Privacy policy

What is stored, where, and for how long.

Updated 2026-10-05

What is stored

The trips you make and the things you put on them: days, places, bookings, expenses, rounds and the log of who changed what. For each person on a trip, what the group writes about them: their name, how to pay them ("Pay them at": an IBAN, a payment address or a link) and a note on what the group should know ("What to know"). Anyone on the trip can read and change these, for anyone on it. A note can touch on health, such as an allergy or a need for step-free access, so write only what that person is happy for everyone on the trip to read. Names, pay details and notes are kept beside the trip, not in its change log: changing or clearing one replaces the old text instead of leaving it in the history. For your account: the identifier Sign in with Apple assigns, the email address it hands over (or Apple's relay address), and the name you gave. If you sign in with Google: the identifier Google assigns, the email address of your Google account if Google says it is verified (an unverified one is not kept, and the stored one follows your Google address each time you sign in), and the name on your Google account if yours has none yet. Nothing else comes from Google: not your photo, your contacts or any other Google data. A Google sign-in whose verified address is that of an existing account opens that account rather than a second one. If you sign in with a code sent by email: that address, which becomes your account's address. The code is stored only as a one-way hash, works for ten minutes and once only, and stops working after a few wrong tries. For each phone you sign in on: a device identifier and, if you allow notifications, a push token. For each invitation you send: the address you sent it to, until it is accepted or revoked.

The preview list

An address left on getndemo.com to join the preview, the language of the page it was left on, when it arrived, when a letter last went to it, and whether it was confirmed. Two letters go to it: one to confirm the address is yours, which asks you to press a button, and one when your invitation is ready. Each carries a link that takes the address off the list on the spot. It stays until you take it off or the preview ends, it is not joined to any account, and nothing else is ever sent to it.

What is not

The change log holds no names and no email addresses — people appear in it as their seat on the trip, which is what makes deleting an account possible without rewriting everyone else's history. A public share link never carries the budget, the expenses, the balances, or anybody's address.

Where

In the European Union. The server runs on Fly.io in Frankfurt and the database is hosted by Neon in Frankfurt (AWS eu-central-1). Nothing is stored anywhere else, and no data is sold or shared for advertising.

For how long

Until you delete it. Deleting a trip removes it for everyone on it, and the log records who did. A deleted trip can be restored for thirty days, then it is erased for good. A person's name, pay details and note go when the trip goes, and when that person deletes their account. Deleting your account removes the trips only you were on, anonymises your seat on the trips you shared, and ends your sessions. The database host keeps six hours of point-in-time history for recovery; after that a deletion is final.

Who else sees it

The subprocessors page lists every company that handles this data on our behalf. There are no others: no analytics, no advertising, no tracking.

Your data

Download my data, on the account screen, gives you everything above as one JSON file, on the spot, except the notes on people, which the download does not carry yet. Delete my account, on the same screen, is immediate.

This app's reports

The app keeps crash and hang reports on the phone that produced them and does not send them to us. Apple may share crash reports with us if you have opted in to that in iOS Settings.