Privacy Policy

Your Account. Your email address, display name and password, stored only as a one-way hash. If you turn on two-factor sign-in, its settings and recovery codes. Your sessions, and records of sign-ins and other security events (section 12).

Guests. A Guest is a chosen name and a sign-in on one device. No email address is collected, so we cannot email a Guest, including to confirm a request.

Unfinished sign-ups. If you start creating an Account and stop, the email address and name you gave, until the sign-up is finished or expires.

Your household's setup. Its members and their roles, invitations and access links, and the split between members, with its history. A change to the split keeps the earlier version, because past months were settled on it. If your household turns maps on, it can save a home area so shop searches start near home. A trip keeps its destination and dates.

Your household's records. The ledger itself: expenses and their history, line items, how each was split, payments recorded between members, corrections, comments, months, budgets, recurring bills and their reminders, the activity feed, and ventures with their budgets, dates, destinations and notes.

Venture notes and pictures. A trip or project can hold notes you type, up to 2,000 characters, and one picture you upload to head it. Everyone who can see the venture sees both, its Guests included. We remove the location, camera and device details from the picture before storing it, store the notes and the picture encrypted, and show the picture only to people who can see that venture. We never fetch a picture for a venture from Google or any other outside source. Replacing or removing the picture deletes the old one.

Receipts. The image and a thumbnail, what was read from it (the shop's name, address and phone as printed, the date, currency, items, prices, taxes, discounts and totals, and how sure the reader was) and the corrections you make. A receipt can show the last four digits of a card, a loyalty number or someone's name. If you would rather we did not keep something on a receipt, edit it out during review or leave the photo out.

Shops and prices. The shops your household uses, products and the prices you paid, your categories, and the category and split you last used at each shop. A shop's name is shared between households as a name only, so everyone spells it the same way. Which household shopped there, what it bought and for how much stays with your household.

Contacts. You can keep a private list of names and email addresses to send invitations from. Only you can see it. The people on it have not agreed to be there and we cannot tell them, so keep only people you mean to invite.

Reserved Seats. A household Owner can add a Seat for someone before they join. It is shown to the household as “Invited”. It holds a name, the person's share of the split, and, once entries are recorded, the amounts and balances on that Seat. The person named cannot sign in to it and has not seen this policy. If they never join, the Seat stays in the household's ledger because other members' balances depend on it, but the name can be removed on request (section 7).

E-transfer question and answer. When you record a payment you can add an Interac e-transfer security question and answer for the person you paid. The people in your household who can see that payment can see it. It is stored encrypted, is never written to a log, and is deleted once the payment is confirmed or cancelled. Use an answer you have agreed with that person for that transfer, not a password you use anywhere else.

Usage analytics. We record which parts of the app are used, such as a screen opened, a button pressed or a month closed, so we can find what is broken or ignored. An event names the feature and never what it contained: no amounts, shops, items or anything you typed. With each event we receive a random id for your app or browser, the household you had open, your session if you are signed in, and the app and its version. The first event also says which website linked you to us, if any, and the campaign tags in that link. Events are deleted 13 months after the end of the month they happened in; daily totals made from them are kept longer, and stop naming an Account once it is deleted.

You can switch usage analytics off in Settings, under Usage analytics. When you are signed in, that applies to every device on your Account. It starts off if your browser sends Global Privacy Control or Do Not Track. It also starts off if we take you to be in Quebec: going by the region you chose for billing or, without one, by Canadian French as your language. If you have an Account and it is off only for that reason, the app asks you once whether to turn it on. Your choice in Settings always wins.

Separately, we keep business counts taken from the ledger, without amounts, shops or anything you typed: how many households and members there are, how many receipts were scanned, when trials and plans started and ended and what was paid, and when problem reports were filed. The analytics switch does not affect these. When an Account is deleted, it drops out of them within 15 minutes.

App updates. When the Android or iOS app opens, it asks whether an update is available. That request carries a random id for the app, the app's version and build, your phone's operating system and its version, whether the phone is an emulator and where the app was installed from, and nothing about your Account or household. We keep a hash of the id with the app's versions, to count how many phones run each update.

Problem reports. If you report a problem, we keep what you wrote (up to 4,000 characters), the area you chose, the app version, the screen you were on, the household you had open, and your browser or app details. We add our verdict and a short note. A report is tied to your Account and is read by our team.

If the form says so beside Send, your report's summary and details also go on the bug hunting board, where other signed-in bug hunters can read them with the area, its status, the day it was filed and how many people have the same problem. Never your name, Account, address, household, screen, browser, photos or videos. We can take any report off the board. If you say you have someone else's problem too, we keep that you said so, and others see only the count.

You can attach up to four photos or videos. We remove the location, camera and device details from each before storing it, store it encrypted, and show it only to you and our team, never on the board. Leave amounts, card numbers and other people's details out of what you write unless the problem needs them.

We also keep how many of your reports were verified, the badges you have, and any decision to stop your Account filing reports. Terms of Service §7.1 explains the bug program.

When you cancel. If you tell us why you cancelled a plan or deleted your Account, we keep your answer like a problem report.

The browser extension. If you install it, it reads a page only when you press its button, and sends what you chose (a picture of the page, or its PDF) to your household as a receipt or to us with a problem report. It keeps its own sign-in and settings in storage only the extension can read.

“Notify me”. If plans are not sold where you are and you ask to be told when they are, we keep that request, the region and the date, and send that one email.

Policy acceptances. Which document and version you accepted, and when. Guests accept too, when they join.

Notifications. If you allow notifications, the device's delivery registration, stored encrypted, and whether notifications are allowed on it. Section 8 says who delivers them.

When you use the app. We keep your time zone, which days you used the app, and which questions the app has asked you and when. We use this to ask you things rarely and at a sensible time, to show you what changed while you were away, and to know when a reminder is due. It holds nothing you entered, and it is deleted with your Account.

Reminder emails. After some time away, or when a month ends, we may email you what changed in your household, at most once a week. You can turn them off in Settings, under Notifications, or with the Unsubscribe link in each one.

Email that bounces. If email to your address comes back undelivered, we note it, stop sending to that address and tell you in the app. The note is deleted 90 days after the last bounce.

Server logs. Our request logs do not record your IP address, what you typed into a search, what a receipt says, or any password, code or token. When a request fails, an error log can record the IP address it came from. Server logs are deleted within 30 days.

What we do not hold. Bank credentials, card numbers or payment tokens (on the web you type a card into Stripe's checkout, not ours, and in an app you pay the store). Your location: the places we keep are the ones you typed or photographed, and a search near you uses your position for that search only. Advertising ids. Crash reports from the website.

Crash reports. The Android app sends crash reports through Firebase Crashlytics (section 8): what failed and where, the app version, the phone model and operating system, and a random installation id Firebase creates for the app. They hold nothing you entered. The app sends them only while usage analytics is on, so switching it off in Settings stops them too.

Receipts are read on equipment we operate in Canada. A photo is read there and not kept there.

Your photos are not sent to any outside AI or OCR company, and no receipt is used to train a model unless you choose to share it. If we ever use an outside reading service, this page and the Subprocessors page will say so before the first photo is sent.

Reading produces a draft for you to check. Totals can be misread, lines missed and dates guessed wrong, and what is saved is what you confirmed.

The full-size photo you upload is deleted once the smaller copy and thumbnail are saved, at once if you cancel, and within 24 hours in any case, unless it is the only copy behind an entry you saved before reading finished; then it is kept until the smaller copy exists.

When you save an expense from a receipt, we count which parts of the draft you changed: the shop, the date, the totals and the lines. That count holds the shop's name, the day and what changed, and nothing that identifies you, your household or the receipt.

Sending a receipt to improve reading (optional). You can send receipts to us so we can test and train EvenHearth's own reader. Nothing is sent unless you choose to send a receipt, and saying no changes nothing else.

• When you correct a receipt our reader got wrong, we offer to send it to us. You can turn these offers off in Settings, under Privacy & data. Review & send shows you the receipt with its details blacked out and what you are agreeing to before anything is sent, and we record what you agreed to and when.
• Before a copy is stored we remove card, member, loyalty and reference numbers, phone numbers, email addresses and any name the receipt labels as one from its text. The photo is kept only if you choose, with black boxes burned in over everything you cover; otherwise only the text is kept. Someone on our team checks every shared receipt and sets it aside if a name or number is still visible.
• A copy holds the shop, the date, each line and its amount, and the totals, plus the photo if you kept it. Never your name, email, household, its members, how the expense was split, or your notes.
• It is kept in Canada, apart from your household's receipts. Only the few people at Maliko Labs Inc. who review receipts can open it, and they see it by number, not by name. It is never sold, shared with another company, or used to train anyone else's model.
• It is kept up to 24 months from the day you shared it, then deleted.
• Press Withdraw on the entry to withdraw one receipt, or Withdraw everything you've sent in Settings to withdraw them all. Erasing your Account withdraws every one. The copy is deleted within a day and kept out of training from then on, though a model already trained on it cannot unlearn it. Deleting the expense alone does not withdraw it.

• Members of a household see its shared entries.
• A venture's Guests see that venture and nothing else, not the household behind it.
• An entry you mark personal is seen only by you, and by the member who paid for it if that is someone else. Other members do not see it at all. An entry in a private trip is seen only by the people on that trip.
• An invitation or access link shows the person opening it only what they were invited to and who invited them. Each works once; a household invitation or access link expires after 24 hours, and an invitation to a trip or project after seven days.
• Your Contacts are seen only by you.
• A Reserved Seat's name is seen by the members of its household, including people who have never met the person named.
• An e-transfer question and answer is seen as section 1 describes.

Nobody at EvenHearth reads your ledger as part of normal work. We look at data only when running the service needs it, such as investigating a failed upload. Our support tools cannot show a household's entries, receipts or payments.

No advertising. No selling or renting personal information. No outside analytics or tracking scripts, no cross-site tracking, no advertising ids and no data brokers. The usage analytics in section 1 is our own: it stays on our servers and no outside company receives it.

On the web, you stay signed in with one cookie. Scripts on the page cannot read it and it only travels over HTTPS. The browser also keeps your preferences, drafts you are part-way through, and, if analytics is on, a random id for the browser. In the phone apps, your sign-in is held in the phone's secure storage.

None of it is for advertising or tracking, so there is no consent banner. The Cookie Policy describes each kind, how long it lasts and how to remove it.

Ledger records last as long as the household, because other people's balances depend on them. Everything else is kept only as long as it is needed.

“Automatically” means it happens on a schedule without anyone having to act. The Data retention page shows the same list.

Export. You can export your records from Settings at any time, on the phone or the desktop. The export is one file with every household you are in: members, months, trips, trip notes, entries with their lines and splits, payments and currency changes. Receipt photos and venture pictures are not in it, but each receipt photo can be saved from its receipt.

Correction. You can change your name and your email address in Settings, on the phone or the web. Anything else we correct on request.

Access, correction and deletion. You can ask for a copy of what we hold about you, a correction, or deletion by writing to support@maliko.ca.

Deleting your account. Settings has a Delete account option on the phone and the web. Your account is closed and signed out everywhere at once, and erased automatically after 30 days. To change your mind, sign in and press Recover account. To erase it straight away, use Slide, then hold to delete now below the countdown. Deleting your account explains each step, what stays, and how to ask by email if you cannot get in.

What deletion reaches. Your Account, its sign-in methods, your Contacts and your settings are deleted. Shared entries that other people's balances depend on stay in their ledger with your name removed; the amounts are not rewritten, because that would change what other people owe. Your personal entries also stay without your name, seen by no one except a member who paid for one. When a Guest becomes an Account, the Guest record is kept for the household's history and its sign-in is removed.

Problem reports. Erasing your Account deletes the photos and videos on your reports, your “I have this issue” marks, your badges and any reporting ban. Each report loses what you wrote, its summary, your screen, browser and household, is no longer tied to you, and comes off the board. Its area, app version, dates and our verdict stay.

If you are not a member. If your name is on a Reserved Seat, or in someone's Contacts, you can ask what we hold about you and have your name removed. The Seat's amounts stay in that household's ledger without it.

If you are a Guest. We have no email address for you, so requests from Guests go through the household that invited you.

Some records outlast deletion. Each is kept for the reason and the period section 6 gives. If your household had a free trial, a keyed hash of your email address and the trial's start date are kept for 24 months, so deleting an Account and signing up again does not give a second trial; it cannot be turned back into your email address, as section 12 explains. What was charged and refunded is kept for six years, as tax law requires. An address that unsubscribed from our emails stays on our list, so it is never mailed again. Our staff audit log is kept for 24 months. Stripe, Google and Apple keep their own records of the payments they took, under their own policies.

EvenHearth is operated from British Columbia. Depending on where you live, PIPEDA or the private-sector privacy law of British Columbia, Alberta or Quebec applies. If you believe a request was not handled properly, you can complain to the Office of the Privacy Commissioner of Canada, the Information and Privacy Commissioner of British Columbia or of Alberta, or the Commission d'accès à l'information du Québec.

Our databases and files are stored in Canada. The public service is hosted by Amazon Web Services in Montréal, with backups in Calgary. evenhearth.dev, our early-access service, runs on our own servers in Canada.

Receipts are read, and addresses and places are looked up, on equipment we operate in Canada. The photo, the words you search for, your position if you search near you, and shop addresses printed on receipts are processed there and not kept.

Connections to EvenHearth are encrypted. Pages from the public service reach you through Amazon CloudFront's nearest location, which can be outside Canada, and it keeps no copy of your data.

Who else handles personal information. Amazon Web Services hosts the public service and sends its email. Resend sends email for evenhearth.dev. Stripe takes payment for plans bought on the web, and Google Play and Apple's App Store for plans bought in the apps. Google Firebase delivers notifications to the Android app and receives its crash reports. Apple delivers notifications to the iPhone app, and confirms who you are if you sign in with Apple. Google Workspace holds our support mailbox. OVHcloud, in Toronto, holds an encrypted backup it cannot read. A browser's own push service (Google, Mozilla, Apple or Microsoft) delivers notifications in that browser, encrypted so it cannot read them. Resend, Stripe, Google and Apple process information in the United States, where it can be reached by the courts, law enforcement and national security authorities there.

Notifications are set to Private by default, so one that would name a person or a device says only “Open the app for details.”

The Subprocessors page lists each provider, what for and where. A new one is added there before it receives any personal information.

Money never moves through EvenHearth. A payment recorded between members is a note that it happened somewhere else.

Plans bought on the web are paid through Stripe. When you buy one, we keep:

• which account pays for which households, and its history;
• the customer and subscription ids Stripe gives us;
• the purchase details Stripe sends us, cut down to ids, amounts, dates, the plan, and the country and province of your billing address, because plans are sold only in Canada and sales tax follows the province. We do not keep the name, email, phone number or street address you gave Stripe;
• which plan each household is on.

We never hold card numbers. You enter your card with Stripe and it stays with Stripe. Stripe also calculates sales tax from your billing address. Stripe's payment form loads only when you subscribe, or when your bank asks you to confirm a payment. Stripe may store its own cookies to prevent fraud, under its own privacy policy. On evenhearth.dev, Stripe runs in test mode and no real card can be charged.

Plans bought in the apps. In the Android app you pay Google Play, and in the iPhone app you pay the App Store. The store takes the payment, holds your payment details and calculates sales tax, under its own privacy policy. Before the store's payment sheet opens, the app asks us for a single-use code and the store keeps it with the purchase, so the store never receives your EvenHearth account or household. We then ask the store to confirm the purchase, and we keep the store's reference for it, its plan, its state and dates, and which household it pays for. The store tells us when the plan renews, changes, is cancelled or is refunded. We do not receive your name, email address or card from the store.

You must be at least 13 to create an Account, accept an invitation or join a venture, as section 3 of the Terms also says, and at least 14 if you live in Quebec. Below the age of majority where you live, you need a parent's or guardian's permission to use EvenHearth.

A parent or guardian who is a household's Owner or Admin may add a younger child as a Reserved Seat, so the child's share of spending can be tracked. The Seat holds the name the parent types and the child's part of the records. The child never signs in and gives us nothing. Nobody may invite a Guest younger than that age.

EvenHearth is not meant for children and does not knowingly collect personal information from them. If you believe a child has been given access to a household, write to us. We will tell the household's Owner and close the child's Account or Guest place the way any Account is deleted.

This policy has a version number, and we record which version you accepted and when. If it changes in a way that matters, you will be asked once, at your next sign-in, to accept the new version, and checkout waits until you do. Using an outside receipt-reading service (section 2) would be such a change.

When you sign in, create an Account or a household, use an invite code, or when a free trial starts or is withheld, we record a keyed hash of your IP address, a short description of your device and browser (such as “Chrome on Android”), and the time. The hash cannot be turned back into your IP address, but it shows when two requests came from the same one.

We use these records to keep Accounts secure, to slow down attempts to guess passwords and codes, and to stop one person taking the free trial again and again. When signs point to a repeated trial, a new household starts on the free plan instead, and everything on the free plan works as normal. Our staff can see these records and may suspend Accounts clearly used to abuse the trial.

To tell whether an email address has had a trial, we keep a keyed hash of it and the date the trial started, for 24 months, even if you delete your Account. It is not your email address and cannot be turned back into one.

These records are used only for security and the one-trial check. They are never used for advertising or marketing, never sold, and never shared outside EvenHearth unless the law requires it. Section 6 says how long each is kept.

A trial is withheld automatically when these checks match. You can ask us which kind of check it was, tell us why you think it is wrong, and have a person review the decision: write to the address in section 13.

Privacy questions and requests: support@maliko.ca.

The person in charge of protecting personal information is the President of Maliko Labs Inc., who reads every request sent to that address and answers in writing within 30 days.

EvenHearth is operated by Maliko Labs Inc., #197, 2-70 Church St, Nanaimo, BC V9R 5H4, Canada.

Our privacy governance policy sets out who is responsible, how long things are kept, how we assess new uses, and how to complain. If you live in Quebec, you can also complain to the Commission d'accès à l'information.