Privacy

Data and purposes

• Account data: username, display name, email, password hash, sessions and preferences, to authenticate and secure your account.
• Personal journal entries and shared group, expense, currency, participant and payment records, to provide the features you use.
• Optional profile/group images, receiving QR images and receiving details you confirm, to display information to authorized users. We do not need banking passwords or payment-card security codes.
• Device/push identifiers and notification preferences, to deliver relevant notifications. Production builds also use usage events, app version and crash diagnostics to improve reliability.
• Messages you send to support, to answer questions and handle privacy requests.

The app does not request phone contacts or GPS. Personal journals and email are not included in public user-search results. Authenticated users can find public usernames, display names and avatars. Group members can see shared expenses and payments. Receiving QR details are available through authorized payment features.

Providers and international processing

Our API/database runs in Vietnam. We use Cloudflare R2 for media, Google Firebase Analytics/Crashlytics for production usage and diagnostics, OneSignal and APNs/FCM for notifications, and Brevo for account emails. Relevant data may be processed outside your country by these providers. We do not sell personal data; the current release does not serve advertisements.

Retention and deletion

After you confirm account deletion, we revoke sessions and remove profile identity, credentials, your personal journal, receiving QR, private settings and pending account communications. Images you uploaded, including group images, are unlinked and queued for physical deletion by a retry worker. They are no longer available through the app; storage failures can delay physical removal.

Titles of expenses/events you created are cleared. Known username, email and display-name identifiers are redacted from related shared text snapshots. Shared amounts, dates, currencies and payment states remain under a deleted-member label while the group remains active, so other members can understand their own records. Internal references and context can still make records linkable: this does not guarantee irreversible anonymization. Other people's private notes or content can mention you; contact support for review and removal of identifying content where appropriate.

Shared records are scheduled for deletion 90 days after a group is disbanded or archived, with daily cleanup and retry if storage cleanup is pending. Another member's independent personal journal remains their record. Deletion does not mark debts paid or transfer money. We retain seven rotating daily database backups; expired copies are replaced on the backup cycle. When restoring a backup, deletion requests since that backup must be reapplied before reopening access.

Usage/crash information already sent to providers is subject to their configured retention and deletion mechanisms. Contact us for access, correction, deletion or objections concerning your data; applicable rights depend on your location. Unfinished balances do not prevent deletion. We use authentication, access controls and HTTPS, but no service can promise absolute security.

Choices and contact

Edit your profile and notification preferences in the app, or disable push permission in device settings. Contact support@vunbtstudio.com about privacy or identifying shared content. Do not email passwords, one-time codes, bank login credentials or card secrets. Material changes will be posted here with an updated effective date and communicated where appropriate.

Registration acknowledgment

We record the version of the Terms of Use, the version of the Privacy Policy provided to you, and the time you confirm, to document what applied when your account was created. This record is handled with your account information under “Retention and deletion”.

This acknowledgment does not replace separate consent for processing that requires a separate choice, such as advertising or tracking where applicable.

Delete account →