OweMe Privacy Policy

Last updated: 26 September 2026 Applies to: the OweMe apps for Android and iPhone, owemeapp.com, and the OweMe service.

This is OweMe's official privacy notice. It is the information the GDPR and the UK GDPR require us to give you about how we use your personal data (Articles 13 and 14), and the notice the US state privacy laws in §8.3 ask for. It is written in plain language on purpose; there is no longer or more legal version of it anywhere else.

1. Who is responsible for your data

The data controller — who decides why and how your personal data is used, and is responsible for it under the GDPR (Art. 4(7)) and the other laws in §8 — is:

OweMe
Skanderbeg Square, 1001 Tirana
privacy@owemeapp.com

Your account and your ledger are stored on servers in France, inside the EU; the few other services that see any of your data are listed in §5. OweMe has no data protection officer; one is not required at this size.

Write to privacy@owemeapp.com with any privacy question or request. A person reads it. Post to the address above reaches the same place, more slowly.

Which law applies to you

OweMe is used from everywhere, so more than one privacy law can reach the same account, and which one reaches yours depends on where you are rather than on where we are.

Rather than sort you into a regime and give you only what it demands, the rights in §8.1 are given to every user, wherever they live. §8.2 and §8.3 then add what a particular law obliges us to spell out — the GDPR and UK GDPR for readers in Europe, and the state privacy laws for readers in the United States. Nothing in §8.2 or §8.3 takes anything away from §8.1.

2. What OweMe is

OweMe records who owes whom within a group of people, and works out who could pay whom to settle up in the fewest transfers. It never moves, holds, or processes money. It has no connection to your bank, no payment rail, and no ability to transfer funds. A "settlement" in OweMe is a note that a payment happened somewhere else.

This matters for your privacy because it means OweMe never sees a bank account, a card number, or a transaction from your bank. There is nowhere for one to go.

In short

The rest of this document is long because it is specific. If you read nothing else, these are the three answers people actually want:

What we hold. Your email address, your display name, a password we store only as a hash and cannot read, and the ledger you record — expenses, amounts, currencies, dates, categories, notes, settlements, and the names of the people you split with — and of any you keep on your friends list. Plus a record of each device you use the app on — with, if you turn on notifications, the token that lets us send them to it — a crash report for a week if the app crashes, a log of changes to your account for a year, the server's request log for two weeks, a receipt of any purchase you make through Google Play or the App Store, and — only if you sign in with Google or Apple — the identifier that company gives your account. That is the whole of it, and §3 breaks it down field by field. No location, no analytics SDK, no advertising, no tracking, no special-category data — §4.

You can take it with you, whenever you like, without asking us. Profile → Privacy & terms → Download a copy of my data gives you everything we hold as a JSON file. Any group exports as CSV from Group settings → Export as CSV, including entries the free plan hides — a window that stopped you taking your own data would make this promise a lie. Both are immediate, free, and need no request. With Premium, or in a premium group, a group also exports as a PDF, made by our server from the same ledger and not kept once it is sent to you. §8.1.

You can delete your account yourself, in the app or on the web, and it takes effect at once rather than becoming a request somebody has to action. What is erased and what survives — and why some of it must — is set out in full in §7, in plain terms, because "we delete everything" would not be true.

3. What we collect, and why

3.1 Your account

The security log. When your account itself changes — a new display name, a new password, the account being deleted, or something our staff do to it, such as granting Premium — we record which change, when, and a salted hash of the network address it came from, which is useless to anybody without our key. A new display name is recorded in full. It is not a record of what you do in the app: adding an expense or opening a screen writes nothing here. Entries are deleted after 12 months (§6), and deleting your account removes the name from them at once (§7).

We do not ask for your real name, address, phone number, or date of birth.

Signing in with Google. It is optional; an email address and password work just as well. If you choose it, Google tells us the identifier it uses for your Google account, the account's email address, whether Google has verified that address, and the name on the account, which becomes your display name until you change it. We keep the identifier, so that the next sign-in finds the same account, and nothing else from your Google account reaches us: no contacts, no photo, and no access to act on your Google account. What Google itself records about the sign-in is covered by Google's privacy policy.

Signing in with Apple. On iPhone you can also sign in with Apple, and that is optional too. If you choose it, Apple tells us the identifier it uses for your Apple Account with OweMe, an email address and whether Apple has verified it, and — the first time only — the name you let Apple share, which becomes your display name until you change it. If you choose Hide My Email, the address is one Apple makes up for OweMe: it forwards our emails, such as verification codes, to your real address, and we never learn what that is. We keep the identifier, so that the next sign-in finds the same account, and a token Apple issues to OweMe with each sign-in, for one purpose only: when you delete your account we hand it back to Apple, so OweMe is removed from your Apple Account too (§7). The token gives nobody access to your Apple Account and is deleted with yours. Nothing else from your Apple Account reaches us. What Apple itself records about the sign-in is covered by Apple's privacy policy.

Verification and reset codes. Confirming your email and resetting a forgotten password both work by a short code sent to your address. The code is short-lived and stored hashed; the email itself goes through our mail provider (§5) and contains the code, your display name, and nothing else.

A forgotten password can only be reset from a confirmed address. If nobody has ever proved they can read the address on an account, we will not send a reset code to it — an unconfirmed address is not evidence of who owns the account, and a mistyped one belongs to a stranger. Confirming takes one code, from Profile in the app, and nothing else in OweMe depends on it. If you cannot sign in and cannot confirm, write to the address in §12 and a person will help you.

3.2 What you record in the app

The ledger itself: groups, the people in them, expense descriptions, amounts, currencies, dates, categories, notes, settlements, and any recurring schedules you set up.

Each entry carries two times: the date you chose for it — the night of the dinner — and the moment you typed it in. Both are visible to everyone in that group, because a shared ledger in which only one person can see when a figure appeared is not a shared ledger. Neither is used for anything else; there is no profile of when you use the app.

Some of this is personal data about other people — the names of those you split with. If you add somebody by name who has no OweMe account, you are providing their name to us on your own initiative. Please only add names those people would be comfortable with; a first name or nickname is enough for the app to work.

Invites. An invite link or QR code contains a random token, nothing about you and nothing about the person you send it to. We store only a hash of it, so a copy of our database hands out no group access. Tokens expire, can be revoked, and only ever grant access to the one group they were made for.

Friends is a shortlist you keep yourself. From the people you share a group with, you can add the ones you want to find quickly; we store who is on your list and when you added them. It is private and one-way: adding somebody tells them nothing and gives them nothing, and nobody can see your list but you. It is in your export (§8.1), and deleting your account takes you off everybody's list as well as deleting your own (§7).

Legal basis: contract — 6(1)(b). This is the service.

3.3 Your devices, and how the app is running

A record of each device. Whenever the app starts while you are signed in, and whenever you sign in, it tells us which installation it is: a random identifier the app made when it was installed — not derived from the phone's hardware — with the platform (Android or iOS), the app's version and the version of the phone's operating system. We keep one record per device on your account, with when it was last seen. If you use offline mode, it also carries a sync position, which is what lets one device know what another has already seen, and which of your groups that device holds offline. That list is how a group that joins the offline copy — a premium group bought after the device last synced — arrives with its whole history, and how one that leaves it — a premium group whose 90 days have ended — is removed from the phone. With Premium the offline copy holds all your groups; through a premium group, only the premium groups.

Notifications. If you turn them on, the app gives us the token your phone's notification service issues for OweMe — on an iPhone, Apple's; on Android, Google's Firebase Cloud Messaging — and we keep it on that device's record. We use it to tell you when somebody else adds an expense that involves you, records or answers a payment with you, or invites you to a group — and for the notifications from OweMe described below. Each notification carries the group's name, who did it, what it was and the amount, and passes through that service on its way to your phone; we keep no copy of it once it is sent. Which kinds you get is up to you, in Profile → Notifications, and those choices are kept with your account. The token is removed when you sign out on that phone, when you turn notifications off, and when you delete your account. Anyone who can see your lock screen can see a notification too, unless you set previews to show only when the phone is unlocked — on Android, by hiding sensitive content on the lock screen.

Notifications from OweMe. Now and then we may send a notification about OweMe itself, to the same token. Important updates — planned maintenance, an update you need to install, a change to the Terms — reach you unless you turn them off. News and offers — new features and promotions — reach you only if you turn them on, and that switch starts off. Both switches are in Profile → Notifications. We send these to everyone, or to everyone on one kind of phone or app version, never to a list of chosen people. For each one we keep what it said, who on our side sent it, and how many phones it reached — not who received it. Legal basis: important updates are part of providing the service — contract, 6(1)(b); news and offers rely on your consent — 6(1)(a) — which you give with that switch and can withdraw with it at any time.

How often the app starts. Each of those starts is also added to a daily count per app version. The count has no account and no device attached to it: it is the other half of the arithmetic that says what share of sessions ended in a crash. Kept for 7 days.

Crash reports. If the app crashes, it writes a short report on the phone and sends it the next time it starts with you signed in: the error message, a technical trace of where in the app's code it happened, when, whether the app closed, the app and operating-system version it happened on, and the installation identifier above. At most one per session. A report is about the app's code rather than your ledger, though an error message can occasionally repeat a value the app was handling when it failed. It is stored without your account, but the installation identifier is also on your device record, so the two can be joined — which is why we treat it as data about you. Crash reports are deleted after 7 days.

The server's request log. Like any web server, ours writes down each request it answers: the time, the IP address it came from, which part of the service was asked for, and how it answered. The web server's own log also records the software that made the request — the app, or a browser. Nothing from your ledger is in it. It is how a fault or an attack gets diagnosed, it is kept for 14 days and then deleted, and it is never combined with anything else to build a picture of you.

Legal basis: contract — 6(1)(b) — for the device record and notifications, which are part of how the service works; legitimate interests — 6(1)(f) — for the count, the crash reports and the request log. The legitimate interest we pursue is keeping the service working and secure: finding out why the app or the server stopped working, spotting attacks on it, and fixing both. §3.6 sets out every legitimate interest we rely on in one place.

3.4 Purchases

If you buy a subscription or a premium group, you pay Google — through Google Play, on Android — or Apple — through the App Store, on iPhone — and we store a record of the purchase:

• Google Play: the product bought, its state, order identifiers, and a hash of the Play purchase token — never the token itself.
• App Store: the product bought, its state and when it runs out, and a hash of Apple's identifier for the original transaction — never the signed transaction itself.

We also store a one-way, salted identifier derived from your user id, which the app hands to Google or Apple with the purchase so that it can be matched to your account. It is meaningless to anyone but us and cannot be reversed into your email or name.

We never see your card, your Google or Apple account email, or your billing address. Google or Apple handles the payment entirely; we only ever ask them "was this purchase real, and is it still valid?"

Codes. On Android, if you redeem a code we store which code, when, and until when the discounted price it unlocks is available to you. On iPhone a code is an App Store offer code: we check that it exists and is live and hand it to the App Store, and we do not record that you entered it — Apple redeems it, and what we learn afterwards is only what any purchase tells us.

Legal basis: contract — 6(1)(b) — for giving you what you bought; legitimate interests — 6(1)(f) — where the legitimate interest we pursue is preventing fraudulent or replayed purchases; and legal obligation — 6(1)(c) — for keeping the purchase record for the 10 years accounting law requires (§6).

3.5 The website

owemeapp.com sets no cookies, runs no analytics, and loads nothing from another company — no fonts, no scripts, no images from a CDN. The Cookie Notice says the same in more detail, including what the app keeps on your phone. If you give it your email address to be told about the launch, we store that address, the date, and the country Cloudflare already attached to the request. Nothing else: not your IP, not your browser. That list exists to send one email.

Legal basis: consent — 6(1)(a). Reply to that email and we delete the address.

3.6 The legitimate interests we rely on

Where §3 names legitimate interests — GDPR Art. 6(1)(f) — as the legal basis, this is the interest we pursue in each case. For each one we have weighed it against yours: each uses the least data that does the job, keeps it for a short, fixed time (§6), and is never used to profile you or for advertising. You can object to any of them (§8.2).

Separately, we disclose data where we are legally compelled to (§5). The legal basis for that is legal obligation — 6(1)(c) — not legitimate interests.

3.7 Sources of personal data

Everything in §3 comes from one of these sources, and from nowhere else:

1. You. What you type in and choose: your account details, your ledger, and the launch-list address (§3.1, §3.2, §3.5).
2. Other people in your groups. A member can add your name to a group, and record expenses and settlements that involve you (§3.2). Where we hold something about you that a member gave us, this is where it came from.
3. Your device. Sent automatically by the app while you use it: the device record — with its notification token, if you turn notifications on — the count of app starts, and crash reports (§3.3).
4. Google or Apple, if you use them. If you sign in with Google or Apple: their identifier for your account, an email address, whether it is verified, and a name (§3.1). If you buy through Google Play or the App Store: whether the purchase is valid (§3.4).
5. Our own systems and service providers. The request log and security logs our server writes as it answers requests, including the IP address a request came from (§3.3, §6); and the country Cloudflare attaches to a request when you join the launch list (§3.5).

We do not buy personal data, and we do not collect it from data brokers, public sources or social networks.

4. What we do not collect

This section is unusually specific because it is the useful part.

• No analytics SDK. No Firebase except Firebase Cloud Messaging, which only carries notifications — no Firebase Analytics, no Crashlytics — and no Google Analytics, no Amplitude, no Segment, no Mixpanel. We do not know which screens you open or how long you spend. A crash report says which part of the app failed, and that is as close as it comes. Firebase Cloud Messaging does nothing until you turn notifications on, and then only what delivering them takes (§3.3). Apart from that, the one component that reports anything to anybody but us is Google's ML Kit, which reads receipts: technical data about the scanner, never your receipt or what you do in the app — see "Receipt scanning" below.
• No advertising, and no advertising identifiers. No ad SDKs of any kind. We do not use your data for advertising and do not sell or share it for cross-context behavioural advertising.
• No crash-reporting SDK. The app reports its own starts and crashes to our server and to nobody else — §3.3.
• No location data. Ever, in any form.
• No contacts, calendar, microphone, or files beyond a photo you explicitly choose for a receipt.
• No tracking across other apps or websites. On iPhone, OweMe never asks for permission to track you (App Tracking Transparency), because it does not.
• No cookies on the website. See the Cookie Notice.

The app asks you for two permissions at most, each only when it is needed. The camera, at the moment you first tap "Scan receipt" — you can decline it and pick a photo instead. And notifications, once you choose to turn them on (§3.3); on Android before version 13 there is nothing to ask, and you can switch them off in the phone's settings. Android grants the others when the app is installed, without asking, because none of them reaches anything private: internet access; seeing whether the phone is online, so offline mode knows when to sync — it reads whether there is a connection, never the name of the network; Google Play Billing, for purchases; and, for notifications, receiving them from Google's messaging service and keeping the phone awake for the moment it takes to show one.

On iPhone it is the same two: the camera at the same moment, and notifications once you choose to turn them on. Choosing a photo instead opens Apple's photo picker, which hands the app only the photo you pick: OweMe never gets access to the rest of your library, and never asks for it. Nothing else needs a permission on iPhone — checking whether the phone is online and buying through the App Store included.

No special-category data, and no profiling

GDPR Article 9 singles out categories that carry extra protection: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify you, data concerning health, and data about sex life or sexual orientation. Article 10 adds criminal convictions and offences.

We do not ask for any of them. There is no field for any of them anywhere in OweMe. We do not buy them, infer them, or derive them, and nothing in the app analyses what you record in order to work anything out about you.

There is one honest exception, and it is worth stating plainly rather than leaving you to discover it:

• An expense description is free text. If you type something sensitive into one, we store it, because it is your ledger entry and we do not read your entries. We do not scan it, index it, classify it, or use it for anything.
• Two of the 32 categories could hint at something. "Health" and "Charity" are on the list because people split a pharmacy run and a fundraiser. Choosing one records a label you picked for a payment — not a diagnosis, not a belief, and nothing we act on.

If you would rather we did not hold something, do not put it in a description — "lunch" works as well as any detail. That is the only mitigation that is genuinely in your hands, which is why we are telling you about it.

If sensitive information does end up in OweMe. We handle it exactly like the rest of the entry it is in, and do nothing else with it: it is stored, shown to the members of that group, and included in exports. We never use it to infer anything about you or anybody else, never profile anyone with it, and never pass it to anyone except the provider that hosts the database (§5). Where GDPR Article 9 applies to something you chose to type, the condition we rely on is your explicit consent (Art. 9(2)(a)), which you give by choosing to enter it in a free-text field.

You can withdraw that consent at any time, and so can anyone the information is about. Editing or deleting an entry is not enough on its own: the ledger keeps every earlier version of an expense, so that everybody in the group can see what changed. Write to privacy@owemeapp.com saying which entry, and we will erase the text from every version, not just the current one.

Why the risk here is low

Not a legal conclusion, just the shape of the thing. OweMe holds who owes whom and nothing that unlocks anything:

• No money moves. No card number, no bank account, no payment credential ever reaches us — §2 and §3.4. There is nothing here to steal and spend.
• No location, no contacts, no tracking, no advertising identifiers, and no analytics beyond the app's own crash reports and count of starts, and the scanner diagnostics described below — the list above.
• No profiling and no automated decision-making. Nothing scores you, categorises you, or decides anything about you. What you see is arithmetic on what you and your group typed in.
• No special-category data, as set out immediately above.
• The most sensitive thing we hold is your email address and the fact that you split a restaurant bill with somebody.

Receipt scanning is on your device

If you photograph a receipt, the image is read on your phone, by Google's ML Kit text recognition, which runs on the device — on Android and on iPhone alike. The photo is never uploaded to us, and neither is the text. Only the numbers you accept become an expense. Scanning works with no internet connection at all, which is the simplest proof that the reading happens on the phone.

ML Kit does send Google technical information about how the scanner itself is working: the phone's model and operating-system version, the app's name and version, an identifier for that installation which Google says is not intended to identify you or your phone, how long a scan took, the image's format and size, and any error codes. Google uses it for diagnostics and statistics about ML Kit, and it never includes the photo or what the receipt says. It is covered by Google's privacy policy. Our reason for allowing it is in §3.6.

5. Who we share it with

We do not sell your data. We do not share it for advertising. There is no third-party analytics processor.

That is the complete list. Nobody else receives your data.

Several of these are in the United States, so using OweMe involves a transfer outside the EEA. §8.2 names the mechanism each one relies on. It is written out once, there, rather than twice — two copies of a transfer clause are two things to keep in step, and the one that goes stale is the one nobody reads.

We will disclose data if legally compelled — a court order or equivalent — and will tell you unless we are prohibited from doing so.

6. How long we keep it

• Your account and ledger: for as long as your account exists — but an account nobody signs into for six months is closed automatically. We email the address on the account first and wait a further 30 days, and simply opening the app in that time cancels it. What happens then is what happens when you delete the account yourself (§7): your email address, name and sign-in details are erased, and the shared ledger rows stay, under your name, so that nobody else's balances change because you stopped using OweMe. We do not close an account with a live subscription, however quiet it is.
• After you delete your account: see §7. The account is anonymised immediately; the shared ledger rows remain, no longer linked to you.
• A group its owner deletes: hidden from every member at once, then erased with everything in it — expenses, settlements, members — after 30 days. The wait is there so that a group deleted by mistake can still be brought back; write to privacy@owemeapp.com within that time.
• Verification and reset codes: minutes. They are deleted once used or expired.
• Purchase records: retained while the entitlement is live, and afterwards for 10 years, which is the retention accounting law requires of the underlying records.
• The security log of changes to your account: 12 months, then deleted automatically (§3.1).
• Sign-in rate-limit counters: 24 hours after the last failed attempt.
• Crash reports, and the daily count of app starts: 7 days, then deleted automatically (§3.3).
• The server's request log: 14 days, then deleted automatically (§3.3).
• The launch-list email address: until you ask us to remove it, or until the launch email has been sent and the list is deleted — whichever is sooner.

7. Deleting your account

Two of these you do yourself, and they take effect at once rather than becoming a request somebody has to action. The second exists because Google Play has required since 2023 that deletion be possible without the app installed.

• In the app: Profile → Account → Delete account on Android, and Profile → Delete account on iPhone.
• On the web: https://api.owemeapp.com/delete-account — enter the email address and password for the account and confirm. Nothing needs to be installed and there is nobody to wait for.
• If you cannot get into your account at all — you have forgotten the password and the address on it was never confirmed, so a reset code cannot be sent — write to privacy@owemeapp.com from any address you can show is connected to the account. A person answers, and we will not leave you stuck with an account you cannot reach and cannot close. This is the only one of the three that is not instant, and we answer within 30 days (§8).

Take your data first if you want a copy. Deletion is immediate and there is nothing left to export afterwards — see §8.1, which is one tap and needs no request.

Here is exactly what happens, because "we delete everything" would be untrue:

Erased immediately

• Your email address and display name (the name becomes "Deleted user").
• Your password and all sign-in credentials — deleted outright, not anonymised. If you signed in with Apple, we also tell Apple, so OweMe disappears from the apps using Sign in with Apple in your Apple Account settings.
• Every session, active or ended; you are signed out everywhere.
• The record of each device you used the app on.
• Your friends list, and your place on anybody else's.
• The invite records that showed which group seat was yours.
• Any name in the security log. Its entries stay until their 12 months are up (§6), saying only that something changed and when.

Kept, and no longer linked to you

Expenses, settlements and balances in groups you shared with other people. Your seat in those groups is severed from your account and left as a ghost member labelled "Former member" — every name that seat carried is overwritten, including any nickname a member of that group had given you. The rows that remain say what was spent and what it settles; they do not say who you were.

Why: those rows are other people's financial records too. A balance reading "owes €40" with the name removed is unusable to the people still in that group, and they have a legitimate interest in the record of a debt they were part of. GDPR Art. 17(3) recognises this limit on erasure. Nothing that remains identifies you or can be traced back to your account.

Kept because the law requires it

If you ever bought a subscription or a premium group, the record of that purchase survives deletion: which product, when, and its state. Accounting law requires the underlying records to be kept for 10 years and §6 says so, so it is repeated here rather than left for you to find. It is a receipt, not a profile — it carries no card, no bank detail and no billing address, because neither Google nor Apple ever gives us one (§3.4).

What none of it amounts to

After deletion there is no way to sign in, no address to write to you at, and nothing left that names you. What survives is somebody else's ledger and a receipt an auditor may ask for.

8. Your rights

Every right below is available to every user, wherever you live, and whichever of these laws does or does not technically bind us. Sorting people by postcode and giving each the statutory minimum would cost more to build than giving everybody the same thing.

How to use them. Most are self-service and instant, in the app: correcting anything, exporting everything, deleting the account. For the rest, email privacy@owemeapp.com. We answer within 30 days, and if a request is genuinely complicated we will say so and take at most 60. It is free; we will not charge you for asking, and asking will never get your account degraded, delayed or closed.

How we check it is you. Nearly always, by your own credentials — you are signed in, or you write from the address on the account. We deliberately do not ask for a document proving identity: collecting a passport scan to answer a privacy request would mean holding far more about you than the request is about. If we cannot satisfy ourselves that a request is yours, we will say so rather than guess, because the alternative is handing your ledger to somebody else. You may use an authorised agent; we will ask for your written permission and still verify you directly.

8.1 Everyone

• Know what we hold and what we do with it. §3 is the list, §5 is everyone who sees any of it, and §6 is how long it lives.

• Access and portability. Profile → Privacy & terms → Download a copy of my data returns everything we hold about you as a JSON file: your account, your devices, your sessions, your friends list, the security log of changes to your account, crash reports from your installations, every group with its expenses and settlements, and your purchases. It states in the file itself what it deliberately omits and why — including crash reports from an installation somebody else has also signed in on, which could be theirs. A single group can also be exported as CSV from Group settings → Export as CSV, including entries outside the free plan's 90-day window. Both give amounts in minor units with the currency code and exponent, so a spreadsheet can total them. With Premium, or in a premium group, a group also exports as a PDF — its balances, every expense with who paid it, and its settlements — made by our server when you ask and not kept afterwards.

  Your copy does not include other members' email addresses. Their names and the amounts between you are there, because you already see those in the app, but their contact details are their personal data rather than yours.

• Correct anything inaccurate — your name, your email and every expense are editable in the app, by you, immediately.

• Delete, as described in §7. Immediate, and not a request that somebody has to get around to.

• Opt out of sale, sharing, targeted advertising and profiling. There is nothing to opt out of: we do none of them, have never done any of them, and §4 is the specific list of what that means.

• Not be treated differently for exercising any of this. No price change, no feature withheld, no account closed.

8.2 The EU and EEA, the UK, and Switzerland

Under the GDPR, the UK GDPR and the Swiss revFADP, in addition to §8.1:

• Sources of personal data (Art. 14(2)(f)). We get it from: you; other members of your groups, who can add your name and record expenses that involve you; your device, through the app; Google or Apple, if you sign in or buy through them; and our own systems and service providers — the server's request and security logs, and the country Cloudflare attaches to a launch-list sign-up. §3.7 sets out each one in full.

• The legal basis for every purpose is named in the tables in §3. Where it is legitimate interests — 6(1)(f) — you may object, and we will stop unless we have grounds that override yours.

• Restrict processing while a dispute about accuracy or lawfulness is being resolved.

• Withdraw consent at any time where consent is the basis. That is the launch-list address in §3.5 and nothing else; withdrawing does not affect what was lawful before you withdrew.

• Complain to a supervisory authority. In the EU/EEA, your own national DPA — the list is at edpb.europa.eu. In the UK, the Information Commissioner's Office, ico.org.uk. In Switzerland, the FDPIC, edoeb.admin.ch. You can complain to them without coming to us first, though we would rather you gave us the chance.

• Transfers. The server and its database are in France, inside the EU. But OweMe is run from Albania, which is outside the EEA and has no EU adequacy decision, and several processors in §5 are in the United States, so using OweMe still involves a transfer of personal data outside the EEA. Your rights under this notice apply in full wherever your data is handled from. The transfers to those processors rely on the EU Standard Contractual Clauses; Google and Cloudflare are additionally certified under the EU–US Data Privacy Framework, and the UK transfers rely on the UK Addendum to those clauses. For people in the EEA, the UK and Switzerland, Apple acts through Apple Distribution International in Ireland, and Apple's own onward transfers rely on Standard Contractual Clauses.

  You can have a copy of these safeguards. Write to privacy@owemeapp.com naming the provider, and we will send you the Standard Contractual Clauses — and the UK Addendum, where it applies — that the transfer relies on. We may black out commercial terms that have nothing to do with your data, but never the data-protection clauses themselves. The Data Privacy Framework certifications are public, at dataprivacyframework.gov.

• No automated decision-making, and no profiling. The balances and settle-up suggestions OweMe shows are arithmetic on the figures you and your group entered — a calculator's answer, not a decision about you. Nothing here produces a legal or similarly significant effect about you by automated means, so GDPR Article 22 does not apply, and neither does the duty in Arts. 13(2)(f) and 14(2)(g) to explain "the logic involved" in such decisions. There is no profiling, no scoring and no automated refusal.

Two limits are worth stating rather than discovering:

• Art. 15(4) — a copy of your data cannot adversely affect the rights of others, which is why your export carries other members' names but not their email addresses.
• Art. 17(3) — erasure does not extend to records other people have a legitimate interest in. That is why deleting your account anonymises your seat in a shared group instead of deleting the expenses everyone else's balances are computed from. §7 sets out exactly what that leaves behind.

8.3 The United States

California's CCPA/CPRA, and the comprehensive privacy laws now in force in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and a growing number of other states, give consumers a broadly similar set of rights.

We almost certainly fall below the thresholds that make those laws binding on us — the CCPA, for instance, applies to businesses over $25m in revenue, or handling 100,000 consumers, or making half their money selling personal information, and OweMe is one person's project that sells none. We are telling you the rights anyway, and honouring them, because a threshold is a reason a regulator cannot make us and not a reason you should get less.

Beyond §8.1, these laws ask for the following to be said explicitly.

1. We do not sell your personal information, and we do not share it for cross-context behavioural advertising. Not now, and not in the preceding twelve months — including for consumers we know to be under 16, whom the CCPA protects specifically. There is no advertising business here to sell into: no ad SDK, no ad identifier, no analytics processor of any kind (§4). Because there is nothing to opt out of, there is deliberately no "Do Not Sell or Share My Personal Information" link; a link to an opt-out from something we do not do would imply we do it.

• Notice of your right to opt out of sale or sharing. The CCPA gives you the right to tell a business not to sell or share your personal information. You do not need to use it here: we do neither, so there is nothing to opt out of and no request to send. If we ever proposed to start, we would change this notice first (§11), and give you a way to opt out before any sale or sharing began.
• Opt-in for consumers under 16. The CCPA allows a business to sell or share the personal information of a consumer it knows to be under 16 only with opt-in consent — the consumer's own if they are 13 to 15, a parent's if they are under 13. Because we sell and share nothing, there is nothing to opt in to, and OweMe is only for people aged 16 and over (§10). If that ever changed, we would ask for that consent before selling or sharing anything.

2. What we collect, in the categories the statute uses. Purposes are in §3, retention in §6, and the recipients in §5 — this is the same information arranged the way the CCPA asks for it. In the preceding twelve months we collected the categories marked "Yes" below, and no others.

Where it came from. In the preceding twelve months, the personal information above came from the five categories of source listed in §3.7 — you; other people in your groups; your device; Google or Apple, if you use them; and our own systems and service providers — and from no others.

Who it was disclosed to, for a business purpose. In the preceding twelve months we disclosed these categories, to these categories of recipient, and to nobody else. Each receives the information to provide the service described in §5; Google's ML Kit also uses its scanner diagnostics to maintain and improve ML Kit itself, as §4 says. None of it was sold, and none was shared for cross-context behavioural advertising.

3. Sensitive personal information, and why there is no "limit" link. The CCPA counts account credentials as sensitive. We use yours to sign you in and for nothing else — never to infer a characteristic about you — which is the use §1798.121(d) exempts from the right to limit. So there is no "Limit the Use of My Sensitive Personal Information" control, because there is no other use to limit it to.

4. Opt-out preference signals. We treat a Global Privacy Control signal — or any universal opt-out mechanism a state recognises, as California, Colorado, Connecticut and others do — as a valid request to opt out of sale, sharing and targeted advertising: for the browser or device that sends it, and for your account if we can tell the request is yours. Since we do none of those things, honouring it changes nothing in what we do, and we will not ask you to confirm it or sign in first. The website sets no cookies, so it does not need to remember the signal in order to honour it.

5. Appeals. If we refuse a request, we will tell you why, and you may appeal by replying to that refusal. A different reading by the same person is not much of an appeal at this size, and we will not pretend otherwise — so we will also tell you how to take it to your state Attorney General, which is the route Virginia, Colorado, Connecticut, Texas and the others provide.

California "Shine the Light" (Cal. Civ. Code §1798.83): we disclose no personal information to third parties for their own direct-marketing purposes.

No financial incentive. We offer nothing in exchange for your data, so there is no incentive programme to disclose.

California Online Privacy Protection Act (CalOPPA).

• Do Not Track. Browsers can send a "Do Not Track" signal. Neither the website nor the app tracks your activity across other websites or apps, or builds a record of it over time, and neither lets anybody else do so, so there is nothing for the signal to switch off. We behave the same whether or not it is sent, which is already what it asks for.
• Cross-context behavioural advertising. We do not engage in it. We do not allow any third party to collect personal information about you on the website or in the app — over time, or across other websites and services — for advertising or to track you. The only third-party component in the app that collects anything is Google's ML Kit (§4), and what it collects is technical data about the receipt scanner, not a record of you.
• Where to find this notice. At owemeapp.com/privacy, linked as Privacy from the footer of every page of owemeapp.com; as Privacy Policy on the app's sign-up screen, before an account is created; in the app at Profile → Privacy & terms; and from the app's listings on Google Play and the App Store.
• Changes to this notice are made as §11 describes.

8.4 Everywhere else

Canada's PIPEDA, Brazil's LGPD, Australia's Privacy Act and the others all ask for some version of access, correction, deletion and an explanation. §8.1 is that, for everyone, and the contact in §12 is the way to use it. If your law gives you something §8.1 does not, ask — we would rather extend the list than argue about jurisdiction.

9. How we protect it

• Passwords are hashed with argon2id at OWASP's recommended parameters. A copy of our database does not yield anybody's password.
• All traffic uses HTTPS.
• Sessions use short-lived access tokens (15 minutes) and rotating refresh tokens. Presenting an already-used refresh token revokes the whole chain — the standard defence against a stolen token.
• Ending a session ends it immediately. Changing your password, resetting a forgotten one and deleting your account all take effect at once, on every device, rather than whenever the current token happens to expire. That is what makes "you are signed out everywhere" in §7 literally true.
• Signing in answers identically whether the email is unknown or the password is wrong, and takes a comparable time either way, so the endpoint cannot be used to find out who has an account.
• Sign-in attempts are limited both per network address and per account, so guessing one person's password stays slow even from many different machines. The limit is a delay that lengthens, never a lock — nobody can shut you out of your own account by deliberately failing to sign in as you.
• Passwords are checked against a minimum length and a list of common and guessable choices, including ones based on your own email or name. We do not impose symbol-and-number rules, which are known to produce weaker passwords.
• Purchase tokens and invite tokens are stored only as hashes.
• Access to a group's data requires membership of that group, re-checked on every request rather than trusted from the client.
• The website loads nothing from any other host, under a Content-Security-Policy that forbids it. Reading this policy tells nobody else that you did.

No system is perfectly secure, and we will not claim otherwise. If we discover a breach affecting your rights we will notify the supervisory authority within 72 hours and tell you where required.

10. Children

OweMe is not directed at children, and the Terms require you to be at least 16 anywhere in the world. That is deliberately the stricter of the two thresholds we could have picked: the GDPR lets a member state set the digital- consent age as low as 13, and the US COPPA rule covers under-13s. One number that satisfies both is easier to honour than a map.

We do not knowingly collect data from anyone under 16. Creating an account asks you to confirm that you are 16 or older: with a tick-box on the sign-up screen, or — if you sign up with Google or Apple from the sign-in screen — with a question before the account is made. Saying no creates nothing. We do not ask for a date of birth, and the answer itself is not stored, only which Terms of Use you accepted and when (§3.1) — collecting everybody's date of birth to catch the few would be more data held, not less. If you believe a child has an account, write to privacy@owemeapp.com and we will delete it and everything on it. A parent or guardian may make that request; we will not require the child's password to act on it.

11. Changes

We will update the date at the top and, for anything that materially changes what we collect or who we share it with, tell you in the app before it takes effect.

12. Contact

OweMe, the data controller — privacy@owemeapp.com, or by post to Skanderbeg Square, 1001 Tirana.