For the mobile app, published by . Effective .
The heart of the app is private by design. All of the following is written to app storage that only can read, and it never leaves your phone:
Because this data lives only on your device, deleting the app deletes it. We cannot recover it for you, and we cannot hand it to anyone else, because we never had it. If you export your ledger, the file is written to your device and shared only through your own share sheet, to whoever you pick.
The app uses a small number of third-party services that collect data about how the app is used and about the device it runs on. None of them receive the content described above.
| What | Collected by | Why |
|---|---|---|
| Usage events: paywall opened, purchase started or completed, challenge or duel started and finished, goal milestone reached. These carry counters and fixed labels only, never your rule text, names, notes, photos or fine amounts. | Google Analytics for Firebase | To understand which parts of the app people actually use, and where they get stuck. |
| Automatic app and device information gathered by the analytics service: an app instance identifier, device model, operating system version, language and general region (worked out from your IP address, which is not stored), and session timing. | Google Analytics for Firebase | To make sense of the usage events above. |
| Crash reports: the error, a stack trace and device state at the moment of the crash. | Firebase Crashlytics | To find and fix crashes. |
| An anonymous account identifier. The app signs you in anonymously on first launch. This creates a random identifier for your install. It is not linked to your name, email or phone number, and we never ask you for any of those. | Firebase Authentication | To give the install a stable identity so purchases can be restored. |
| Purchase and subscription information: which product was bought, when, its status, and the anonymous identifier above. Also a small counter recording how many times you have closed the upgrade screen, so the offer can be tuned. | RevenueCat, plus the App Store or Google Play | To unlock what you paid for, restore it on reinstall, and handle renewals and cancellations. |
| Configuration settings the app fetches when it starts. | Firebase Remote Config | To change app settings without shipping an update. |
| A push notification token issued to your device by Google. | Firebase Cloud Messaging | Notification support is built into the app. We do not currently send push notifications, and the token is not sent to any server of ours. |
The reminders the app shows, such as the monthly settle-up nudge, a duel deadline or a goal milestone, are scheduled on your device by the app itself. They are not sent from a server, and no data leaves your phone to produce them. You can turn reminders off in the app's settings, and you can turn off notifications entirely in your device settings.
These are the services described above. Each has its own privacy policy:
You can decline any of these and keep using the app. Declining the camera and photo permissions simply means fines are filed without a photo.
Your on-device data stays until you delete it in the app or uninstall the app. Usage and crash data held by the services above is retained according to their own schedules, which their policies describe. Purchase records are kept as long as needed for your subscription and for the legal and tax reasons the stores require.
Requests go to . We aim to respond within 30 days.
The app is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, email and we will delete it.
Your app data is held in your device's private app storage, which other apps cannot read, and is protected by your device's own passcode and encryption. The services listed above receive data over encrypted connections. No system is perfectly secure, but the strongest protection here is structural: the sensitive material never leaves your phone in the first place.
The third-party services above are operated by companies based in the United States and may process data there and in other countries. By using the app you understand that the limited data described in this policy may be processed outside your country of residence.
If we change what the app collects, we will update this page and change the effective date at the top. Material changes will also be announced in the app or in the store listing's release notes. Continuing to use the app after a change means you accept the updated policy.
Questions about this policy or about your data go to . A real person reads it.