Pooled Privacy Policy

Who this policy is from

Pooled is made and published on Google Play by Moiasun LLC, a Delaware limited liability company at 16192 Coastal Highway, Lewes, DE 19958, United States. Its developer name on Google Play is SunnyOrbit, which is Moiasun LLC's brand.

Moiasun LLC is the “controller” of the personal data described here, which means it decides why and how that data is used. In this document “we” means Moiasun LLC, and “you” means the person using the app.

• Email: support@sunnyorbitapps.com
• Post: Moiasun LLC (Pooled), 16192 Coastal Highway, Lewes, DE 19958, United States

The person responsible for privacy at Moiasun LLC is the owner of Moiasun LLC, who can be reached at support@sunnyorbitapps.com or at the postal address above. For users in Canada, including Quebec, this person is accountable for our handling of personal information and is the person in charge of its protection.

What stays on your phone

Pooled is local-first. An account is for backing up what is already on your phone, not for permission to use the app. Everything below works with the phone in flight mode and no account at all:

• Your expenses and income: the amount, category, note, date and how it was paid.
• Wallets, budgets, transfers, grocery lists, and your lent & borrowed records and their repayments.
• Receipt photos. These always stay on the phone, and they are also uploaded once you have an account (see “Photos” below).
• Your app-lock PIN or password. It is stored as a salted, stretched derived key, never the secret itself, and it never leaves the phone.
• Your chosen currency, language and app settings.

Without an account, we receive none of this. We have no copy of it and no way to get one.

What does go out, even with no account. Each time Pooled opens, it reads one public document from Google Cloud Firestore, config/app. It holds a single number: the oldest version of the app that is still allowed to run. If your version is older, the app shows “Update required” and a button to Google Play, so that unsupported and possibly insecure versions stop being used. The request carries no account and nothing that identifies you. Like any request over the internet, it does show Google your phone's IP address and the fact that a copy of Pooled was opened. If the phone is offline, the app uses the last answer it saw, or simply runs if it has never seen one.

That request also carries a Firebase App Check token. To get one, the app asks Google Play's Integrity service to confirm that this is a genuine copy of Pooled from Google Play on a genuine Android device, and Google turns the answer into a short-lived token, renewed from time to time. It is a verdict about the app and the device, not about you, and it is never shown to us as anything that identifies you. Nothing else leaves the phone until you make an account. Pro can only be bought with an account, so with no account the app never contacts RevenueCat or opens a Google Play purchase.

Android's own backup is switched off for this app. Neither the automatic backup to your Google Drive nor the phone-to-phone transfer when you set up a new device will copy Pooled's data, because a ledger holding salaries and spending should not travel somewhere you did not choose to put it. The deliberate way to take your records out of the app is the Export screen, which produces a CSV or PDF that you hand to whatever you like. With or without Pro, you can also ask us for a copy (see “Your rights”).

One file on the phone is not encrypted. Pooled's home-screen widgets show figures such as a balance, and Android's launcher cannot ask the app to decrypt anything. So the figures a widget displays are kept in a plain preferences file inside the app's private storage. Other apps cannot read it, it is excluded from backup, and the widgets hide their figures when the app lock is on, but the file itself is not encrypted.

What we hold when you make an account

Signing in uploads everything you already have. The moment you make an account, the app copies your whole existing ledger to it, and keeps it in sync from then on: your profile, wallets, entries, transfers, categories, budgets, grocery lists, lent & borrowed records and your memberships of shared spaces. There is no partial sync and no separate switch for it. This is the moment a private app on your phone becomes one with a copy in the cloud, so please read this section before you sign up.

Your identity

Firebase Authentication, operated by Google, holds:

• your email address;
• your password, which Google holds in hashed form; we never see it, and neither does the app after you type it;
• your display name;
• whether your email address has been verified;
• a profile picture URL, if you have one;
• your user ID, a long random string that Firebase creates for your account.

If you sign in with Google instead, we receive your Google account's email address, display name and profile picture from Google rather than collecting them ourselves. We do not ask Google for anything else. No contacts, no Drive, no calendar.

Like any server, Google's servers see the IP address your phone connects from. Google's Firebase documentation says Firebase Authentication keeps the IP addresses used to sign in for a few weeks, for security. We do not use IP addresses for anything, and the app does not store them.

Your profile record

Your account also has a profile record in Firestore, under users/{your-user-id}. Besides your name, email address and picture, it holds two things you should know about:

• When you accepted the Terms of Use (termsAcceptedAt). The app asks you to accept the Terms of Use before you create or join a shared space, and records the date and time you first did, so it does not ask again.
• Your block list (blockedUserIds): the user IDs of anyone you have blocked. It is kept on your account so that a block follows you to a second phone.

Only your own account can read this record. The people you block are not told and cannot see the list, and neither can the other members or the owner of a space. It is deleted with your account.

Daily and ownership counters. To apply the daily limit on new records, our security rules keep a small record under usage/{your-user-id}: today's date in US Pacific time, how many entries and payments you added that day, when, and which record was the last one. Our server also keeps limits/{your-user-id}: how many shared spaces and wallets you own, so the free plan's limits can be checked once they start. Neither holds anything you wrote, and only your own account can read them. They are deleted by our server a few minutes after the account is deleted.

Reports are not stored by us. When you report somebody in a shared space, the app blocks them for you and writes the report out as a short text: who it is about, which space, and the reason you picked. It then opens your phone's share sheet so you can send that text wherever you choose, for example to the owner of the space or to us by email. Nothing about the report is sent to us or saved in the cloud by the app. If you email it to us, we hold it as an email, as described in the SunnyOrbit Privacy Policy.

Early-access grants and the OG badge

Before 11 October 2026 at 04:33 UTC, anyone who made an account and confirmed their email address while early access was open got an early-access grant: 6 months of Pro, free, and a permanent “OG” badge. Those grants are honoured as they are. Since then, the first 100 accounts made from that moment that confirm their email address get the same grant, in the order they confirm.

A grant is one record in Firestore, under grants/{your-user-id}. It holds its kind (og) and when it was created and, for the first 100, when its free Pro ends and the place number. Grants made before 11 October 2026 at 04:33 UTC were created by the app itself, under security rules that allowed it only while early access was open and only for a confirmed address. Since then, only our server creates them. The server also keeps a record of the place it gave your account and, for a grant made before that time, the date it was first made, so a grant cannot be restarted. Only your own account can read your grant. Your OG badge is shown next to your name to the members of the shared spaces you are in. A grant cannot be extended, and it is deleted with your account, together with those records. The OG badge itself stays next to your name in shared spaces until we remove your name on request (see “How long we keep it”).

One place per email address. So that one inbox cannot take several of the 100 places, for example by deleting an account and signing up again, our server keeps a one-way hash (SHA-256) of the confirmed email address of every account that took a place, in a cleaned-up form, together with the place number, its dates and the random user ID of the account that took it. It keeps the same kind of hash, with the user ID, for every account made before 11 October 2026 at 04:33 UTC, whether or not its address was confirmed, and for any account we gave free Pro by hand, so those addresses cannot later take one of the 100. We keep this hash with no end date, because its only job is to stop the same address taking a place again. The hash is not your address and cannot be turned back into it, but anybody who already knows an address can work out its hash, so we treat it as personal data. We keep it after you delete your account, with the details just listed and nothing else. If you later make a new account with the same address, it gets the same place and the same end date back, not a new 6 months. Addresses from email relay or alias services do not qualify for a place.

Purchases and Pro

Pooled Pro is an optional subscription. You buy it through Google Play, which takes the payment under its own terms and the Google Privacy Policy. We never see your card or bank details, your name or your street address. Google Play's sales reports show us, for each order, the order number, the price, and the buyer's country, state or province, city and postal code, which we use only for tax and accounting.

To confirm a purchase and keep your Pro status with your account, the app and our server use RevenueCat, Inc. (United States), a subscription service that acts for us as our processor. The app contacts RevenueCat only when you are signed in with a confirmed email address and open the Pro screen or your subscription screen, buy, or restore a purchase. If you have a subscription, or a purchase our server has not confirmed yet, it also checks in with RevenueCat when the app opens. RevenueCat receives:

• your Pooled user ID, the long random string Firebase gave your account, not your name or email address;
• the Google Play purchase token and order ID, the product and plan, the price and currency, and the store country;
• the dates of the purchase, the free trial, each renewal, a cancellation or refund, and when Pro ends;
• like any server, your phone's IP address, and basic technical details such as the app version, the Android version and the language.

The app turns off RevenueCat's collection of device and advertising identifiers, and RevenueCat receives nothing from your ledger. RevenueCat also gives us totals of sales, trials, renewals and refunds. That is sales reporting about purchases, not tracking of what you do in the app.

Our server keeps a record of your subscription under entitlements/{your-user-id}: whether Pro is active, the plan, the dates, whether it will renew, whether a payment is being retried, whether it was refunded, and the Google Play order ID. That record is what tells the app and our server that you have Pro, so it follows your account to a new phone. Only your own account can read it, and only our server can write it. It is deleted when you delete your account, and at the same moment our server asks RevenueCat to delete its record of you.

PRO badge. While you have Pro, a PRO badge is shown next to your name to the members of your shared spaces. Our server checks it against your subscription or early-access grant and takes it off when Pro ends or your account is deleted.

Deleting your account does not cancel your subscription. Google Play keeps charging until you cancel it there. The app warns you of this before it deletes an account with a renewing subscription. Cancel in Google Play under Payments & subscriptions, then Subscriptions.

Notifications

If you are in a shared space and allow notifications, the app stores a notification token for this phone under your account, at users/{your-user-id}/devices. The token is an identifier issued by Google Firebase Cloud Messaging (FCM). With it we store the app's language, the phone's platform, when it was last updated, whether this phone's app lock is on (so that we leave amounts out), and a number saying which kinds of notification this version of the app can open. We also store your Notifications choice for each shared space, at users/{your-user-id}/spacePrefs (no saved choice means on). Only you and our server can read these.

Our server uses them to send three kinds of notification, through FCM, in your app's language:

• when someone asks to join a space you own: the space's name and the name of the person asking;
• when another member adds expenses in a space you share: titled with the space's name, then the member's display name, the categories and, unless your app lock is on, the total, for example “Our Apartment” over “Sam added Groceries, Fuel · $89.50”. Everything one person adds is grouped into one notification, sent once they have stopped adding for three minutes, and never more than about eleven minutes after their first;
• when someone records a payment to you in a space: for example “Sam sent you $25.00”, or “Sam sent you money” while your app lock is on.

A notification never includes a note or a photo, and nothing is sent about your personal wallets. Its text passes through Google's FCM and appears on your phone, including the lock screen if your phone shows notifications there.

To group expenses, our server keeps a short list of the newest ones one person added in one space (their record IDs, amounts, category IDs and dates) for a few minutes, eleven at most, and deletes it when the notification is sent. So that nothing is notified twice, it also keeps the IDs of records it has already notified about for 48 hours; an automatic expiry policy in our database then removes them, normally within a day after that. Neither list holds a note or a photo.

Notification tokens are deleted when you sign out (if the phone can reach the internet at that moment), when you delete your account, and when Google tells us a token no longer works. Your Notifications choices are deleted with your account. You can turn notifications off for one space with the Notifications switch in that space's Members sheet, turn off the “Space activity” category in your phone's notification settings, or turn off notifications for Pooled entirely in your phone's settings.

Your ledger

With an account, the app copies your records to Google Cloud Firestore, under users/{your-user-id} and spaces/{space-id}. That copy includes, in full:

• Every expense and income entry: the amount, the note you typed, the category, the date, and the payment method.
• Wallets and spaces, and their members: the name of each personal wallet and each shared space, its currency, and the display name and picture of everyone in it.
• Transfers: payments you record between people inside a shared space, with “Record a payment”. No money is moved; the app just records it.
• Budgets, per category per month.
• Grocery lists and their items, including prices and who ticked them off.
• Lent & borrowed records and their repayments, including the name of the other person, because that is what the record is for. See “Other people's information” below.
• Invite codes for shared spaces, and requests to join them.

Notes are free text. If you type someone's name, an account number or a medical detail into the note on an expense, that is what gets stored. The app does not read your notes or decide which of them are sensitive, and we do not analyse them. Pooled does not connect to any bank: every figure in it is one you or a member of your space typed in.

Deleting something in the app marks it as deleted. When you delete an entry, a transfer, a category, a list or a lent & borrowed record, the app does not erase the row. It marks it as deleted (a “tombstone”), on the phone and in the cloud copy, so that your other devices and the other members of a shared space learn that it was deleted rather than bringing it back. The record stops appearing in the app, but its contents, including any note, stay in the cloud copy. In your personal wallets they are erased when you delete your account. In a shared space they stay with that space after you delete your account, like the rest of its records, unless you ask us to remove them. Budgets and join requests are the exceptions: those are erased outright. Photos are handled separately and are removed straight away (except photos in a shared space that was deleted as a whole, see below).

With an account, the app also reads one public document of exchange rates from Firestore, at most once a day, and converts amounts on the phone. No amount and nothing about you is sent to work out a conversion, and the phone never contacts the company that supplies the rates.

This copy is not end-to-end encrypted. It is encrypted in transit (TLS) and encrypted at rest by Google, but the service can read it, and so can we through the Firebase console. We look at it only to run the service, to deal with a report or a support request you send us, or when the law requires it. Access rules keyed to your user ID stop other users of Pooled from reading it. If that is not a trade you want to make, use the app without an account: everything except the cloud backup and shared spaces still works.

Photos

With an account, the photos you attach in the app are uploaded to Google Cloud Storage, so that they survive a lost phone and appear on your other devices. A copy always stays on the phone as well. Without an account nothing is uploaded; photos you attached before making one are uploaded the next time you sign in.

That means these, and only these:

• Receipt photos you attach to an expense or income entry, stored under spaces/{space-id}/entries/….
• Photos on a lent & borrowed record: a picture of the other person if you add one, and any receipt or IOU note you attach. These are stored under spaces/{space-id}/loans/….
• Your profile picture, if you set one, stored under users/{your-user-id}/avatar.

The app resizes each photo before it is stored, to at most 1280 pixels on the long edge. It also removes the notes your camera writes into the file before the photo is saved anywhere: the EXIF block, the XMP block and any embedded comment. That includes where the photo was taken, if your camera records it, and also the camera's serial number and the original timestamp. This happens the moment you pick or take the picture, so the copy on your phone, the copy in cloud storage and the copy inside any PDF you export are all stripped. Removing these notes does not change the picture: the stripping step copies the image data through exactly as it is.

The one format this cannot strip is HEIC/HEIF, because its metadata is not a block that can be cut out. It does not arise in practice, because the app always asks the system to re-encode a picked photo, which produces a JPEG. The app never re-adds anything it has removed. If you want to be certain, turn off location tagging in your camera app as well.

Who can see your photos

• Photos in your personal wallets can be read only by your own account.
• Photos in a shared space can be seen by every current member of that space, because seeing the receipt is the point of sharing it. Someone removed from the space loses access to its photos.
• Your profile picture can be loaded by any signed-in Pooled account that knows your user ID, so that people who share a space with you can see your face next to your name. Your user ID is a long random string, and the only place the app ever shows it to anybody is inside a space you are both in. But we would rather tell you this than imply a limit we do not enforce. Pick a picture you are comfortable being visible to other users of the app, or none at all. Nothing else you put in your own folder is readable by anyone but you.

These rules are enforced by Google's servers, not by the app. Like the rest of your cloud data, the photos are encrypted in transit and at rest by Google but are not end-to-end encrypted: the service can read them, and so can we through the Firebase console.

When your photos are deleted

• Taking a photo off an entry, deleting the entry, or deleting the lent & borrowed record deletes the uploaded copy as well as the one on the phone. If the phone is offline at that moment, the app deletes the uploaded copy the next time it can.
• Changing or removing your profile picture deletes the old one.
• Deleting a whole shared space does not delete its photos: they stay in storage until we erase the space on request (see “How long we keep it” below).
• Deleting your account deletes every photo in your personal wallets and your profile picture, in the same action. Photos you put in a shared space are the exception. See “How long we keep it” below, which says exactly why.

Who else receives your data

Apart from Pro purchases, which also involve RevenueCat (below), Pooled contacts no company but Google. With no account, it contacts Google only for the launch version check described under “What stays on your phone”, which carries nothing about you or your money. With an account, it also uses Google for your sign-in, your backup, your photos and, if you allow them, notifications. Google LLC runs these services for us as our processor, which means it handles the data on our behalf and under its data processing terms, not for its own purposes:

• Cloud Firestore, for the launch version check and, with an account, the copy of your ledger, your early-access grant, your subscription record, the daily and ownership counters, and your notification tokens and settings;
• Firebase App Check, which asks Google Play to confirm that requests come from a genuine copy of the app, to stop scripts from abusing the service. It attaches a verdict about the app to requests the app is already making, including the launch check with no account. It does not identify you to us and records no activity;
• Firebase Authentication, for your sign-in, once you have an account;
• Cloud Storage for Firebase, for your photos, once you have an account;
• Cloud Functions and Firebase Cloud Messaging, to send notifications to the members of shared spaces who have allowed them (see “Notifications” above). Cloud Functions also run our server's part of Pro: granting early-access places, checking purchases with RevenueCat, counting for the daily limit, and showing the PRO badge.

For Pro, two more companies are involved. Google Play sells the subscription and takes the payment; for that, Google acts on its own account, under the Google Privacy Policy. RevenueCat, Inc. checks purchases and keeps their status for us, as our processor, under its data processing terms. What it receives is listed under “Purchases and Pro” above.

The only other people who can see any of your data are:

• The members of a shared space you join. They see your display name and picture, your OG badge if you have one, a PRO badge while you have Pro, and what you record in that space, including your notes and receipt photos. If they allow notifications, they are also told when you add expenses there or record a payment to them, with your display name and, unless their app lock is on, the amount. A personal wallet is never shown to anyone.
• Authorities, where the law requires it. If we receive a valid legal demand, we will check it and hand over only what it requires.

There is no analytics, no crash reporting, no advertising and no tracking of any kind, and apart from Google and, for Pro, RevenueCat, no other company hears from this app at all.

This changed in version 2.87.0. Earlier test builds made one request at every launch to ipinfo.io, a commercial IP-intelligence company, falling back to api.country.is, to guess a currency from the country the connection came from. The request carried no identifier and the app kept only a two-letter country code, but any web request reveals the address it came from. That request is gone. Pooled now works out which currency to offer from the region your phone is set to and the time zone its clock is running in, and neither leaves the device. If you still have an older build, update it and the request stops.

What this app does not do

This is unusual enough to be worth stating flatly, and it is verifiable from the app's dependency list:

• No analytics. Nothing counts your screens, sessions or taps. There is no Firebase Analytics, no Google Analytics, no third-party product analytics.
• No crash reporting. There is no Crashlytics or equivalent. Errors are written to the device's own log and go nowhere.
• No advertising and no ad SDK. No ad network is built into this app and no ad is served. Nothing collects an advertising ID.
• No tracking, attribution or fingerprinting SDK of any kind.
• We do not sell personal data, including sensitive data, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising or profiling.
• We do not use your records to train anything, including AI models.
• No automated decisions. Nothing in Pooled makes a decision about you by automated means.

Do Not Track

Some browsers and devices send a “Do Not Track” or Global Privacy Control signal. Pooled does not track you across other apps or websites over time, and does not let any third party do so, so there is nothing for these signals to switch off. We treat every user as if the signal were on. No third party collects personal information about your online activities over time and across different websites or apps when you use Pooled.

How your data is protected

On your phone

Your ledger and your receipt photos are encrypted at rest with AES-256-GCM, under a key that is generated on the device and held in the Android Keystore. Deleting the data discards the key with it. You can also put the app behind a PIN or a password, which your fingerprint can then unlock.

Here is what that does and does not cover. It protects the files if they leave the phone, for example in a forensic dump or on a rooted device. It does not make your data unreadable to us, because the cloud copy described above is a separate copy that is not encrypted with that key. This is device-at-rest encryption, not end-to-end encryption.

In transit and in the cloud

All traffic between the app and Google's services uses TLS. In Firestore, your documents are readable only by an account whose user ID matches them, or by the other members of a space you have joined. That is enforced by server-side security rules, not by the app. Cloud Storage applies the same kind of rules to photos, as set out under “Photos” above. Nothing has yet been audited by an independent security firm.

If a security incident ever puts your personal data at risk, we will tell you, by email if you have an account, without undue delay, and we will notify any data protection authority the law requires us to.

Permissions the app asks for

• Internet. For the version check each time the app opens, and, once you have an account, to sign in and to back up your ledger and your photos.
• Camera and photos. Only when you attach a photo. The app opens the picker you chose; it does not browse your gallery.
• Notifications. For notifications about your shared spaces: a request to join a space you own, expenses other members add, and payments recorded to you. And for one reminder suggesting you make an account so your records are backed up. The app works normally if you decline.
• Run at startup. So that a reminder you have already agreed to survives a reboot instead of silently vanishing.
• Biometrics. Optional, for unlocking the app. Your fingerprint or face is handled entirely by Android; the app is only told yes or no, and never receives or stores any biometric data.
• Google Play billing. Lets the app open Google Play's purchase screen for Pooled Pro. It gives the app no access to your payment details.

Pooled does not ask for your location, your contacts or access to your files.

Other people's information

Two features let you record things about people who are not you. A lent & borrowed record stores the name of the person you lent to or borrowed from, and a photo of them if you add one. A shared space stores the display name and picture of each member. If you enter somebody else's details, you are responsible for doing so lawfully and for telling them, where the law where you live requires it. We hold that information only to make the feature work. Deleting the record removes any photo of them straight away, but, like any deleted record, its other contents stay in the cloud copy (see “Your ledger” above): in a personal wallet until you delete your account or we remove them on request, and in a shared space until we remove them on request.

If you are that other person and you do not use Pooled, you can ask us to remove your name or photo from someone's records: write to support@sunnyorbitapps.com and tell us enough to find it, such as the name of the person who recorded you. Only records in an account's cloud copy are within our reach; a record kept on a phone with no account never reaches us.

Why we use your data, and our legal bases

Data protection law in the EU, the UK and some other places asks us to say which legal basis we rely on for each use. These are ours:

• Running your account, syncing and backing up your ledger and photos, and showing what you record in a shared space to its members: performance of our contract with you, the Terms of Use. We cannot restore your records to another phone without holding them.
• Recording when you accepted the Terms of Use, and keeping your block list: performance of the contract, and our legitimate interest in being able to show that you accepted the rules of shared spaces and in letting you protect yourself.
• Selling Pro, checking purchases with RevenueCat and keeping your subscription record: performance of the contract, because Pro is what you bought under the Terms of Use. Google Play, which sells the subscription, keeps the order records that tax law requires; we do not keep a separate copy after you delete your account, apart from the 90-day log of subscription events described under “How long we keep it”.
• Showing your PRO badge to the members of your shared spaces: performance of the contract, because the badge is part of what Pro gives you.
• Counting new records for the daily limit, and counting the spaces and wallets you own: performance of the contract, and our legitimate interest in keeping the service affordable to run and stopping automated abuse.
• Holding and applying your early-access grant: performance of the contract, because the grant is part of what the Terms of Use give you.
• Keeping a hash of the email address of accounts that took, or cannot take, an early-access place: our legitimate interest in giving the 100 places to 100 different people. It is a hash, not the address, and only the place number, its dates and the random user ID are kept with it.
• The launch version check: our legitimate interest, and yours, in keeping unsupported and possibly insecure versions of the app from running. It carries nothing about you beyond what any internet request reveals.
• Notifications (join requests, expenses in a shared space, payments to you): your consent, given when you allow notifications on your phone. Turn them off for one space in its Members sheet, or for the whole app in your phone's settings, and they stop.
• Security, meaning App Check, sign-in protection, the security rules and dealing with abuse: our legitimate interest, and yours, in keeping the service and your data safe and in stopping automated abuse of it.
• Dealing with reports and enforcing the Terms of Use, including closing an account: our legitimate interest in keeping shared spaces safe for the people in them.
• Names and photos of people who are not users, entered in a lent & borrowed record: our legitimate interest, and the user's, in a record that says who it is about. It is kept to a minimum, visible only to the user (or the space it is in), and removed on request.
• Answering legal requests and keeping records the law requires: compliance with a legal obligation.

Where we rely on legitimate interests, you can object, and we will stop unless we have a compelling reason that overrides yours. Apart from notifications, we do not rely on consent for anything we hold today. If we ever add something that needs it, such as marketing email, we will ask first, and you will be able to withdraw that consent at any time.

An account is optional. You do not have to give us any personal data to use Pooled, beyond the IP address that the launch version check, like any internet request, shows to Google. Without an account, the only things you cannot do are back up to the cloud and share a space with other people.

Where your data is held

Moiasun LLC is a US company, and Google stores the Pooled cloud data in the United States. RevenueCat, which holds purchase records, is also in the United States:

• Your records (Cloud Firestore) are in the nam5 multi-region, in the United States.
• Your photos (Cloud Storage) are in the us-east1 region, in South Carolina, United States.
• Our server functions (Cloud Functions for Firebase) run in the us-central1 region, in Iowa, United States.

Google may process them in other countries in the course of running those services. The people who run SunnyOrbit may also look at the data from outside the United States, including from Bangladesh, when that is needed to run the service or answer you.

If you are in the EU, the UK or Switzerland, this means your data is handled in countries whose data protection laws differ from yours. We handle it as this policy describes wherever it is. For Google's part, we rely on the EU-U.S. Data Privacy Framework (with its UK Extension and the Swiss-U.S. framework), in which Google takes part, and on the Standard Contractual Clauses in Google's data processing terms for Firebase and in RevenueCat's data processing terms. Email us if you would like more information about these safeguards.

How long we keep it, and how to make it stop

We keep your cloud data for as long as your account exists. There is no scheduled purge and no retention timer: it is there until you remove it. If we ever change that, we will update this policy and tell you by email before it applies to you. Data on your phone stays until you delete it, reset the app or uninstall it.

Delete account, in the app's menu and on your account screen, does all of this in one go:

• erases your profile record (including your Terms of Use acceptance date and your block list), your lent & borrowed records and your personal ledger from Firestore: every entry, transfer, category, budget, grocery list and item, including anything marked as deleted;
• deletes your early-access grant (grants/{your-user-id}) and the server's records of its place and first date, so your free Pro goes with the account;
• deletes your subscription record (entitlements/{your-user-id}) and asks RevenueCat to delete its record of you. This does not cancel a Google Play subscription: cancel that in Google Play;
• takes your PRO badge off every shared space you were in, and deletes its record;
• deletes the notification tokens stored for your phones, and your Notifications choice for each shared space;
• deletes every photo you uploaded from Cloud Storage: the receipts and lent & borrowed photos in your personal wallets, and your profile picture;
• deletes your Firebase Authentication account, so the email address and password go with it;
• wipes the copy on the phone, including the encryption key and every photo, and returns the app to its welcome screen.

Two small counters, usage/{your-user-id} and limits/{your-user-id}, are deleted by our server a few minutes after the account. Delete account erases your current wallets in full, including records you had deleted in them. If you deleted a whole wallet earlier, email support@sunnyorbitapps.com and we will make sure nothing of it is left.

A few things are kept. If your account took one of the first 100 early-access places, was made before 11 October 2026 at 04:33 UTC, or was given Pro free by us, the one-way hash of your email address described under “Early-access grants” stays, so the address cannot take a place again. We keep this hash with no end date, because its only job is to stop the same address taking a place again. Our server keeps a short log of each subscription event RevenueCat sends us (its type, its dates and your random user ID) for 90 days, so that no event is applied twice. It is then deleted automatically. Our server's technical logs, which can contain your random user ID and the ID of a space, are kept by Google Cloud for 30 days and then deleted automatically. The list of records our server has already notified about expires by itself within about three days. A record of the wallet limits for a wallet you deleted earlier, and your own join requests still waiting in other people's spaces, can remain: email support@sunnyorbitapps.com to have them removed. And Google Play keeps its own record of any purchase, under Google's policies; we cannot delete that.

Apart from the cases above where we say to email us, there is nothing to write to us about afterwards, and nothing to wait 30 days for. The photos go in the same press of the button as the records, while you are still signed in. That is the only moment they can go, because the permission to delete them is your sign-in.

The order matters and is enforced. The photos are removed before the documents that grant access to them, and the account is deleted last of all. If any part of the cloud copy cannot be erased, usually because the connection dropped, the app stops before deleting your account. It tells you which file or record it could not remove, and you can try again. Anything it had already erased stays erased. Because the account goes last, a failed attempt never leaves your current ledger or its photos in the cloud with no account left to remove them.

With no account, the same control is called Reset everything. It wipes the phone, because there is nothing anywhere else to delete.

If you cannot get into the app, you can ask us to delete your account by email. The Delete your Pooled account page explains how, and we do it within 30 days.

One honest exception. A shared space is not deleted, even one you created. Other members' money is recorded in it and their ledgers still have to add up, so the space and its records carry on for them. You lose access to it, because your account no longer exists, and your profile picture is deleted from storage, so it no longer shows. In this version of the app your display name stays on your membership in the cloud copy, with your OG badge if you had one, so the remaining members still see it next to the entries and transfers that involved you, and a join request you sent that was never answered stays in that space's list until its owner declines it. If you want your name removed, email support@sunnyorbitapps.com from your account's address, naming the spaces, and we will replace it with a generic label by hand within 30 days; the Delete your Pooled account page explains how. Receipt photos you attached to entries in that space stay with those entries, visible to its remaining members, for the same reason the entries do. If you want them gone, take them off the entries before deleting your account.

Deleting a shared space hides it from every member, but its records stay in our database marked as deleted, and photos attached to its entries stay in storage. To have a shared space and its photos erased completely, email support@sunnyorbitapps.com from your account's address, naming the space, and we will erase it within 30 days.

One more thing is outside our systems. If the owner of a space removes you, your cloud access to it ends at once, but your own phone keeps the copy of that space it already held, frozen. It no longer receives anything new, and it goes when you reset the app or delete your account.

Backups. We do not keep backups of the Pooled database, and point-in-time recovery is switched off. Firestore itself keeps earlier versions of changed or deleted documents for one hour. Google may take longer to remove deleted data from its own systems, as set out in its Firebase data processing terms. We cannot read or restore that data.

Uninstalling the app without deleting your account removes the copy on the phone but leaves the cloud copy in place. Sign in again on any device and it comes back.

Your rights

Wherever you live, you can ask us to access, correct, delete or export the personal data we hold about you, to restrict what we do with it, or to object to it. Most of this you can do yourself, straight away, without asking us: the app's Export screen gives you your entries as a CSV or PDF, the account screen lets you change your name and email address, and “Delete account” erases your account and data, with the few exceptions set out above. A copy of your data never needs Pro: email us and we will send you everything we hold about you, free, in a common machine-readable format.

For anything you cannot do in the app, or if you want written confirmation of what we hold, email support@sunnyorbitapps.com from the email address your account uses, so we can tell the request is yours. We will never ask for your password. We reply within one month. If a request is complex, we may extend this by up to two further months, and we will tell you why within the first month. Requests are free, and we will not treat you differently for making one.

If you are in the EU or the UK

You have the rights the GDPR and the UK GDPR give you: access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent where we rely on it. Our legal bases are listed under “Why we use your data” above.

If you are in the EU or EEA, you can complain to a data protection supervisory authority, in particular in the country where you live or work, or where you think the problem happened. The European Data Protection Board lists them at edpb.europa.eu.

If you are in the UK, you have the right to complain to us first, at support@sunnyorbitapps.com. We will acknowledge your complaint within 30 days and answer it without undue delay. You can also complain to the Information Commissioner's Office at ico.org.uk.

If you are in the United States

We do not sell personal data, including sensitive data, and we do not share it for cross-context behavioural advertising or use it for targeted advertising. There is no advertising in this app, so there is nothing to opt out of. You can review and correct your details in the app, and ask us for a copy or for deletion as described above. Exercising any of these rights will never get you a worse version of Pooled. This policy is posted to meet the California Online Privacy Protection Act and the Delaware Online Privacy and Protection Act.

If you are in Canada

You may ask for access to your information and challenge its accuracy. If we cannot resolve a complaint between us, you may take it to the Office of the Privacy Commissioner of Canada.

If you are in Brazil

You have the rights the LGPD gives you, and you can use the email address above to exercise them. You may also petition the national data protection authority, the ANPD.

If you are in Australia

You may ask for access and correction, and complain to the Office of the Australian Information Commissioner if you are not satisfied with how we handle it.

Wherever you are

If your country gives you a right not listed here, you still have it. Ask and we will honour it, and you can always contact your national data protection authority. The answer to almost all of these is the same in any case: an email to us gets you a free copy of everything we hold, and “Delete account” removes your account and data, uploaded photos included, apart from the few records listed under “How long we keep it”.

Children

Pooled is not directed at children. You must be at least 13 years old, or the minimum age for digital consent where you live if that is higher, to use it. We do not knowingly collect personal information from anyone under 13. If we learn that a child under 13, or under the minimum age where they live, is using Pooled with an account, we will close the account and delete its data. If you believe a child has given us personal data, including if you are their parent or guardian, email support@sunnyorbitapps.com and we will act on it.

Changes to this policy

If we change what the app collects or who it is shared with, we will update this page and the date at the top before shipping the release that makes the change. If a change materially affects how we use data you have already given us, we will also tell you by email if you have an account, before it takes effect. The current version always lives at sunnyorbitapps.com/pooled/privacy.

This policy is written in English. If we publish a translation and the two differ, the English version applies, except where the law where you live says otherwise.

Contact

Questions about this policy, requests about your data, or anything else: support@sunnyorbitapps.com.

Post: Moiasun LLC (Pooled), 16192 Coastal Highway, Lewes, DE 19958, United States.