Pooled Privacy Policy

Who this policy is from

Pooled is published by Moiasun LLC, a Delaware limited liability company, trading as SunnyOrbit. Moiasun LLC is the “controller” of the personal data described here, which means it decides why and how that data is used. In this document “we” means Moiasun LLC and “you” means the person using the app.

• Email: support@sunnyorbitapps.com
• Post: Moiasun LLC, 16192 Coastal Highway, Lewes, DE 19958, United States

We have not appointed a data protection officer. We are not required to, and every question goes to the same address above.

What stays on your phone

Pooled is local-first. An account is for backing up what is already on your phone, not for permission to use the app. Everything below works with the phone in flight mode and no account at all:

• Your expenses and income: the amount, category, note, date and how it was paid.
• Wallets, budgets, transfers, grocery lists, and your lent & borrowed records and their repayments.
• Receipt photos. These always stay on the phone, and they are also uploaded once you have an account (see “Photos” below).
• Your app-lock PIN or password. It is stored as a salted, stretched derived key, never the secret itself, and it never leaves the phone.
• Your chosen currency, language and app settings.

Without an account, we receive none of this. We have no copy of it and no way to get one.

Android's own backup is switched off for this app. Neither the automatic backup to your Google Drive nor the phone-to-phone transfer when you set up a new device will copy Pooled's data, because a ledger holding salaries and spending should not travel somewhere you did not choose to put it. The deliberate way to take your records out of the app is the Export screen, which produces a CSV or PDF that you hand to whatever you like.

One file on the phone is not encrypted. Pooled's home-screen widgets show figures such as a balance, and Android's launcher cannot ask the app to decrypt anything. So the figures a widget displays are kept in a plain preferences file inside the app's private storage. Other apps cannot read it, it is excluded from backup, and the widgets hide their figures when the app lock is on, but the file itself is not encrypted.

What we hold when you make an account

Signing in uploads everything you already have. The moment you make an account, the app copies your whole existing ledger to it, and keeps it in sync from then on: your profile, wallets, entries, transfers, categories, budgets, grocery lists, lent & borrowed records and your memberships of shared spaces. There is no partial sync and no separate switch for it. This is the moment a private app on your phone becomes one with a copy in the cloud, so please read this section before you sign up.

Your identity

Firebase Authentication, operated by Google, holds:

• your email address;
• your password, which Google holds in hashed form; we never see it, and neither does the app after you type it;
• your display name;
• whether your email address has been verified;
• a profile picture URL, if you have one;
• your user ID, a long random string that Firebase creates for your account.

If you sign in with Google instead, we receive your Google account's email address, display name and profile picture from Google rather than collecting them ourselves. We do not ask Google for anything else. No contacts, no Drive, no calendar.

Like any server, Google's servers see the IP address your phone connects from. Google's Firebase documentation says Firebase Authentication keeps the IP addresses used to sign in for a few weeks, for security. We do not use IP addresses for anything, and the app does not store them.

Your profile record

Your account also has a profile record in Firestore, under users/{your-user-id}. Besides your name, email address and picture, it holds two things you should know about:

• When you accepted the Terms of Use (termsAcceptedAt). The app asks you to accept the Terms of Use before you create or join a shared space, and records the date and time you first did, so it does not ask again.
• Your block list (blockedUserIds): the user IDs of anyone you have blocked. It is kept on your account so that a block follows you to a second phone.

Only your own account can read this record. The people you block are not told and cannot see the list, and neither can the other members or the owner of a space. It is deleted with your account.

Reports are not stored by us. When you report somebody in a shared space, the app blocks them for you and writes the report out as a short text: who it is about, which space, and the reason you picked. It then opens your phone's share sheet so you can send that text wherever you choose, for example to the owner of the space or to us by email. Nothing about the report is sent to us or saved in the cloud by the app. If you email it to us, we hold it as an email, as described in the SunnyOrbit Privacy Policy.

Your ledger

With an account, the app copies your records to Google Cloud Firestore, under users/{your-user-id} and spaces/{space-id}. That copy includes, in full:

• Every expense and income entry: the amount, the note you typed, the category, the date, and the payment method.
• Wallets and spaces, and their members: the name of each personal wallet and each shared space, its currency, and the display name and picture of everyone in it.
• Transfers between people inside a shared space.
• Budgets, per category per month.
• Grocery lists and their items, including prices and who ticked them off.
• Lent & borrowed records and their repayments, including the name of the other person, because that is what the record is for. See “Other people's information” below.
• Invite codes for shared spaces, and requests to join them.

Notes are free text. If you type someone's name, an account number or a medical detail into the note on an expense, that is what gets stored. The app does not read your notes or decide which of them are sensitive, and we do not analyse them. Pooled does not connect to any bank: every figure in it is one you or a member of your space typed in.

Deleting something in the app marks it as deleted. When you delete an entry, a transfer, a category, a list or a lent & borrowed record, the app does not erase the row. It marks it as deleted (a “tombstone”), on the phone and in the cloud copy, so that your other devices and the other members of a shared space learn that it was deleted rather than bringing it back. The record stops appearing in the app, but its contents remain in your data until you delete your account. Budgets and join requests are the exceptions: those are erased outright. Photos are handled separately and are removed straight away (see below).

With an account, the app also reads one public document of exchange rates from Firestore, at most once a day, and converts amounts on the phone. No amount and nothing about you is sent to work out a conversion, and the phone never contacts the company that supplies the rates.

This copy is not end-to-end encrypted. It is encrypted in transit (TLS) and encrypted at rest by Google, but the service can read it, and so can we through the Firebase console. We look at it only to run the service, to deal with a report or a support request you send us, or when the law requires it. Access rules keyed to your user ID stop other users of Pooled from reading it. If that is not a trade you want to make, use the app without an account: everything except the cloud backup and shared spaces still works.

Photos

With an account, the photos you attach in the app are uploaded to Google Cloud Storage, so that they survive a lost phone and appear on your other devices. A copy always stays on the phone as well. Without an account nothing is uploaded; photos you attached before making one are uploaded the next time you sign in.

That means these, and only these:

• Receipt photos you attach to an expense or income entry, stored under spaces/{space-id}/entries/….
• Photos on a lent & borrowed record: a picture of the other person if you add one, and any receipt or IOU note you attach. These are stored under spaces/{space-id}/loans/….
• Your profile picture, if you set one, stored under users/{your-user-id}/avatar.

The app resizes each photo before it is stored, to at most 1280 pixels on the long edge. It also removes the notes your camera writes into the file before the photo is saved anywhere: the EXIF block, the XMP block and any embedded comment. That includes where the photo was taken, if your camera records it, and also the camera's serial number and the original timestamp. This happens the moment you pick or take the picture, so the copy on your phone, the copy in cloud storage and the copy inside any PDF you export are all stripped. The picture itself is untouched: the same image data, the same format, never re-compressed.

The one format this cannot strip is HEIC/HEIF, because its metadata is not a block that can be cut out. It does not arise in practice, because the app always asks the system to re-encode a picked photo, which produces a JPEG. The app never re-adds anything it has removed. If you want to be certain, turn off location tagging in your camera app as well.

Who can see your photos

• Photos in your personal wallets can be read only by your own account.
• Photos in a shared space can be seen by every current member of that space, because seeing the receipt is the point of sharing it. Someone removed from the space loses access to its photos.
• Your profile picture can be loaded by any signed-in Pooled account that knows your user ID, so that people who share a space with you can see your face next to your name. Your user ID is a long random string, and the only place the app ever shows it to anybody is inside a space you are both in. But we would rather tell you this than imply a limit we do not enforce. Pick a picture you are comfortable being visible to other users of the app, or none at all. Nothing else you put in your own folder is readable by anyone but you.

These rules are enforced by Google's servers, not by the app. Like the rest of your cloud data, the photos are encrypted in transit and at rest by Google but are not end-to-end encrypted: the service can read them, and so can we through the Firebase console.

When your photos are deleted

• Taking a photo off an entry, deleting the entry, or deleting the lent & borrowed record deletes the uploaded copy as well as the one on the phone. If the phone is offline at that moment, the app deletes the uploaded copy the next time it can.
• Changing or removing your profile picture deletes the old one.
• Deleting your account deletes every photo in your personal wallets and your profile picture, in the same action. Photos you put in a shared space are the exception. See “How long we keep it” below, which says exactly why.

Who else receives your data

Pooled contacts no company but Google, and it contacts Google only when you have an account. Google LLC runs these services for us as our processor, which means it handles the data on our behalf and under its data processing terms, not for its own purposes:

• Firebase Authentication, for your sign-in;
• Cloud Firestore, for the copy of your ledger;
• Cloud Storage for Firebase, for your photos;
• Firebase App Check, which asks Google Play to confirm that requests come from a genuine copy of the app, to stop scripts from abusing the service. It attaches a verdict about the app to requests the app is already making. It does not identify you to us and records no activity.

The only other people who can see any of your data are:

• The members of a shared space you join. They see your display name and picture, and what you record in that space, including your notes and receipt photos. A personal wallet is never shown to anyone.
• Authorities, where the law requires it. If we receive a valid legal demand, we will check it and hand over only what it requires.

There is no analytics, no crash reporting, no advertising and no tracking of any kind, and there is no other company that hears from this app at all.

This changed in version 2.84.0. Earlier test builds made one request at every launch to ipinfo.io, a commercial IP-intelligence company, falling back to api.country.is, to guess a currency from the country the connection came from. The request carried no identifier and the app kept only a two-letter country code, but any web request reveals the address it came from. That request is gone. Pooled now works out which currency to offer from the region your phone is set to and the time zone its clock is running in, and neither leaves the device. If you still have an older build, update it and the request stops.

What this app does not do

This is unusual enough to be worth stating flatly, and it is verifiable from the app's dependency list:

• No analytics. Nothing counts your screens, sessions or taps. There is no Firebase Analytics, no Google Analytics, no third-party product analytics.
• No crash reporting. There is no Crashlytics or equivalent. Errors are written to the device's own log and go nowhere.
• No advertising and no ad SDK. No ad network is built into this app and no ad is served. Nothing collects an advertising ID.
• No tracking, attribution or fingerprinting SDK of any kind.
• We do not sell personal data, including sensitive data, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising or profiling.
• We do not use your records to train anything, including AI models.
• No automated decisions. Nothing in Pooled makes a decision about you by automated means.

Do Not Track

Some browsers and devices send a “Do Not Track” or Global Privacy Control signal. Pooled does not track you across other apps or websites over time, and does not let any third party do so, so there is nothing for these signals to switch off. We treat every user as if the signal were on. No third party collects personal information about your online activities over time and across different websites or apps when you use Pooled.

How your data is protected

On your phone

Your ledger and your receipt photos are encrypted at rest with AES-256-GCM, under a key that is generated on the device and held in the Android Keystore. Deleting the data discards the key with it. You can also put the app behind a PIN, a password or your fingerprint.

Here is what that does and does not cover. It protects the files if they leave the phone, for example in a forensic dump or on a rooted device. It does not make your data unreadable to us, because the cloud copy described above is a separate copy that is not encrypted with that key. This is device-at-rest encryption, not end-to-end encryption.

In transit and in the cloud

All traffic between the app and Google's services uses TLS. In Firestore, your documents are readable only by an account whose user ID matches them, or by the other members of a space you have joined. That is enforced by server-side security rules, not by the app. Cloud Storage applies the same kind of rules to photos, as set out under “Photos” above. Nothing has yet been audited by an independent security firm.

Permissions the app asks for

• Internet. To sign in and to back up your ledger and your photos, once you have an account.
• Camera and photos. Only when you attach a photo. The app opens the picker you chose; it does not browse your gallery.
• Notifications. For one reminder, suggesting you make an account so your records are backed up. It is asked for only after you tap “Not now” on the in-app reminder, not on first launch, and the app works normally if you decline.
• Run at startup. So that a reminder you have already agreed to survives a reboot instead of silently vanishing.
• Biometrics. Optional, for unlocking the app. Your fingerprint or face is handled entirely by Android; the app is only told yes or no, and never receives or stores any biometric data.

Pooled does not ask for your location, your contacts or access to your files.

Other people's information

Two features let you record things about people who are not you. A lent & borrowed record stores the name of the person you lent to or borrowed from, and a photo of them if you add one. A shared space stores the display name and picture of each member. If you enter somebody else's details, you are responsible for doing so lawfully and for telling them, where the law where you live requires it. We hold that information only to make the feature work, and it is deleted along with the record it belongs to.

If you are that other person and you do not use Pooled, you can ask us to remove your name or photo from someone's records: write to support@sunnyorbitapps.com and tell us enough to find it, such as the name of the person who recorded you. Only records in an account's cloud copy are within our reach; a record kept on a phone with no account never reaches us.

Why we use your data, and our legal bases

Data protection law in the EU, the UK and some other places asks us to say which legal basis we rely on for each use. These are ours:

• Running your account, syncing and backing up your ledger and photos, and showing what you record in a shared space to its members: performance of our contract with you, the Terms of Use. We cannot restore your records to another phone without holding them.
• Recording when you accepted the Terms of Use, and keeping your block list: performance of the contract, and our legitimate interest in being able to show that you accepted the rules of shared spaces and in letting you protect yourself.
• Security, meaning App Check, sign-in protection, the security rules and dealing with abuse: our legitimate interest, and yours, in keeping the service and your data safe.
• Dealing with reports and enforcing the Terms of Use, including closing an account: our legitimate interest in keeping shared spaces safe for the people in them.
• Names and photos of people who are not users, entered in a lent & borrowed record: our legitimate interest, and the user's, in a record that says who it is about. It is kept to a minimum, visible only to the user (or the space it is in), and removed on request.
• Answering legal requests and keeping records the law requires: compliance with a legal obligation.

Where we rely on legitimate interests, you can object, and we will stop unless we have a compelling reason that overrides yours. We do not rely on consent for anything we hold today. If we ever add something that needs it, such as marketing email, we will ask first, and you will be able to withdraw that consent at any time.

An account is optional. You do not have to give us any personal data to use Pooled. Without an account, the only things you cannot do are back up to the cloud and share a space with other people.

Where your data is held

Moiasun LLC is a US company, and Google stores the Pooled cloud data in the United States:

• Your records (Cloud Firestore) are in the nam5 multi-region, in the United States.
• Your photos (Cloud Storage) are in the us-east1 region, in South Carolina, United States.

Google may process them in other countries in the course of running those services. The people who run SunnyOrbit may also look at the data from outside the United States, including from Bangladesh, when that is needed to run the service or answer you.

If you are in the EU, the UK or Switzerland, this means your data is handled in countries whose data protection laws differ from yours. We handle it as this policy describes wherever it is. For Google's part, we rely on the EU-U.S. Data Privacy Framework (with its UK Extension and the Swiss-U.S. framework), in which Google takes part, and on the Standard Contractual Clauses in Google's data processing terms for Firebase. Email us if you would like more information about these safeguards.

How long we keep it, and how to make it stop

We keep your cloud data for as long as your account exists. There is no scheduled purge and no retention timer: it is there until you remove it. Data on your phone stays until you delete it, reset the app or uninstall it.

Delete account, in the app's menu and on your account screen, does all of this in one go:

• erases your profile record (including your Terms of Use acceptance date and your block list), your lent & borrowed records and your personal ledger from Firestore: every entry, transfer, category, budget, grocery list and item, including anything marked as deleted;
• deletes every photo you uploaded from Cloud Storage: the receipts and lent & borrowed photos in your personal wallets, and your profile picture;
• deletes your Firebase Authentication account, so the email address and password go with it;
• wipes the copy on the phone, including the encryption key and every photo, and returns the app to its welcome screen.

There is nothing to write to us about afterwards, and nothing to wait 30 days for. The photos go in the same press of the button as the records, while you are still signed in. That is the only moment they can go, because the permission to delete them is your sign-in.

The order matters and is enforced. The photos are removed before the documents that grant access to them, and the account is deleted last of all. If any part of the cloud copy cannot be erased, usually because the connection dropped, then nothing is deleted at all. The app tells you which file or record it could not remove, and you can try again. It will not leave you with an unreachable ledger or an unreachable photo in the cloud that nobody could ever remove.

With no account, the same control is called Reset everything. It wipes the phone, because there is nothing anywhere else to delete.

If you cannot get into the app, you can ask us to delete your account by email. The Delete your Pooled account page explains how, and we do it within 30 days.

One honest exception. A shared space is not deleted, even one you created. Other members' money is recorded in it and their ledgers still have to add up, so the space and its records carry on for them. What happens instead is that your membership is marked as ended and your own link to the space is removed, so you lose access to it. Your name and your profile picture come off your membership in the same step, so the remaining members no longer see either. What is left is an unnamed former member, still attached to the entries and transfers that involved you, because their ledger has to account for that money. Receipt photos you attached to entries in that space stay with those entries, visible to its remaining members, for the same reason the entries do. You lose your own access to those photos the moment your membership closes. If you want them gone, take them off the entries, or leave the space, before deleting your account. If you want a shared space removed entirely, delete the space itself before deleting your account, or ask the other members to.

One more thing is outside our systems. If the owner of a space removes you, your cloud access to it ends at once, but your own phone keeps the copy of that space it already held, frozen. It no longer receives anything new, and it goes when you reset the app or delete your account.

Backups. We do not keep backups of the Pooled database, and point-in-time recovery is switched off. Firestore itself keeps earlier versions of changed or deleted documents for one hour. Google may take longer to remove deleted data from its own systems, as set out in its Firebase data processing terms. We cannot read or restore that data.

Uninstalling the app without deleting your account removes the copy on the phone but leaves the cloud copy in place. Sign in again on any device and it comes back.

Your rights

Wherever you live, you can ask us to access, correct, delete or export the personal data we hold about you, to restrict what we do with it, or to object to it. Most of this you can do yourself, straight away, without asking us: the app's Export screen produces a full CSV or PDF of your records, the account screen lets you change your name and email address, and “Delete account” erases everything as set out above.

For anything you cannot do in the app, or if you want written confirmation of what we hold, email support@sunnyorbitapps.com from the email address your account uses, so we can tell the request is yours. We will never ask for your password. We reply within one month. If a request is complex, we may extend this by up to two further months, and we will tell you why within the first month. Requests are free, and we will not treat you differently for making one.

If you are in the EU or the UK

You have the rights the GDPR and the UK GDPR give you: access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent where we rely on it. Our legal bases are listed under “Why we use your data” above.

If you are in the EU or EEA, you can complain to a data protection supervisory authority, in particular in the country where you live or work, or where you think the problem happened. The European Data Protection Board lists them at edpb.europa.eu.

If you are in the UK, you have the right to complain to us first, at support@sunnyorbitapps.com. We will acknowledge your complaint within 30 days and answer it without undue delay. You can also complain to the Information Commissioner's Office at ico.org.uk.

Our representatives. Our representative in the European Union under Article 27 of the GDPR is [TO FILL: EU representative name and address, or remove if not appointed], and in the United Kingdom under Article 27 of the UK GDPR is [TO FILL: UK representative name and address, or remove if not appointed]. You can contact them instead of us, or as well as us.

If you are in the United States

We do not sell personal data, including sensitive data, and we do not share it for cross-context behavioural advertising or use it for targeted advertising. There is no advertising in this app at all, so there is nothing to opt out of. You can review and correct your details in the app, and ask us for a copy or for deletion as described above. Exercising any of these rights will never get you a worse version of Pooled. This policy is posted to meet the California Online Privacy Protection Act and the Delaware Online Privacy and Protection Act.

If you are in Canada

You may ask for access to your information and challenge its accuracy. If we cannot resolve a complaint between us, you may take it to the Office of the Privacy Commissioner of Canada.

If you are in Brazil

You have the rights the LGPD gives you, and you can use the email address above to exercise them. You may also petition the national data protection authority, the ANPD.

If you are in Australia

You may ask for access and correction, and complain to the Office of the Australian Information Commissioner if you are not satisfied with how we handle it.

Wherever you are

If your country gives you a right not listed here, you still have it. Ask and we will honour it, and you can always contact your national data protection authority. The answer to almost all of these is the same in any case: the Export screen gives you everything we hold, and “Delete account” removes it, uploaded photos included.

Children

Pooled is not directed at children. You must be 18 or older (or the age of majority where you live, if that is higher) to use it, and it is listed on Google Play for adults only. We do not knowingly collect personal information from anyone under 18. If we learn that a child is using Pooled with an account, we will close the account and delete its data. If you believe a child has given us personal data, including if you are their parent or guardian, email support@sunnyorbitapps.com and we will act on it.

Changes to this policy

If we change what the app collects or who it is shared with, we will update this page and the date at the top before shipping the release that makes the change. If a change materially affects how we use data you have already given us, we will also tell you in the app, or by email if you have an account, before it takes effect. The current version always lives at this URL.

Contact

Questions about this policy, requests about your data, or anything else: support@sunnyorbitapps.com.

Post: Moiasun LLC, 16192 Coastal Highway, Lewes, DE 19958, United States.