Legal
FrançaisData retention
Updated November 7, 2026
How long we keep each kind of information. Ledger records last as long as the household, because other people's balances depend on them. Everything else is kept only as long as it is needed.
| Data | Kept |
|---|---|
| Original receipt photo | Until reading succeeds, you cancel, or 24 hours, whichever is first, unless it is the only copy behind an entry you saved before reading finished, which is kept until the smaller copy exists. Deleted automatically |
| A failed upload | At most 24 hours. Deleted automatically |
| Receipt image and thumbnail, and a PDF kept with an entry | On Free, 56 days from the day it is scanned, and the receipt shows that date. On a paid plan, until you delete the entry or the household, and images taken on a paid plan stay after it ends. Deleting an image never deletes its entry |
| Ledger records: expenses, splits, payments | For the life of the household, or as long as the law requires |
| A venture's notes and picture | For as long as the venture exists. Replacing or removing the picture deletes the old one at once, and deleting the venture or the household deletes both. Deleted automatically |
| The e-transfer question and answer on a payment | Until the person paid confirms it arrived, or the payment is cancelled. Deleted automatically |
| Receipts you shared to improve reading | Up to 24 months from the day you shared it, then deleted automatically. Withdrawing one, turning sharing off or erasing your Account deletes it within a day |
| Reading diagnostics | 90 days after the receipt is confirmed, or after it was scanned if it never was. Deleted automatically |
| Security records: a keyed hash of your IP address and a short device description, kept with sign-ins, new households, invite codes and free trials | 180 days, then deleted automatically |
| Your sessions: which devices are signed in, and when each was last used | 30 days after a session ends, whether you sign out, it expires or it goes unused. Deleted automatically |
| App update records from the phone apps | 90 days after the app last checked for an update, or 180 days for a note that an update failed. Deleted automatically |
| Free-trial record: a keyed hash of your email address and the date your trial started | 24 months from the start of the trial, even after your Account is deleted. Deleted automatically |
| Email and notifications waiting to be sent | A day after they are sent. Deleted automatically |
| A sign-up that was not finished: your email address and name | 30 days, or a day after the Account is created. Deleted automatically |
| Unverified accounts | 30 days, then deleted automatically. Anyone who has joined a household is kept, verified or not, because they hold shared history |
| The email address an invite code was sent to | Until the code is used up, revoked or expires. Deleted automatically |
| An address that unsubscribed from our emails | Until you press Undo or ask us to lift it. It stays after an Account is deleted, so nobody can invite that address again |
| How you use the app: your time zone, the days you used it, and the questions it asked you | As long as your Account. Deleted automatically when your Account is erased |
| A note that email to your address bounced | 90 days after the last bounce, then deleted automatically |
| An Account you asked us to delete | Closed at once and erased automatically after 30 days. Signing in shows the countdown, where you can recover it or erase it at once |
| Problem reports, their photos and videos, your “I have this issue” marks, your badges and any reporting ban | As long as your Account, and a report’s files as long as the report. When your Account is erased, the files, marks, badges and any ban are deleted automatically, and each report loses what you wrote |
| Our staff audit log: what our staff did, and invite codes being used | 24 months, then deleted automatically. Network and device details on each entry go after 180 days. Staff cannot change an entry once it is written |
| Exports | 24 hours after it is ready, then deleted automatically. Erasing your Account deletes any that is waiting |
| Billing records: which plan a household had, what was charged and refunded, and when | Six years after the end of the tax year they belong to, as tax law requires |
| Usage analytics events | 13 months after the end of the month they happened in, then deleted automatically. Daily totals made from them are kept, and stop naming an Account once it is deleted |
| Android crash reports | Held by Firebase Crashlytics under its own retention. We keep no copy |
| Server logs | At most 30 days, then deleted automatically. Request logs do not record your IP address, what you searched for, or what a receipt says |
| Deleted data inside backups | At most 100 days. Anything encrypted for your Account or household becomes unreadable within 14 days of its erasure. Backups are only restored to recover from a failure |
“Automatically” means it happens on a schedule without anyone having to act.
When a receipt photo is deleted
Deleting a photo after its 56 days removes the picture only. The entry, its amounts and its line items stay in the ledger on every plan.
When you delete your account
Your account is closed at once, signed out everywhere, and erased automatically 30 days later. Until then you can sign in and press Recover account to cancel, or use Slide, then hold to delete now below the countdown to erase it straight away.
The 30 days are there so a mis-tap does not wipe out a household's records.
When a household is deleted
Deleting a household deletes its ledger, receipts and images. Copies in backups go when those backups expire, as the table above says, and backups are only restored to recover from a failure.
