Privacy Policy

Last updated: August 16, 2026

1. Controller

2. The core principle: no accounts, local first

sharepot works without a user account. There is no registration, no email address, no phone number, and no requirement to use your real name. Everything you enter in the app (pots, expenses, balances, member names, categories, budgets, reminders) is stored only on your device — as long as you don’t actively share a pot online, none of this information ever leaves your device.

The app contains no ads, no tracking, no analytics SDKs, and builds no usage profiles.

If you use the Home Screen widget (iPhone only), the app stores a small extract for it (pot name, colour, symbol, member count and your own balance) in a shared area on your device so the widget can display it. This extract never leaves your device and is not transmitted. The widget deliberately shows no amounts; only the pot name is visible on your Home Screen.

If you use the Apple Watch app, your iPhone sends the watch an extract of your pots (name, colour, symbol, currency, the members’ names and the expense titles you used most recently) so you can add an expense there; the expense you add travels back the same way. This exchange happens solely between your own devices over Apple’s iPhone-to-watch connection – none of it reaches us. Balances are not sent to the watch.

3. Live sync of shared pots (only if you turn on “Share online”)

If you enable online sharing for a pot (or join a shared pot via link, QR code, or code), the contents of that pot are synchronized through our hosting provider so that all members see the same state. The following is transferred and stored:

• Pot data: name, symbol, color, currency, and pot settings
• Write-protection flags: whether a pot or an individual entry is protected against changes by others, plus the public key of the device that created the pot (the same kind of key as in section 4)
• Expenses and payments: titles, amounts, dates, category (including custom category names), who paid and who participated
• Members: the display names and avatar colors chosen within the pot
• Payment methods only if you explicitly release them (see section 4)
• an anonymous, randomly generated device identifier (Supabase anonymous ID) that is not linked to any real identity and cannot be linked to one by us
• a cryptographic derivative (hash) of the join code; the code itself is not stored

Purpose: providing the core “shared pot” feature (synchronization between members’ devices).
Legal basis: Art. 6(1)(b) GDPR (providing the feature you requested).

Hosting/processor: Supabase (project hosted in the EU region West Europe, Ireland). A data processing agreement under Art. 28 GDPR is in place; data is processed on servers in the European Union (Ireland).

Important: the contents of a shared pot are visible to all members of that pot. Anyone who knows the join link or code can join — only share links with people who belong in the pot.

Write protection for pots and individual entries is an app feature: it prevents other members from changing or deleting things by accident and does not restrict visibility. On the server, every member holding the pot key still has write access, so the protection is not a security measure against deliberate tampering. Continue to share pot links only with people you trust.

4. Payment methods (PayPal.Me, Revolut, Wise, Cash App, Monzo, IBAN)

Payment methods stored in your profile stay locally on your device until you actively release them in a shared pot (when settling, for selected members, or via the pot's “share payment methods automatically” switch). The released details (e.g. PayPal.Me name, IBAN and account holder name) are transmitted end-to-end encrypted: they are encrypted on your device individually for each selected member and can only be decrypted on that member's device – neither the server nor other members can read them. You can withdraw a release per member at any time; the encrypted details are then removed from the shared pot.

sharepot itself does not process payments and receives no bank or transaction data. If you tap a payment link (e.g. PayPal.Me), the respective service opens; from there, its own privacy policy applies.

5. In-app purchases (Sharepot Pro)

Purchases and subscriptions are handled entirely by the respective store: on iPhone by Apple via the App Store (StoreKit), on Android by Google via Google Play (Play Billing). We receive no payment data and store no purchase information on our own servers; the app checks the purchase status locally through that store’s framework. Apple’s or Google’s privacy policy applies in addition.

6. Exchange rates

If you record an expense in a foreign currency, the app fetches current exchange rates from a rates API (open.er-api.com). The request contains no personal data and none of your pot contents — only the currency code. For technical reasons the provider receives your IP address (Art. 6(1)(b) GDPR; required to obtain the rates).

7. Camera, receipt scanner, and QR codes

The camera is used only by the receipt scanner, and only when you actively start it. The receipt scanner exists on iPhone only; the Android app requests no camera access at all. Text recognition runs entirely on your device (Apple Vision/VisionKit). Camera images are never uploaded and are not stored. A join QR code is read by your system’s camera app on both platforms – sharepot only ever receives the finished link.

8. Reminders and notifications

Payment reminders you create are stored locally on your device via Apple’s Reminders framework; this feature exists on iPhone only. App notices (e.g. that someone requested your payment details) are local notifications generated by your own device on both platforms — there is no push service with servers of ours.

9. Retention and deletion

• Local pots: exist only on your device; deleting them in the app removes them permanently. Deleting the app removes all local data.
• Shared pots: “Delete this pot for everyone” marks the pot and its contents as deleted on the server; after that, no device can access them. Individually deleted entries (expenses, payments, members) are likewise removed for all devices.
• Server-side data marked as deleted is permanently and irreversibly removed from the database by an automated cleanup job no later than 90 days after deletion.
• On request to the contact address above, we will also permanently erase server-side pot data earlier (please include the pot name and approximate time frame; since we keep no accounts, we can only locate data through these details).

10. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). Please contact the address above. Note: since sharepot keeps no accounts and the anonymous device identifier cannot be attributed to a person, we can only locate server-side data based on the details you provide (e.g. pot name). You also have the right to lodge a complaint with a data protection supervisory authority — the authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information.

11. Children

sharepot is not directed at children. The app collects no data that would allow us to determine users’ ages.

12. Website statistics (Cloudflare Web Analytics)

Our website is delivered via the network of Cloudflare, Inc. (USA); in doing so, Cloudflare processes technically necessary connection data (e.g. the IP address) as a processor. For reach measurement we use Cloudflare Web Analytics: no cookies, no fingerprinting, no user profiles – we only see aggregated metrics such as page views, country, and browser. The legal basis is our legitimate interest in secure delivery and anonymous statistics (Art. 6(1)(f) GDPR); transfers to the USA are based on the EU-US Data Privacy Framework.

13. Changes to this policy

We will update this privacy policy when the app or the legal situation changes. The current version is always available at sharepot.axeptdesign.com/privacy/en.html; the date above indicates the version.