Privacy: what Paid Up stores and sends

What we store

Your groups, the people in them, every expense and payment, the notes you type, and the receipts you attach. If you add an account, your email address or Google sign-in and your display name. If you choose to, your Venmo name, Cash App name or Zelle email or phone, which only people who share a group or friendship with you can see.

Your settings are stored too: theme, language, reminder and email switches, and the push notification address your browser gives us if you turn notifications on.

We don't store your contacts. A phone number you type to invite someone by text is used on your phone to build the link and goes nowhere else.

Where it lives

The database and receipt files are stored with Supabase, in one project that the Chase Builds apps share. Each app keeps its data in its own separate area, and Paid Up can't read another app's area.

The app itself is served from Vercel. Email, when you ask for it or turn on a reminder, goes out through Resend.

The project runs in us-east-1.

One Chase Builds login

One Chase Builds login works across the Chase Builds apps. Each app stores its own data separately.

Deleting your Paid Up account removes your Paid Up data. If you also use another Chase Builds app with the same login, Account, then Data offers a second option, Delete my Chase Builds login from every app, which removes your data in every app and then the login itself.

On your phone or browser

Paid Up keeps your sign-in session in a cookie that belongs to this site only, and a few settings and group links in the browser's storage so your groups open without a network. Starting a group without an account gives your device a random anonymous identity.

If you pick a language, one cookie remembers that choice for a year. Using the phone's language removes it.

Delete my data from Paid Up, in Account, then Data, removes you from your groups (you show as Former member) and clears this device.

Analytics, in plain words

We use PostHog to count what people do, so we know what to fix. It runs in memory: no analytics cookies and nothing in your device storage. It respects the browser setting that asks sites not to track you.

Events go through our own address, e.chasebuilds.app, so PostHog is never called from your browser directly.

Each event is tied to a random account id, never to your name or email. No event holds titles, amounts, names, emails or group names. Each one carries the app name, the app version, your language, and a flag we set on our own test visits.

Where a visit came from: the first time you open Paid Up in a tab, we note the utm_source, utm_medium, utm_campaign, utm_content and ref values in the link (up to 64 characters each) and the website you came from, only its domain. We keep the first values for your account and attach the current ones to page views.

We also record page speed numbers and errors with their stack trace, never what you typed. We don't record sessions and we don't capture clicks or typed text.

Every event we send

These are all of them. Anything not listed isn't sent.

• $pageview: A screen was opened, with the campaign values from the link.
• anonymous_started: A device started without an account.
• group_created: A group was made.
• link_shared: A group link was shared.
• link_opened: A group link was opened.
• member_bound: Someone joined as a person in a group, and whether they picked a name or added themselves.
• member_reclaimed: Someone took back their place on a new device.
• link_reset: A group link was replaced.
• expense_added: An expense was saved: the split type, the number of payers and whether the calculator was used.
• itemized_saved: An itemized expense was saved: a size range for the items and whether it had tax or tip.
• explain_opened: A balance explanation was opened.
• upgrade_prompt_shown: The offer to save your groups was shown, and at which moment.
• account_upgraded: An account was added, with the moment and the sign-in method.
• settle_up_recorded: A payment was recorded.
• pwa_installed: The app was installed to a home screen.
• push_enabled: Notifications were turned on.
• push_offer_shown: The one-time offer to turn on notifications opened, with the moment that triggered it.
• import_completed: A Splitwise import finished, with a size range for the rows.
• newsletter_optin: The new free apps box was ticked.
• aise_link_clicked: The AI Service Engine link was tapped.
• invite_sent: An invite was sent by text, share sheet or copy, for a friend or a group.
• invite_email_result: An invite email was sent or held back, and why.
• friend_added_by_link: A friend was added from a friend link.
• friend_added: A friend was added, and whether from a friend link, a QR code or an email.
• friend_code_scanned: A friend link was opened, and whether by camera, photo or paste.
• pay_link_opened: A pay button was tapped: Venmo, Cash App or Zelle.
• category_suggested: A category was suggested, and whether you kept it.
• settle_date_set: A settle-up date schedule was chosen.
• email_pref_changed: An email setting was switched, which one and whether on or off.
• locale_changed: A language was picked.

Bot check

When you start a group, open a join link or sign in, Cloudflare Turnstile checks that you're a person. It runs in your browser and Cloudflare sees the request details a browser normally sends.

Receipts and photos

Photos are shrunk on your phone before they upload, and the stored copy has no photo metadata. Each image or PDF is at most 2 MB. You get 25 MB of space without an account and 100 MB with one.

If your phone shares when and where a photo was taken, we keep that in a private record only the person who uploaded it can read. Android usually removes the location first.

Email and newsletter

Sign-in codes, invites and the reminder or digest emails you switch on are sent from noreply@mail.chasebuilds.app by Resend, which sees the address, subject and message. We don't track opens or clicks. Anonymous members get no email.

If you tick the box for new free apps, our server sends your email address, the app name and where you came from to the newsletter service. Nothing else is sent.

Camera

The scanner uses your camera only while it's open. Camera frames and photos you pick are read on your phone and are never uploaded.

Export and delete

To get a copy: open Account, then Data, and choose Download my data. You get a file of everything and a spreadsheet for each group.

To delete: open Account, then Data, and choose Delete my account. Your groups stay for everyone else, and you show up in them as Former member. This removes Paid Up data only.

If another Chase Builds app uses your login, the same screen offers Delete my Chase Builds login from every app.

On a device with no account, Delete my data from Paid Up removes you from your groups and clears that device. Groups that only you were in are deleted.

Questions

Write to us at the address below and we'll answer.