Privacy Policy

1. In short

• We collect the minimum needed to run the app: your Google account basics, the profile you set, and the expenses you record.
• People in your groups can see your name, username, photo and the expense details you add to those shared groups.
• We don’t sell your data, show ads, or use tracking/marketing cookies.
• We use only privacy-friendly, cookieless analytics to understand overall usage — never to track you across the web or build ad profiles.
• You can edit your profile, download your data, or delete your account at any time from your Profile.

2. Information we collect

We collect the following categories of personal data:

• Account information. When you sign in with Google, we receive your email address, name and profile photo from Google.
• Profile information. The username, display name and profile picture you choose in the app.
• Content you create. The expenses you record (title, optional note, amount, who paid what, date and category), the groups you create or join, group invitations, and any budgets you set.
• Technical information. A sign-in session cookie (required to keep you logged in), and your IP address for the purpose of rate-limiting certain requests to prevent abuse. Some preferences (such as your last opened group and date settings) are stored only on your own device.
• Push subscriptions. If you enable notifications, we store a per-device push delivery address and encryption keys so we can send you notifications.
• In-app notifications. When something notification-worthy happens in your groups (a new expense, an invite, a budget alert), we store a short feed entry for you — the notification text, a link, which group it concerns, and who triggered it — kept for 30 days.
• Error diagnostics. If the app encounters an error, a technical report (the error message, stack trace, browser/device type and the page where it happened) is sent to our error-monitoring service (Sentry) so we can fix bugs. These reports are not tied to your account and contain no expense content.
• Usage & performance data. We use privacy-friendly, cookieless analytics (Vercel Web Analytics and Speed Insights) that record aggregated, anonymized information such as page views, referrer, approximate region, device/browser type and page-load performance. This is not tied to your identity, and is never used to track you across other sites or to build advertising profiles.

We do notintentionally collect special-category data (such as health, religion or political views). Note that free-text fields (expense titles/notes) and some categories (for example “Giving”) could reveal such information if you choose to enter it — please keep that in mind when recording expenses.

3. How we use your data

• To create and operate your account and authenticate you.
• To provide the core service: recording expenses and showing per-person and per-category spending within your groups.
• To enable group features (memberships, invitations, shared budgets).
• To keep the service secure and prevent fraud, abuse and spam.
• To comply with our legal obligations.

4. Legal bases (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the app and the features you ask for.
• Legitimate interests — to keep the service secure, reliable and free of abuse, balanced against your rights.
• Consent — where we ask for it (for example, the optional features you choose to use); you can withdraw consent at any time.
• Legal obligation — where we must process data to comply with the law.

5. How your information is shared

With people in your groups. Potluck is a shared ledger. When you add an expense to a group, the other members of that group can see your name, username and profile photo, and the details of that expense (title, amount, who paid what, date, category and any note). Your email address is never shown to other members.

With service providers (sub-processors). We use a small number of trusted providers to run the app. They process data only on our instructions:

• Google — Sign-in (OAuth). Provides your email, name and profile photo when you choose to sign in.
• Supabase — Hosts the application database (your account and expense data).
• Vercel — Hosts and serves the application; processes requests and operational logs; and provides cookieless, aggregated usage and performance analytics (Vercel Web Analytics and Speed Insights).
• Upstash — Rate limiting, to protect the service from abuse.
• Sentry — Error monitoring. When something in the app breaks, receives a technical error report (error message, stack trace, browser/device type, the page URL) so we can find and fix the problem. Configured without session tracking or identity — reports are not tied to your account.

For legal and safety reasons. We may disclose data if required by law or to protect the rights, safety and security of our users and the service.

We never sell your personal data and we do not share it for advertising.

6. International data transfers

Our database is currently hosted in South Korea, and our other providers operate globally. If you use Potluck from another country, your data will be transferred to and processed in these locations. Where required, such transfers rely on appropriate safeguards (such as the providers’ standard contractual clauses).

7. How long we keep your data

We keep your account data for as long as your account is active. Deleted expenses are kept for up to 30 days before being permanently removed. In-app notification feed entries are kept for 30 days, then permanently removed. Because Potluck is a shared ledger, when you delete your account we anonymize your account rather than erasing everything: your personal details are removed, but the amounts you contributed to shared groups are retained in anonymized form (shown as “Deleted user”) so that your groupmates’ totals remain accurate.

8. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and data (right to erasure).
• Receive a copy of your data in a portable format.
• Object to or restrict certain processing, and withdraw consent.
• Lodge a complaint with your local data-protection authority.

You can exercise most of these rights directly in the app: edit your details under Profile → Edit profile, download a copy of your data under Profile → Download my data, and delete your account under Profile → Delete Account.

9. Security

We protect your data with industry-standard measures: encryption in transit (HTTPS/TLS), encryption at rest at the database layer, row-level security, and server-side access controls so that you only ever see data from groups you belong to. No system is perfectly secure, but we work to keep your data safe.

10. Cookies & local storage

Potluck uses a strictly-necessary sign-in cookie to keep you logged in, and stores a few functional preferences locally on your device. We use no advertising, marketing or cross-site tracking cookies.

We use privacy-friendly, cookielessanalytics — Vercel Web Analytics and Speed Insights — to understand overall usage and performance (see section 2). Because they set no cookies and collect only aggregated, anonymized data that isn’t tied to your identity, no cookie-consent banner is required; your acceptance of this policy covers this use.

11. Push notifications

If you turn on notifications, we store a push subscriptionfor that device — a delivery address issued by your browser plus two encryption keys. We use it to send you notifications such as “someone added an expense to your group” and budget alerts. Notifications are opt-in: we never send them unless you enabled them on that device, and you can mute individual groups.

Delivery goes through your browser vendor’s push service (Google, Apple, or Mozilla, depending on your browser). Notification content is encrypted on our server and decrypted on your device — the push service relays it but cannot read it.

A device’s subscription is deleted when you turn notifications off, when the push service reports it gone (for example after you clear site data), and when your account is deleted.

Independently of push, Potluck keeps an in-app notifications feed: when something notification-worthy happens in your groups (a new expense, an invite, a budget alert), we store a short entry for you — the notification text, a link, which group it concerns, and who triggered it — so you can see it inside the app even if push is off or muted. Feed entries are kept for 30 days, then permanently deleted; they are also deleted when you delete your account.

12. Children

Potluck is not intended for children. You must be at least 16 years old to use the app. We do not knowingly collect personal data from anyone under that age; if you believe a child has provided us data, please contact us so we can remove it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the app. Your continued use of Potluck after changes take effect means you accept the updated policy.

14. Contact

For privacy questions or to exercise your rights, the quickest way is to use the in-app controls described above. You can also contact us at heyalan.id@gmail.com.