Privacy

Your email address. It is the only thing you have to give. It is your account, it is where sign-in links are sent, and it is how an invite to a household finds you.

Your date of birth. Asked once, on the way in, and kept with your account. We Both is for people 13 and over, and the date is how that is checked. If the date says you are under 13, nothing is created and nothing is written down — not the account, not the email address, not the date itself.

Your display name and a colour. Whatever you typed when you joined a household. It goes next to your entries so the household can tell who logged what. Any name works — it is never checked against anything.

The money you type in. For an expense: the amount, the category you picked, whether it was cash, debit or credit, the date it was spent, and a note if you wrote one. For income: the amount, the source, the date, and a note. Also the bills you set up (name, expected amount, due day, when it starts, how many instalments) and any repeating income (amount, source, how often, when it next lands). Amounts are stored as whole minor units — 12.34 is kept as 1234, never as a decimal number that can round.

Your household. Its name, its join code, the currency its totals are shown in, and who is in it.

What your calendars put in front of the house. Each calendar carries one choice. Shared or Ours sends the event: its title, when it is, where it is and who is invited. Busy only, which is where a calendar you have not shared starts, sends the times and nothing else: no title, no place, no guests, not even the calendar’s name, so the house can see the hour is taken without seeing what it is. Only me sends nothing at all, and then those events exist nowhere but on your own phone and your own account. You can change any calendar’s choice whenever you like, and one event can be shared on its own without sharing the calendar it is on.

Your timezone. The IANA name your device reports, like Europe/Lisbon. It is stored so an expense logged at 9pm lands on tonight rather than on tomorrow’s UTC date.

Currency detail, only if you spend abroad. The currency you spent in, and what it cost in your household’s currency on that day. If you later enter what your card statement actually charged, that figure is stored too.

What signing in leaves behind. For each sign-in link: your email address, a SHA-256 hash of the token, when it expires, whether it has been used, and where it should land you. For an invite: the token, the address it was sent to if it was sent to one, and when it expires or was accepted.

A token for your phone. A random string your phone sends instead of a cookie, so the app and the iPhone Shortcut can log an expense without signing in again.

Timestamps. When your account was created, when it was last seen, and when each entry was written.

Anything you send through “Ideas and bugs”. What you wrote, whether you marked it an idea or a bug, and which account sent it — otherwise there is no way to reply.

Reports when the app breaks. If the app crashes, freezes or hits an error, it sends us a report so we can fix it: the error message and where in the code it happened, the screen, the app build and the phone’s system version, and the household and member signed in on the phone when the report is sent, if any. It is kept in our database, and the first report of each kind of error in a day is also emailed to us. No crash-reporting company receives it.

A few moments, with your household. So we can see whether a house keeps coming back, the app records, with your household and member once you have one: a notification opened, an onboarding step reached, the app opened from a widget, the week ahead or Month at home opened, the month shared, and bills added from “the bills you always pay”. Each is a kind with a short label (which notification, which step, which screen) or a count, never an amount, a name or anything you wrote. These stay on our server and are not part of the counting you can turn off, described below.

No location. No contacts. No photos. No advertising identifier, no IDFA, no device fingerprint.

No tracking, and no ad networks. Nothing in this app follows you to another app or another website. There is no advertising SDK, no session recorder, no third-party crash reporter and no third-party script. We never sell or share anything with a data broker.

What the app does count. So we can tell which parts of We Both are worth building on, the app records that a feature was used: an expense logged, a chore ticked, a list item checked, a question asked, and how long a screen was open. Those go to PostHog, on servers in the European Union. On a phone set to the EU, the EEA or the UK, nothing is counted until you say yes, and anyone can turn counting off in Settings, under This phone.

They are counts, not content. An event says that an expense was logged, never the amount, the shop, the category or the note. It says a question was asked and whether it was spoken or typed, never the question. No name, no email address, no photo and no figure from your ledger is ever part of one. Nothing in that stream carries your account id or your household id, so it cannot be tied back to your name, your account or your household. PostHog gives each install a random id of its own.

No bank login. We Both never sees your bank password or your card number. A bank is only read if someone in your household connects one, through Plaid, as described in “Bank connections” below.

No third-party cookies. The website sets one cookie of its own, holding your signed account id. It follows you nowhere.

You type your email address and a link is mailed to you. There is no password, so there is nothing to forget and nothing to leak.

Only a SHA-256 hash of that link’s token is stored — never the token itself. A leaked database row therefore cannot be replayed as a login. The link works exactly once and expires in 15 minutes, and redeeming it marks it spent in the same write, so a second attempt does nothing.

After that, the website keeps a cookie holding your account id and an expiry, signed with HMAC-SHA256, for 90 days. The phone app instead trades a single-use code for a long-lived token and keeps it in the iOS Keychain, so the token never appears in a URL or in browser history.

Face ID is a lock on the device rather than a second account, answered by iOS itself: the app is told yes or no and never sees anything biometric.

This is the point of the app, and it is worth being blunt about: entries belong to the household, not to the person who typed them. Anyone in your household sees every expense, every income entry, every note and every bill — including the ones you logged, with your name on them.

People get in by accepting an invite or by using the household’s join code, so treat that code the way you would treat a key. If you want out of a household, write to us at hello@weboth.xyz.

Text that says what you buy and pay is sealed. Shop names, bill names, notes, receipts and the like are encrypted with a key made for your household alone. Someone reading the database sees scrambled text, not “Starbucks”. Amounts stay readable, because the totals are added up in the database.

The team cannot look at your house on its own. We can only look if someone in your household turns on Support access in Settings. It lasts 24 hours, anyone in the house can stop it sooner, and every look is listed there with what was looked at, by whom and when.

The assistant. To answer you, it sends what it needs to Anthropic, which does not train on it (see below).

Seven companies are involved in running this (an eighth, Plaid, only if you connect a bank), and none of them are advertisers. Nothing is sold, and nothing is shared for advertising or with data brokers — there is no arrangement of that kind and no code that could carry one out.

Neon hosts the Postgres database. Everything listed above lives there.

Vercel hosts the site and the API. Like any web host it keeps ordinary request logs — IP address, URL, timestamp. It also counts visits to the public landing page, so it is possible to tell whether anyone arrives and from where. That counter is cookieless and aggregate — no identifier follows you between pages, and it is not loaded on any signed-in screen at all, so nothing about your money is ever in its view.

RevenueCat keeps track of whether a household is subscribed. It is told an identifier for the household and what Apple says about the purchase; the payment itself is Apple’s, and neither we nor RevenueCat ever see a card.

Resend delivers the sign-in and invite emails, and the error reports emailed to us. It receives the address being written to and the contents of that message, and nothing else.

Frankfurter, which publishes European Central Bank reference rates, is asked for an exchange rate — and only when you log an expense in a currency other than your household’s. The request contains a currency pair and a date. Not the amount, not your account, nothing that identifies you or your household.

Anthropic runs the model behind the household assistant, and only when you use it. What you say or type to the assistant is sent there, with enough of the house to answer: who is in it, the categories, the shopping lists, open chores, bills due this week, today’s shared events and the memories you chose to keep. If you connect a mailbox, the receipts and subscription emails it reads to find recurring charges go the same way. When you tap Generate memory on the Memory screen, the titles, dates, times and places of events in the calendars on your phone go the same way too, so it can find trips and birthdays worth remembering: the events themselves are never stored, only the ones you choose to keep. A calendar connected to We Both directly through Google or Outlook is not part of that read. Anthropic does not train on any of it. Nothing is sent until you ask something or tap Generate memory, and the app says so before either, the first time.

OpenAI (ChatGPT), only if you connect We Both to ChatGPT yourself, by signing in and pressing Allow. Then, when you ask ChatGPT about your house, it is sent what that question needs: who is in the house, the categories, bills and what has been paid, spending and what is left this month, recent expenses with their notes and places, open chores, the shopping lists and what is shared on the calendar. What you tell it to add (spending, money in, a paid bill, list items, chores) is written to your house like anything you add in the app. Memory and your mailbox are never sent. What ChatGPT keeps of your conversation follows OpenAI’s privacy policy and your ChatGPT settings. Disconnect it any time in ChatGPT or on Connected apps, which ends its access at once.

ElevenLabs gives the assistant its voice, and only when you talk to it. With your permission, what you say while holding the button is recorded and sent to ElevenLabs to be written down, and the assistant’s replies are sent to ElevenLabs to be read aloud. The recordings are not kept by We Both. ElevenLabs keeps a record of each request in our account with them, under their own terms: the option to keep nothing is offered only to their enterprise customers, and We Both is not one yet. We Both has opted out of ElevenLabs using this data to train its models.

A database can be read by whoever runs it, and honesty is better than a claim that cannot be verified: the admin screen actually used to keep this thing alive shows counts, household names and feedback — not your entries.

Everything travels encrypted. Your phone, this website and the API behind them talk to each other only over HTTPS, so anything moving between them is encrypted in transit. The database itself only accepts encrypted connections too.

Everything is encrypted at rest. Neon, which hosts the Postgres database, encrypts all of it with AES-256. Vercel, which hosts the site and the API, encrypts what it stores the same way.

Mailbox tokens are sealed on top of that. If you connect a Google or Microsoft account, the OAuth token that lets We Both read it is encrypted a second time before it is written down, with its own key that lives only in the server’s environment, never in the database. A copy of the database on its own cannot open anyone’s mailbox.

Access is limited to your household. Every request the app answers is checked against the household making it, in the one place in the code that every other query has to go through. There is no way to read or write another household’s entries, calendars or mailbox, by mistake or by asking.

Receipts do not last. A receipt photo is deleted 30 days after you attach it to an expense. The numbers already read off it stay on the expense, but the photo itself is gone. A photo shared to the app and never turned into an expense is deleted after 7 days.

Disconnecting removes the token. Disconnecting a Google or Microsoft account deletes its stored token from our database. For Google, the same action also revokes the token with Google, so it stops working there too, not only here.

What happens when you delete your account is covered below, in “How long it is kept, and deleting it”.

This section says, in one place, exactly what We Both takes from a connected Google account and what it does with it.

What we access. If you connect a Google Calendar, We Both reads and writes events on it, the same as it does with an iPhone calendar. Per the choice you made for that calendar (see “What is stored”, above), that can be a full event, just the busy time, or nothing at all. If you connect a Gmail account, which is optional and separate from the calendar, We Both reads messages in it to find bills, receipts, subscriptions and trips. It never sends email from your Gmail: when you ask it to try cancelling a bill, it writes the letter and opens it in your own mail app, and you send it yourself.

How it is used. Calendar events are shown on the House tab the way you chose to share them. A repeating one, like a class or a shift, is noticed on your own phone by comparing events already on it, a comparison that runs on the device and is never sent anywhere. A Google Calendar connected this way is also not one of the calendars read to find trips and birthdays: only the calendars already on your phone are. Mail is read to find recurring charges, receipts and trips, as described in “Who else touches it”, above, and for nothing else.

Limited Use. We Both’s use and transfer of information received from Google APIs, raw or derived, including Google Workspace APIs such as Gmail and Google Calendar, will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI and Google data. Anthropic and ElevenLabs, both named above, are the only AI or ML services We Both uses, and they are used only to provide the features described on this page: answering what you ask the household assistant, writing down what you say to it and reading its replies aloud, reading a receipt you photograph, finding bills, subscriptions and trips in a mailbox you connected, and finding trips and birthdays in the calendars on your phone. A Google Calendar connected to We Both directly is not part of that last one. Google data that reaches either of them, such as a shared calendar event’s title and time in the assistant’s own context, a bill found in an email, or a reply read aloud that mentions one, is never used to develop, improve or train generalised AI or ML models. It is not sold, not used for advertising, and not transferred anywhere except as needed to provide those features. Anthropic’s own terms for this API state that it does not train its models on that content, and We Both has opted out of ElevenLabs using it to train theirs.

Connecting a bank is optional. It is offered in the United States, on Premium, and only someone in your household can turn it on, for a bank of their own.

Plaid connects it. You sign in to your bank inside Plaid’s screen, so your bank password goes to your bank and to Plaid, never to us. Plaid’s handling of your data is described in its End User Privacy Policy.

What we read. The accounts you choose in Plaid’s screen (their names, type and last 4 digits) and their posted charges and deposits: amount, date, the bank’s description and the shop’s name. We only read. We cannot move money, pay anyone or change anything at your bank. Charges from before the day you connect are not added to your ledger: the six months before it are read once, only to find subscriptions and pay, and they are not kept. A subscription it finds becomes a bill; pay it finds changes nothing until someone in your household keeps it.

What we keep. Amounts and dates. The bank’s descriptions, shop names, account names and last 4 digits are encrypted with your household’s own key before they are written down, and so is the token that lets us read the bank, which never leaves our server. Plaid’s own identifiers are kept only as one-way fingerprints.

What it is for. Logging the charges nobody logged, and confirming the ones someone already did, so nothing is counted twice. The people in your household see what a connected bank logs, like everything else in Money. It is not sold, not used for advertising and not shared with anyone else.

Notifications never carry an amount. A question about a bank charge names the shop or the bank, never the figure, because a notification passes through Apple and Expo before it reaches your phone.

Stopping it. Disconnect a bank in the app, under Banks: we remove the connection at Plaid and delete the raw bank data, and what it already logged stays in your ledger unless you choose to delete that too. If you withdraw access at Plaid or at your bank instead, everything that bank brought in is deleted. Deleting your account disconnects your banks.

Your account and your entries are kept until you ask for them to be deleted. Sign-in links are pruned a day after they expire, spent or not.

You can delete your account yourself, in the app. Settings, then Delete my account, on the phone or on the website. It happens the moment you confirm it. If you were the only person in your household, the household goes with you and so does everything in it. If you share one, the entries you logged stay in it under the name “Former member”, so the other person’s totals and bills are unchanged, while your sign-in, your phone token, your devices, your calendars and your notification settings are all removed. Your email address is replaced with an unreachable placeholder and cannot be recovered.

Step by step: Delete your account.

You can also email rithellyenzo@gmail.com from the address you signed up with and ask, if you would rather it were done by hand — within 30 days, and in practice the same week.

You can also ask for a copy of everything stored about you, at the same address.

If what is stored changes, this page changes and the date at the top moves with it. That date is the notice — there is no mailing list.

Questions about any of the above: rithellyenzo@gmail.com. There is also a support page.