Privacy Policy

CVS Ledger organizes data by household. Everyone invited into a household can see that household's expense data according to their role (owner or member). If you join someone else's household, your activity in that household is visible to its members as described below.

Account and identity

We use Clerk for sign-in. Depending on how you authenticate, this typically includes your email address, display name, and a stable user identifier. We store a corresponding user profile in our database so we can attach you to a household and deliver notifications.

Household and expense data

When you use the Service we store data you create or import, including:

• Transactions (amounts, dates, merchants, categories, notes, tags)
• Accounts, budgets, categories, and settings (currency, calendar preferences)
• CSV / spreadsheet imports you upload
• Comments and audit-style events tied to household actions

Bank connections

If you connect a financial institution, we use third-party aggregators (Plaid and/or SimpleFIN) to retrieve account and transaction information. Aggregator credentials (for example Plaid access tokens or SimpleFIN access URLs) are stored encrypted on our servers and are not exposed to the mobile app. We do not ask you to type your bank password into CVS Ledger itself; authentication happens with the aggregator.

Subscriptions and payments

Paid plans may be purchased on the web via Stripe or in the Android app via Google Play Billing (through RevenueCat). We store subscription status, plan tier, and provider identifiers needed to determine entitlement. We do not collect or store full payment card numbers (PAN), CVV, or card expiry on our servers — card entry is handled by Stripe or Google Play.

Notifications

If you enable push notifications, we store an Expo push token scoped to your user and household. Lock-screen push bodies are generic (they do not include merchant names or amounts); the detail is shown after you open the app. We also store email/push notification preferences and may send transactional email (for example digests) via our email provider when you have opted in for that kind.

Technical and security data

Our hosts and auth provider may process standard technical logs (IP address, device/browser type, timestamps) to operate, secure, and debug the Service. We do not use advertising trackers or marketing pixels in product email.

• Provide expense tracking, budgets, reports, and bank sync for your household
• Authenticate you and enforce household membership and roles
• Determine subscription entitlement and process plan changes
• Send notifications you have enabled (in-app, push, and/or email)
• Maintain security, prevent abuse, and meet legal obligations
• Improve reliability (for example sync health and error diagnosis)

We do not sell your personal information. We do not use your transaction data for third-party advertising.

We share data only with processors that help us run the Service, including:

• Clerk — authentication
• Neon (or our Postgres host) — database storage
• Vercel — application hosting
• Plaid / SimpleFIN — bank data aggregation (when you connect)
• Stripe / RevenueCat / Google Play — subscription billing
• Resend — transactional email (when email notifications are enabled)
• Expo — push notification delivery (when push is enabled)
• Inngest — background job processing

Household members you invite can see that household's expense data. We may disclose information if required by law or to protect the Service and its users.

We retain household data while your account and household remain active. If a household or user is deleted, associated tenant data is removed according to our database cascading rules, subject to short-term backups held by our hosting providers. Subscription and audit records may be retained as needed for billing disputes, security, and legal compliance.

We use industry-standard measures appropriate to a multi-tenant financial journaling app, including encrypted transport (HTTPS), server-side encryption for bank aggregator credentials, and row-level isolation so one household cannot query another's data through the application. No method of transmission or storage is perfectly secure; please use a strong password / auth method with Clerk and protect devices that have the app installed.

• Update profile details through your Clerk account settings
• Disconnect bank connections and stop syncing in the Service
• Hide amounts in the web and Android apps (Settings → Security on Android; the header control on the web). When this is on, money figures are replaced with a placeholder so the real digits are not in the on-screen text or the accessibility tree. Category and merchant names stay visible. The preference is stored on the device (Android secure storage / the browser's local storage) and is off by default.
• Block screenshots and screen recording on Android (same Security screen). Off by default. When on, the app asks the OS to refuse screenshots and screen recording. This control is not available on the web.
• Change or disable email/push notification preferences
• Leave a household or ask a household owner to remove your membership
• Cancel a paid subscription via Stripe Customer Portal (web) or Google Play (Android)
• Request account or household deletion via our Delete account & data page (contact-based process)

The Service is not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children.

We and our processors may process data in the United States and other countries where those providers operate. If you use the Service from another region, you consent to transfer of your information to those locations for the purposes described in this policy.

We may update this policy from time to time. The "Last updated" date at the top will change when we do. Continued use of the Service after an update means you accept the revised policy.

Questions about privacy or requests to access or delete your data: email the CVS Ledger operator at the address you use for your Clerk / CVS Ledger account (subject line: "Privacy request"), or open an issue in the project repository if that is how the operator prefers to receive requests. We will respond within a reasonable time.