Privacy policy
Last updated: 2026-11-04
What we store
- Account: your email address, a display name, a password hash (scrypt), timestamps of registration and login.
- Groups: group names, members, invitations (the invited email address), expenses, settlements and the notes you type.
- Personal expenses: the entries you add or import in the "My expenses" module. Imported statements are parsed and discarded; only the resulting rows are kept.
- How you found us: the first time you open a page of our website through a link that names a campaign (for example an advert) or from another website, we note the campaign details written in that link (source, medium, campaign, content and keyword), which network the click came from (for Facebook and Instagram this can also be an ordinary shared link: Facebook, Instagram and Messenger add the same marker to ordinary links that leave them, in posts and in private chats alike), the name of the website you came from, which of our pages you opened (its name only, never the rest of its address) and when. An earlier visit without such a link is ignored. A click identifier is never part of these details, and a campaign detail that contains an email address or a click identifier is dropped. These details stay in our session cookie, which is set for this even when you are not logged in, until you sign up, log in or close the browser. If you sign up, they are kept with your account, to see which adverts and websites bring people; if you never sign up, they are never saved on our server. Nothing goes to a third party. To refuse, turn on "Global Privacy Control" or "Do Not Track" in your browser: we then note nothing.
- Security logs: failed login attempts per IP address and per email for 15 minutes.
- Server logs: for security and to keep the site running, our web server notes each request's IP address, the page asked for (its address without the part after a "?", where campaign details sit), the time and the browser, kept about two weeks; a second log with only the page, the time and the outcome is kept about two months. When a request fails, an error log can also note its full address and the page you came from, kept up to two months.
What we do not do
No advertising trackers, no third-party analytics, no selling or sharing of data. The only cookie is our own session cookie: it keeps you logged in and, until you sign up, can hold the campaign details described above.
Emails
We send account emails (verification, password reset) and group invitations on behalf of the person inviting you. These are transactional and carry no marketing.
Where
Data is stored on a server in the European Union and backed up daily.
Your rights
You can export or delete your account from the Account page. Deleting the account removes your personal record; expenses you recorded in shared groups remain visible to the other members as bookkeeping history, attributed to a "former member".
Contact
hello@soldifam.ch