Privacy policy

What is stored, where, and for how long.

Updated 2026-09-07

What is stored

The trips you make and the things you put on them: days, places, bookings, expenses, rounds and the log of who changed what. For your account: the identifier Sign in with Apple assigns, the email address it hands over (or Apple's relay address), and the name you gave. For each phone you sign in on: a device identifier and, if you allow notifications, a push token. For each invitation you send: the address you sent it to, until it is accepted or revoked.

The preview list

An address left on getndemo.com to join the preview, the language of the page it was left on, when it arrived, when a letter last went to it, and whether it was confirmed. Two letters go to it: one to confirm the address is yours, which asks you to press a button, and one when your invitation is ready. Each carries a link that takes the address off the list on the spot. It stays until you take it off or the preview ends, it is not joined to any account, and nothing else is ever sent to it.

What is not

The change log holds no names and no email addresses — people appear in it as their seat on the trip, which is what makes deleting an account possible without rewriting everyone else's history. A public share link never carries the budget, the expenses, the balances, or anybody's address.

Where

In the European Union. The server runs on Fly.io in Frankfurt and the database is hosted by Neon in Frankfurt (AWS eu-central-1). Nothing is stored anywhere else, and no data is sold or shared for advertising.

For how long

Until you delete it. Deleting a trip removes it for everyone on it, and the log records who did. Deleting your account removes the trips only you were on, anonymises your seat on the trips you shared, and ends your sessions. The database host keeps a short point-in-time history for recovery, measured in days; after that a deletion is final.

Who else sees it

The subprocessors page lists every company that handles this data on our behalf. There are no others: no analytics, no advertising, no tracking.

Your data

Download my data, on the account screen, gives you everything above as one JSON file, on the spot. Delete my account, on the same screen, is immediate.

This app's reports

The app keeps crash and hang reports on the phone that produced them and does not send them to us. Apple may share crash reports with us if you have opted in to that in iOS Settings.