OweJar · Public information

Privacy Policy

This policy explains the information OweJar uses to provide its mobile app, cloud sync, web app and authorised AI connections, including ChatGPT.

Effective and last updated: 13 October 2026

OweJar is operated by Nivesh Saharan. For privacy questions or requests, contact hey@nive.sh. This policy covers OweJar’s own handling of information; third-party services have their own policies.

Information you keep in OweJar

Your ledger can contain people’s names and contact details, money entries, amounts and currencies, split expenses and participants, settlements, bills, deliveries, recurring schedules, notes, categories, reminders, settings and activity history. Only record other people’s information when you have a legitimate reason and the authority to do so. Avoid storing bank credentials, card numbers, government identifiers or unrelated sensitive information in notes.

Phone records are stored locally. Enabling cloud sync uploads the supported ledger and account data to OweJar’s hosted service. The current web and AI connection access committed cloud records; they cannot access unsynced phone changes, photos kept only on a device, or your local backup files. Contact and camera permissions are requested for the features that use them. QR scanning processes camera frames on the phone and sends the decoded sign-in request for review and approval, not camera footage.

Selected contacts, photos and backups

Account-based sharing uses an explicitly chosen public display name and optional avatar, random discovery codes, connection requests, and group invitations. We do not match accounts by contact names, phone numbers, or email addresses. Accepting a group invitation shares its disclosed history with you and permits members to assign future shared expenses. Shared descriptions, allocations, comments, receipts, revisions and settlement records are visible to authorized participants. A group admin may also create a secret read-only link that shows the group's member names, expense titles, amounts, payments and balances to anyone holding it, without receipts, notes, payment details or contact information. Admins can replace or delete such links at any time, and a link stops working when its creator is no longer an admin. Private contact notes and historical private splits are not automatically published.

Images you explicitly upload as sharing profile photos, group guest photos, shared receipts or payment QR codes are stored by the hosted service after metadata removal. Group guest photos are visible to authorized members of that group. Private People photos uploaded on the web or through optional mobile photo sync are available only in your own book. Linking a private person to a group changes the photo you see, without sharing that private photo with other members. Using your local Me photo in shared groups requires a separate choice. Selected QR images are decoded on your device. Optional payment destinations are visible within accepted relationships. External payment services handle payments under their own terms; opening a payment link does not verify payment. Device push tokens are used for shared notifications, which you can mute or disable.

If you choose a contact or photo, OweJar reads the selected information for that feature. Saved contact fields can sync; the address book is not uploaded as a list. Private People photo syncing is a separate optional setting; existing local photos stay on the device until you enable it. Uploaded images are resized and image metadata is removed. Removing a selected photo does not change financial records. Encrypted backups you create can include records and photos, use your passphrase, and are saved in the location you choose: iCloud Drive on iOS or a selected folder or document provider on Android, which may include Google Drive. Your device or operating-system backups may separately include app data. Destinations and people or apps you explicitly share with process the files or content under their own policies. Delete those copies separately.

Receipt scanning

When you choose to scan a receipt and confirm sharing, OweJar sends the selected receipt image and currency through its hosted service to Anthropic’s AI service to extract the merchant, date, items and amounts. Review the result before saving it. OweJar’s receipt-reading handler uses the image to service the scan request and does not persist that scan input; a photo separately attached to an expense is stored as a shared receipt under the image and group-access rules above. Anthropic processes scan inputs and outputs under its applicable policies and agreements with OweJar, including its retention terms. Cancelling before you confirm sharing does not send the image for scanning.

Shared links and payment details

You can create secret read-only links to a statement with one person or to a group. Anyone holding such a link can see what it shows, without signing in, until you turn it off or replace it. You can add payment methods, such as bank account details, to your account and choose which of them each of your links shows. A link shows the payment details you chose only while the person or someone in the group owes you; they are otherwise visible only to you, and are not available to connected AI clients. OweJar does not move money or confirm payments made with these details.

Account, subscription and technical information

We process account identifiers, email addresses, names and sign-in provider information, such as Apple account identifiers where used. Subscription processing includes customer and purchase identifiers, product and entitlement status, renewal or expiry information and provider events. Payment-card details are handled by the relevant app store, not entered into the OweJar ledger.

Authentication uses session and authorisation records, connected-client consent, device or browser descriptions and security events. Email account creation verifies ownership through a one-time code. The separate shared demonstration account uses a username and a stored password hash. The server and its hosting infrastructure process network information such as IP addresses, request metadata and diagnostic logs to operate and protect the service. Support requests contain the information you choose to send us.

How we use this information

We use information to store and sync your records, calculate balances, display history, manage schedules, authenticate accounts, apply subscription access, carry out the changes you request, maintain security, resolve errors and provide support. Authentication and service emails can include sign-in codes and cloud-retention notices.

Service providers and connected AI clients

• Hosting and database infrastructure providers process cloud records and technical information needed to run OweJar.
• Object-storage providers store the private and shared images you choose to upload, subject to OweJar account and group access controls. Expo, Apple and Google deliver enabled push notifications; the authoritative notification inbox remains in OweJar.
• Amazon Simple Email Service delivers authentication and service emails.
• RevenueCat processes subscription customer and entitlement information; Apple and Google handle purchases made through their stores.
• An AI client you authorise, including ChatGPT provided by OpenAI, can receive account details and the cloud records its permitted tools request. Depending on your approved access, it can also request ledger changes. Protected changes require a separate OweJar confirmation.
• If you use the linked Google support form, Google processes that submission. Email, device backups and other services you choose are also subject to their own policies.

Providers may process information in countries different from yours. Contact us with questions about processing locations. An AI provider’s use and retention of information it receives depend on your agreement and settings with that provider. Revoking OweJar access stops future authorised requests; it does not delete information already returned in a conversation.

Cookies and sign-in security

The web app uses necessary session cookies, and QR sign-in uses a separate temporary browser-binding cookie. Browser session cookies are HttpOnly; OweJar does not store browser authentication tokens in local storage. A QR code contains a short-lived approval secret rather than a mobile or browser session token. Scanning alone does not approve sign-in. These public policy pages do not require cookies, run scripts or contain advertising or analytics trackers.

Connections to the hosted service use HTTPS. Access controls separate accounts and restrict connected clients to approved permissions. Hosted sync is not an end-to-end encrypted backup: the server processes readable ledger data to provide the service. No storage or transmission method is guaranteed to be completely secure.

Retention

• Cloud account and ledger records are retained while your account and cloud service remain in use. Deleted ledger records, settlement reversals and operation receipts can remain as history until the book or account is purged. The incremental sync change feed is retained for 90 days.
• When personal cloud access becomes inactive, private cloud financial data is scheduled for removal after 12 months. The retention deadline appears in your account’s cloud status. Subscription-provider verification or outages can delay cleanup. Expiry cleanup does not itself delete your sign-in account or other participants’ shared history.
• Shared financial history is independent of a Pro subscription. Leaving a group preserves relevant historical and settlement records. Account deletion removes your discovery, public profile, payment and notification details and replaces your shared participant identity with “Deleted member”; necessary shared financial records remain available to the other participants.
• Browser sessions use a 30-day lifetime that may be renewed while you use the service; signing out or revocation can end them earlier. QR requests expire after five minutes; cleanup removes request records more than one day after expiry.
• A minimal deletion registry retains the account identifier and deletion-request timestamp indefinitely to prevent a restored database from reactivating a deleted account. It does not contain the ledger.
• Support correspondence, security/operational records and infrastructure copies may remain after a record is removed from the active service where needed to resolve requests, maintain security or meet legal obligations. Retention for these records depends on their purpose and applicable legal requirements rather than a single automatic deletion deadline. Contact us with an access or deletion request concerning them.

Your choices and deletion

You can review and correct records, export supported data in the mobile app, revoke connected clients, sign out of devices and choose whether to use cloud sync. Existing local records and backups remain under your control.

To delete your cloud account, use the account-deletion action in the mobile app’s Cloud or Multi-device sync settings, or contact hey@nive.sh for help. We may need to verify ownership. An authenticated deletion request immediately revokes OweJar sessions and connected-client access, then queues removal of the cloud ledger, account and RevenueCat customer record. Cleanup is retried when a provider is unavailable; it may not finish immediately.

Cloud account deletion does not erase phone data, device or exported backups, information already supplied to an AI client, or records an app store must retain. It does not cancel an Apple or Google subscription; cancel that separately through the store. You may request access, correction or deletion and exercise other rights available under applicable law by contacting us.

Shared demonstration data

The reviewer demonstration account contains fictional records and is shared among people given its credentials. Changes made there are visible to other users of that account and persist until an operator resets or removes them. Do not enter personal or real financial information in it. OweJar manages its identity and credentials separately from personal accounts.

The home page can also open a public demonstration in one click, without an account or email. It shows fictional records, is shared by everyone who opens it and is read-only, so visitors cannot save changes in it. Opening it creates an ordinary browser session cookie; it is replaced with newer fictional records about once a week.

Policy changes and contact

We will publish changes here with an updated date and provide additional notice where required. Questions about this policy or your data can be sent to hey@nive.sh.