Privacy Policy

This page explains how Futari collects, uses, and protects your personal data.

Data we collect

• Basic account information from Google or Apple sign-in: name, avatar, and email address.
• Expense data you enter manually, including transactions, settlements, split preferences, and shared asset records.
• Invite links and acceptance times (used to link the two accounts).
• Usage behavior and error information (used to improve the Service — see Third-party services below).

How we use your data

• To display the shared ledger interface between you and your partner and calculate balances.
• To power features such as recurring rules and monthly reviews.
• To detect and fix errors in the Service (via Sentry error tracking).
• To analyze feature usage and improve the product experience (via PostHog, with no personally identifiable information).

Where data is stored

Data is stored on servers hosted by Supabase, transmitted over encrypted connections and protected by access controls. These fields are encrypted with AES-256-GCM before they are written to the database: a child's full name, national ID number, health insurance card number, a vehicle licence plate, a home address, and the verification code for an e-invoice carrier. Everything else you record — transaction descriptions, amounts, categories, settlement notes — is stored as plain text. Both encryption and decryption happen on our servers and we hold the key, so this is encryption at rest, not end-to-end encryption. We also make a backup of the database every day. Each backup is encrypted before it is uploaded, stored on Google Drive and kept for up to about 60 days; the key that decrypts it is kept offline, separate from the backups.

Data retention

Your account data is retained for as long as your account remains active. Transactions you delete are kept as soft-deleted records for about a year, then cleared automatically. When you request account deletion from the settings page there is a 14-day grace period (calendar days, not business days) during which you can cancel at any time; after that it runs automatically. What happens then depends on whether the ledger is yours alone or shared with a partner:

• A solo ledger: the transactions, settlements, recurring rules, aibutsu and trip records you wrote on your own are deleted (aibutsu, recurring rules and trip names your partner could see stay so they can look back at them), along with your profile (name, avatar, email). If this ledger was once shared and your partner has since left, the records of your time together stay so they can look back at them, and your name appears as "Partner who left". Once they delete their account too, those records are deleted with it.
• A shared ledger: the ledger stays with your partner. The transactions, settlements, aibutsu records and monthly review notes the two of you wrote together remain in their ledger; we do not remove them on your behalf, because those records are theirs as well. Your sign-in identity is deleted (Google / Apple account link, email, avatar, push devices), and your name appears in their ledger as "Partner who left". The same applies to a ledger you left earlier: the records you wrote during that time stay in your partner's ledger.
• If you would like the content in a shared ledger removed as well, talk it over with your partner before deleting your account, or write to us first.
• Data you delete (including what is removed when you delete your account) can remain in encrypted backups made before the deletion for up to about 60 days, and disappears as those backups are cleared. We do not use backups to bring it back; backups are only used if the whole service has to be restored, and in that case we apply those deletions again.

Third-party services

• Google (OAuth sign-in)
• Apple (OAuth sign-in)
• Supabase (backend, database, realtime sync)
• Vercel (web hosting)
• Sentry (error tracking — collects anonymous error traces, no personally identifiable information)
• PostHog (product analytics — collects anonymous usage events, no personally identifiable information)
• Google Analytics 4 (traffic source analytics — IP-anonymised, cross-site personalisation disabled)
• Google Drive (storage for encrypted database backups)

Your rights

You may sign out or delete your account at any time from the settings page. To export or enquire about your personal data, open an issue on GitHub, or email us at support@southern-light.dev.

If this policy changes, we will update this page and revise the date above. For any questions, open an issue on GitHub.