Privacy Policy Draft

Summary

Cardsemble is a household credit card and transaction tracking application. This document describes the data practices of the application and its backend services as they exist in the current implementation.

Information we collect

Account information

• Google OAuth sign-in: When you sign in using your Google account, the application receives your Google user ID (email), display name, and profile picture. This data is stored in the Supabase profiles table.
• Household membership: If you join a household via an invite code, your user ID and role (owner or member) are stored in the household_members table.
• Device tokens: On Android, if you enable Google Wallet capture, a per-device token (SHA-256 hash of the actual token) is stored in Supabase's device_tokens table. A device label (e.g., "Pixel 8") is also stored. On iOS, a token from an iPhone Shortcut is stored under the same model.
• Optional card display names: You may give friendly names to linked credit cards (e.g., "Chase Sapphire" instead of the Plaid-generated name). These are stored in the plaid_credit_accounts.display_name column.

Financial transaction data

• Plaid transactions: When you connect a credit card via Plaid, transaction data is fetched from Plaid's API and stored in Supabase's plaid_transactions table. Fields include: transaction ID, amount, currency, date, merchant name, transaction type, account ID, currency code, pending status, and source (paid or card_event).
• Card events: On Android, captured Google Wallet payment notifications are stored as card events. On iOS, events are submitted via an iPhone Shortcut. Each event includes: amount, currency, merchant, date, and a label describing the card used. Events are stored in the card_events table.
• Reconciliations: Card events may be matched to Plaid transactions by amount, merchant, and date. Reconciliation status and other metadata are stored in the card_event_reconciliations table.
• Credit accounts: Metadata about each linked credit account (institution name, last 4 digits, account type, display name, credit limit, current balance, statement details) is stored in the plaid_credit_accounts table.

Household sharing

• The application supports a household model where one user is the owner and others are members. Household membership is stored in household_members.
• Transaction assignments and visibility are per-row flags assigned to individual transactions.
• However, all transaction, assignment, and household queries remain scoped to the authenticated user's Supabase user ID. There is no cross-user data sharing from a member's view unless explicitly configured.

How we use your data

• To display your transaction ledger and spending summaries.
• To let you assign transactions to household members and split charges.
• To compute monthly totals by card and by person.
• To reconcile captured card events with Plaid transactions.
• To provide Plaid-powered bank account sync.
• To send you app-related notifications (e.g., about sync status or device configuration).

Third-party services

Plaid

Bank account connections are handled entirely through Plaid. When you link a card:

• Plaid Link runs in your browser or mobile app in a secure sandbox.
• Your bank credentials are never seen by Cardsemble; they are entered directly into Plaid's interface.
• Plaid returns a short-lived public token, which Cardsemble exchanges for a Plaid access token.
• The access token is stored encrypted within Supabase. The app never reads the raw token.
• Plaid syncs transactions on a daily cursor-based schedule.
• Per-item sync errors are recorded and the sync continues for other items.

Plaid's own privacy practices are governed by Plaid's privacy policy, which is available at plaid.com/legal.

Supabase

All application data is stored in a Supabase Postgres database. Supabase provides:

• Authentication via Google OAuth.
• Row-level security (RLS) policies that ensure each user can only read their own data.
• Edge Functions that serve the API and authenticate requests via Supabase sessions or device-token hashes.
• Storage of encrypted secrets (API URLs, device tokens) in the Android Keystore.

Supabase's privacy practices are governed by their privacy policy, available at supabase.com/privacy.

Data retention

[VERIFY: data retention period for transactions, card events, household memberships, and device tokens. The Supabase schema defines tables with creation timestamps and optional revocation/deletion columns (e.g., revoked_at on device_tokens), but the documented retention policy is not yet in place. Please verify with the team before publishing.]

Your rights

• You may sign out of the application at any time from the app settings.
• You may request account deletion from the app settings. This removes your user record and cascading deletes for your transactions, assignments, Plaid items, and device tokens.
• You may edit or delete custom card display names from the app.
• You may revoke Google account access from the Supabase dashboard or the application.

Changes to this privacy policy

We may update this privacy policy from time to time. We will post any changes on this page and update the "Last reviewed" date.