted with HTTPS. Server tables are protected by row-level security so that you can read only your own data. Our first line of protection is simply not storing sensitive financial identifiers in the first place.

12. Changes to this policy

If this policy changes, we will announce the changes and their effective date in the app and on this page.