Privacy policy
In short. Your ledger lives on your phone, encrypted. If you choose to back it up, it is encrypted on your phone first, with a key only your devices hold, so we cannot read it. We don’t show ads, we don’t use third-party analytics or tracking tools, and we don’t sell or share your data. The app counts a few anonymous milestones (such as “first entry added”), with no identifier attached, and you can turn that off.
This policy explains what ClearOwe (“ClearOwe”, “we”, “us”) collects when you use the ClearOwe app and clearowe.com, why, and the choices you have. It applies worldwide, including to users in India (Digital Personal Data Protection Act, 2023), the European Union and United Kingdom (GDPR), and the United States.
What stays on your phone
Everything you record (people’s names, phone numbers and notes you add, amounts, dates, loans, EMIs, split bills, things you lend, reminders and your preferences) is stored in a database on your phone. That database is encrypted (AES-256, SQLCipher) with a random key kept in your phone’s secure storage (Keychain on iPhone, Keystore on Android).
- Notifications are planned and delivered on your phone. Nothing about them is sent to us.
- Face ID, Touch ID and fingerprint unlocking is handled by your phone’s operating system. We never receive biometric data.
- Contacts: ClearOwe does not read your address book. You type the names you want.
- Photos and camera: if you attach a photo to an entry or a thing (a receipt, the drill you lent), ClearOwe uses the camera or photo library only when you ask it to, and only for that photo. Photos are shrunk and stored on your phone. They are not uploaded, not included in your backup, and not shared in links or statements.
Without an account, nothing you record leaves your phone, except what you choose to share yourself (for example a statement you send through WhatsApp).
If you create an account
An account is optional. It lets you back up your ledger and use it on more than one phone. To create one you sign in with Apple, with Google, or with your email address.
| What we receive | Why |
|---|---|
| Your email address, and your name if your sign-in provider shares it | To identify your account, send sign-in codes and reply to you |
| Your encrypted backup | To keep a copy of your ledger and sync it between your phones |
| If you sign in with Apple, a token Apple gives us for your account | Only so we can tell Apple to remove ClearOwe’s access when you delete your account, as Apple requires |
| Technical sign-in records (time of sign-in, IP address, device type) kept by our authentication provider | To keep your account secure and prevent abuse |
How the backup is encrypted
When you turn on backup, your phone creates a random 160-bit recovery code and shows it to you once. Every record is encrypted on your phone with AES-256-GCM, using a key derived from that code, before it is uploaded. The recovery code and the key never leave your devices.
Our servers store only the encrypted records plus the minimum needed to sync them: which kind of record each one is (for example “entry” or “person”), a random identifier, when it last changed, and whether it was deleted. We cannot read your names, amounts or notes. Because of this, we cannot recover your backup if you lose every phone and your recovery code.
Share links
You can send someone a link to a page on clearowe.com that shows your balance with them, so they can see it and pay without the app. A share link works without an account.
- Encrypted on your phone. The page’s contents (your name as you typed it, their name, amounts, dates, notes if you choose to include them, and the payment details you added) are encrypted on your phone with a key that exists only inside the link, after the “#”. Browsers never send that part of a link to a server, so we store the page only in encrypted form and cannot read it.
- “I’ve paid”. If the person taps “I’ve paid”, what they enter (amount, how they paid and an optional message) is encrypted in their browser with the same key and kept on our server only until your phone collects it.
- Notifications. If you allow notifications, we store your device’s push token with the link so we can tell you when someone taps “I’ve paid”. The notification never contains names or amounts.
- Turning a link off deletes it from our server straight away, along with anything waiting for you. Deleting all your data or your account turns off every link.
Anyone who has the whole link can open the page, so share it only with the person it is for. The page is not indexed by search engines.
Anonymous usage counts
To learn whether ClearOwe is working for people, the app counts a few moments, each at most once per installation: for example finishing setup, adding a first or second entry, coming back after a week, turning on reminders, seeing the Pro offer, starting a trial or buying Pro. Each count is just the name of the moment, added to that day’s total on our server. Nothing else is sent with it: no account, no device or advertising identifier, no names, amounts or other ledger content, and we don’t store IP addresses with it. The totals can’t be tied to you. You can turn this off at any time in Settings > Privacy (“Share anonymous usage counts”); development builds never send counts.
Purchases
If you buy ClearOwe Pro, the payment is handled by Apple (App Store) or Google (Google Play). We and our purchase provider (RevenueCat) receive a record of the purchase (product, date, price, country and an anonymous app user identifier) to unlock Pro on your devices. We never receive your card details.
What we don’t do
- No advertising, and no advertising identifiers.
- No third-party analytics or tracking SDKs. The only usage data is the anonymous counts described above.
- No selling, renting or sharing of your data for anyone’s marketing.
- No access by us to anyone’s ledger. Our internal tools show only counts (for example how many accounts exist), never people, entries or items.
Service providers
We use a small number of providers who process data on our behalf, under contracts that require them to protect it:
- Supabase (database and authentication), hosted in Mumbai, India (AWS ap-south-1). Data is encrypted in transit (TLS) and at rest.
- Apple and Google, if you sign in with them or buy through their stores.
- RevenueCat, for purchases, if you buy Pro.
- Vercel, which hosts clearowe.com. It keeps short-lived server logs (such as IP addresses) for security.
- An email delivery provider, to send sign-in codes.
How long we keep data
- Data on your phone stays until you delete it or remove the app.
- Share links stay until you turn them off. “I’ve paid” messages are deleted from our server as soon as your phone collects them.
- Your encrypted backup stays until you delete it. Deleting all your data, or deleting your account, removes it from our database straight away; copies in our providers’ routine backups expire within 30 days.
- Purchase records are kept as long as the law requires for tax and accounting.
Your choices and rights
- Delete all your data: Settings, then Account, then Delete all my data. Your account stays.
- Delete your account: Settings, then Account, then Delete account. This removes your account and backup. You can also ask us by email.
- Export: Settings, then Export as CSV, gives you a spreadsheet of everything you recorded.
- Access, correction and objection: most of your data is in the app, where you can see and change it. For anything else, email us.
Depending on where you live you may have further rights, including to complain to a data protection authority. We will respond to requests within 30 days.
Children
ClearOwe is not intended for children under 13 (or the minimum age in your country) and we don’t knowingly collect their personal data.
Security
We use encryption on your phone, end-to-end encryption for backups, TLS for everything in transit, and per-account access rules on our database. No system is perfectly secure, and we will tell you promptly if a breach affects your data.
Changes
If we change this policy we will update the date above, and tell you in the app if the change is significant.
Contact
Questions or requests: privacy@clearowe.com.