Privacy

What this app keeps about you

Your Telegram name, username, profile picture and Telegram id when you sign in with Telegram. If you sign in with a name and a password, only that name and a hashed form of the password.

When your account was created and when you were last in the app, with date and time. The latter is updated at most once every five minutes, without a page or IP address. Friends only see the day.

The trips you add: name, period, places and your photographs. Places you type in yourself are deliberately kept to about two kilometres and never more precisely. Pick a bitcoin place from the map and the exact address of that business comes with it: it is on its own front door and in OpenStreetMap. The label you type beside a place is free text and is kept as you write it, so do not put an address in it.

Your day book: amounts, categories, notes, dates and where you paid. Those figures are yours and nobody else’s, apart from the people you share a book with yourself.

Friendships, invitations and the likes you leave on photographs.

Everything in your photographs that is not the picture is removed before they are stored: the GPS coordinate, the device, the moment. The original files are never kept.

What does not happen

There is no tracking script, advertising network or third-party analytics package in this app.

This app keeps no access log of its own: nowhere is it written down who asked for which page. What is kept is a counter per day: a date, a word and a number, for instance that the app was opened four hundred times that day. It carries no member id, address or path. On our public pages we count, per day, roughly what kind of source visitors come from, for example Google, Bing, an AI assistant, another website or directly. We keep only the source category and the daily total, not the referring web address, the page visited, your IP address or who you are. Cloudflare, which carries the traffic to the server, does keep its own traffic logs, with IP addresses.

Your data is not sold, rented or shared for advertising.

Who gets to see it

Anybody who is signed in can find your name by typing it, together with the Family badge if you are in the group. That is what makes it possible to add somebody as a friend. Your Telegram username and your profile picture are only shown once you actually are friends.

Friends see your trips, your places and your photographs, with the day beside them. Somebody who is not a friend sees none of that.

Friends also see which day you were last in the app, so that the list on the Activity tab can be ordered by who was there most recently. The day and not the time: nobody can see what hour you were looking.

Travel companions see the trip you invite them to, even when you are not friends. They can add photographs and places to it and take them off again. So invite only people you trust, and withdraw an invitation code once you are done with it.

If you are in the Family group, your name appears under the photographs you like, visible to the other people in the group.

Inside your household everybody sees the same book, which is what a household is for. You always have to accept an invitation yourself. Bear in mind that you are not only sharing amounts: every entry also carries the place to about two kilometres, the day and your note, and those stay in the book if you later leave the household.

Your day book is never visible to friends. Only to you and to your household.

Parties outside this app

Telegram, for signing in. You send your own name and id in doing so. Members’ profile pictures are fetched straight from Telegram by the browser, so Telegram sees that somebody asked for such a picture.

Stripe, for paying by card. Card details never reach this app: card numbers go straight to Stripe and never pass this server. We keep the amount, the plan, whether it succeeded, the reference Stripe gave the payment and which household it belongs to. Stripe itself keeps what you fill in on their page, such as your email address and your card; that stays with them under their own retention rules, also after you have erased your account here. We cannot erase anything there.

Speed, for paying with crypto: Lightning, bitcoin on-chain, USDT or USDC. Wallet details never reach this app and never pass this server: you choose your coin and pay on Speed’s own page. What we hand over beforehand is the amount, the plan and a reference that carries your household’s id (correlationId), so a payment lands with the right household. Once it has been paid we also keep what actually arrived and in which coin, for instance sats or USDT (amount_paid and target_currency). Speed itself keeps what happens on their page under their own retention rules, also after you have erased your account here. We cannot erase anything there.

Cloudflare, which carries the traffic to this server and holds the encrypted nightly copy.

mempool.space, only if you enter a bitcoin address yourself on the Bitcoin tab. The lookup is done by your own browser directly at mempool.space, so they see which address you ask about and from which internet address. Enter nothing and nothing goes there. The addresses themselves stay in your browser and never reach our server.

Esri for the satellite map, and OpenStreetMap and BTC Map for place names and bitcoin places. The map tiles are fetched from Esri by your own browser, so they see your IP address and which piece of the world you are looking at, not who you are or that you are signed in here.

Prices come from OKX and Bybit. They see nothing of yours at all.

The app carries referral links to partners: exchanges, eSIMs, an insurer, internet on the road. Tap one and a code goes with it that tells the partner you came from here, along with everything your browser always sends, such as your IP address. What that partner does next falls under their own privacy statement. Do not tap and nothing goes there.

A language model, only when you ask Toshi something that is not in his own answer book, and only during an active paid period of Your life in Bitcoin; in the free trial days Toshi answers from his own answer book only. What goes out is your question after it has been through our filters: a seed phrase or private key is stopped and never goes along, and email addresses, phone numbers, account numbers, addresses and names are removed. No account goes with it, no name and no id, and never anything from your cash book, your trips or your photos: the app works those out itself, here on this server and in your own browser. Today we use Anthropic (Claude) for this. This feature is new and we are trying out which model suits this app best, so this may become a different provider; we will update this page before that happens.

Anthropic (Claude) also for reading a receipt, only when you tap Scan a receipt yourself and only during an active paid period of Your life in Bitcoin. The photo of the receipt then goes to Anthropic to turn it into a proposed entry. We do not keep that photo; only the entry you save afterwards. No account, name or id goes with it, but everything on the receipt does, so do not scan a receipt with something on it you would rather not share. For both the question to Toshi and the photo of a receipt: Anthropic processes what we send under their commercial terms and their data processing addendum (DPA). They do not train models on it and delete it under their retention policy within thirty days, unless their safety systems flag it. We have no zero-retention arrangement.

Why we may do this

Your trips, your photos and your book are processed to deliver the app you use: that is the agreement between you and us.

Payments are processed to carry out that same agreement, and kept afterwards because the law requires it for financial records.

Security and the counters against abuse are our legitimate interest: without them the service does not stay up, and they touch nothing you have written down.

Your position for “Nearby” and looking up a bitcoin address happen only with your consent, each time anew, and are not stored.

Outside the European Union

The party responsible for this app is established in the United Arab Emirates. There is no adequacy decision of the European Commission for that country.

What we process about you is necessary to carry out the agreement with you, and that is the ground on which your data may be with us (Article 49(1)(b) GDPR). If you do not want that, you do not use the app and nothing of yours is processed.

Cookies and what stays in your browser

One cookie to keep you signed in, for a week, renewing itself while you use the app. Sign out and it is gone.

During signing in, briefly a second cookie of ten minutes that checks the sign-in really belongs to your own tap.

A few small things stay in the browser itself: your language, whether you have seen the intro cards, and a referral code if you arrived through somebody’s link. They never leave your device.

There are no cookies for advertising or statistics, ours or anybody else’s.

How long it is kept

As long as your account exists. Delete it and your data is out of the app at once.

One exception: if you share a book with others, the entries you shared with them stay in that book, without pointing at you any more. Otherwise your housemates’ book would no longer add up. The same goes for a shared book you left earlier. What you had put under Private does go.

The copies take longer: there is a nightly copy on a computer at home and an encrypted copy at Cloudflare R2. The daily copies are gone within about two weeks, and photographs only leave the copies once no kept night still knows them.

A payment is kept as a financial record, without pointing at you any more.

What you can do yourself

Take everything with you: the Ik tab has a button that hands you everything the app holds about you as a file.

Erase everything: the menu behind your profile picture holds Delete account. You type your own name over, and it is gone.

Correction or objection: get in touch and we will do it by hand.

Security

Everything travels over https. Passwords are stored with scrypt. The copy outside the house is encrypted before it leaves.

The app runs on its own machine, not shared with other services, and the source code is open to read.