PRIVACY & SECURITY

Your shared money should stay shared only with the right people.

Balow is designed around private groups, minimal public data, and clear controls for export and deletion.

Product summary · updated August 20, 2026

Private by default

Group records, receipts, attachments, notifications, and payment requests require an authenticated member and database row-level access checks.

Receipt privacy

New personal receipt originals stay in this browser by default. Balow uploads a copy only when you explicitly share or back it up, or when you consent to configured cloud OCR. Existing shared group receipts remain in private storage behind short-lived signed links.

Location is explicit

Balow records whether a place came from a printed address, merchant match, device permission, or manual entry. Device location is requested only after you press the permission button. Linking a personal place to a shared trip or group event explicitly shares that place with its readers.

Data we store

Account details, group membership, expenses, receipt metadata, splits, balances, payment handles you add, and activity needed to operate the product. Local-only receipt originals are not included in Balow account exports.

Public links are deliberate

Invitation and balance links use unguessable tokens. Balance links contain a read-only snapshot, expire after seven days, and do not expose a live group.

Export

Signed-in users can download their profile, personal receipt metadata, and the group records they are allowed to access in a portable JSON file.

Deletion

Personal receipt deletion has a 10-second undo before its local original is purged. Account deletion removes group access and personal profile/payment details; shared financial history keeps an anonymized label so other people’s balances remain understandable.

Operational safeguards

  • Amounts use integer cents to prevent floating-point balance errors.
  • Private storage uses membership policies and time-limited access links.
  • Database actions verify the signed-in user and the required group role.
  • Cloud OCR requires a provider-specific disclosure and consent record; Balow deletes its temporary upload after processing, while provider handling follows the configured provider terms.
  • The browser map key is observable and must be restricted to Balow origins; server geocoding remains disabled without credentials, quotas, and a monetary ceiling.
  • Archived groups are read-only at both the interface and database layers.
  • Passwords are handled by Supabase Auth and are never stored by Balow application tables.
  • Server-only secrets are not shipped to the browser.

This page is a plain-language product summary, not a substitute for a jurisdiction-specific legal privacy policy. A formal legal review remains part of launch readiness.