Privacy policy

Last updated 2026-09-22

The short version

• You can start without signing in. The app still gives your phone an anonymous account and keeps your ledgers in our cloud database, so they can be shared and restored. Signing in only adds a phone number or Apple ID so you can get that account back.
• We never move, hold or see your money. We record that you paid, and keep the slip you attach.
• We do not sell data, show ads or track you across apps.

What we store

• Account — name, the one- or two-character tile you choose, the phone number or Apple ID you sign in with (if you use Sign in with Apple, Apple may give us your name and a real or private-relay email), language, base currency, payout handles you add (e.g. an FPS number or a PayMe link).
• Ledgers — groups you belong to, expenses, splits, payments, comments, game-night sessions and the activity log.
• Slips and receipts — images or PDFs you attach. Before upload the app re-encodes images, which removes location and camera metadata, and limits them to 5 MB.
• Purchases — which plan you hold, from Apple or Google. We never receive card details.
• Device checks — to block fake clients, Apple (App Attest / DeviceCheck) or Google (Play Integrity) confirm to Firebase that requests come from the genuine app. We collect no crash reports or analytics.

Who can see it

Members of a ledger see everything in that ledger, including slips. Nobody else does. Invite links expire after 14 days and can be rotated by the ledger owner. Our processors are Google Firebase (hosting, database, storage, authentication, SMS verification codes) and Apple / Google (sign-in, purchases, device checks). Your data is stored in Google Cloud in Hong Kong (asia-east2); Google may process it in other countries under its data processing terms.

On-device processing

Receipt scanning runs on your phone using the operating system's text recognition. Receipt images are not sent to any recognition service.

Retention and deletion

• Deleted expenses are kept for 30 days so they can be restored, then erased.
• Delete your account in the app: Me → Account & legal → Delete account and all data. Your profile, handles and device data are erased. Entries you made in shared ledgers remain, attributed to an anonymous "former member", so other people's balances stay correct.
• You can export any ledger as CSV from its settings.

Why we use it

To run the service you asked for: keep your ledgers, share them with the members you invite, and restore them on a new phone (performance of our agreement with you). To stop abuse and fake clients, and to keep other members' balances correct after you leave (our legitimate interests). To keep records the law requires, such as purchase records (legal obligation). We do not use your data for advertising or profiling.

Your rights

You can see, correct and export your data in the app, and delete your account there at any time. You can also write to us to ask for a copy of your data, to correct or erase it, or to object to or restrict how we use it. We answer within 30 days. If you are in the EU, the UK or elsewhere with a data protection authority, you may complain to it; in Hong Kong, that is the Privacy Commissioner for Personal Data.

Other people in your ledgers

Members often add friends who have not installed the app yet (a name and a tile), and slips can show someone else's name or account. Only add what the ledger needs. Anyone named in a ledger can ask us to remove their details.

Children

FundJournal is not directed at children under 13, or under the age at which a child can consent to online services where they live (up to 16 in parts of the EU).

Changes

We will show important changes in the app before they take effect. The date at the top shows the latest version.

Who we are

FundJournal is operated by Buds Never Stop Company Limited, 6D, MG Tower, 133 Hoi Bun Road, Kwun Tong, Kowloon, Hong Kong.

Contact

support@fundjournal.app