Your data, no secrets.

What we keep

Oumox stores your name, email, a secure derivative of your password, your sessions, groups, notification preferences, technical app installation identifiers, and the expenses, splits, and payments you take part in. Your plain-text password is never stored.

Why we keep it

This data is used only to run your account, calculate balances, preserve shared history, secure access, and deliver the emails and notifications you enable. Group members see other participants’ names, never their email addresses. Oumox does not sell your data or use it for advertising.

Analytics on the public website

On oumox.com, Google Analytics measures visits, pages viewed, clicks to the app, and general browser, device, and approximate location information. A click to the app is not a signup. Oumox does not send it your name, email, or financial data from the app.

Google Analytics is completely blocked until you accept optional analytics cookies. Refusing does not affect Oumox. Your choice is saved in your browser’s local storage; change it using Privacy choices in the oumox.com footer.

New website Analytics cookies are restricted to oumox.com and are not shared with app.oumox.com. Their configured lifetime is 90 days. The visitor cookie (_ga) is not extended on each visit; Google may renew the session-state cookie (_ga_…) while you use the site. Your browser may remove them sooner. Withdrawing consent stops collection and deletes these cookies, but not data already processed by Google. Google Analytics retention is configured to 2 months for event data and 14 months for user data, with the latter period reset on new activity. These limits do not apply to standard aggregated reports. Pending campaign provenance expires separately after 30 minutes. Advertising signals remain disabled, and signups, groups and expenses are not sent to Google Analytics.

Who processes it

The application and its D1 database are hosted by Cloudflare. Transactional emails are sent through Amazon SES, and push notifications are delivered through Apple. These services may process the technical data required for hosting and delivery. Cloudflare hosting logs include approximate location derived from your IP address, request metadata, and execution times. These technical logs support operation and diagnostics, not advertising tracking. Oumox does not request your device’s GPS location.

Campaign measurement

On oumox.com, your choice separately allows Google Analytics and the handoff of three controlled codes (source, campaign, creative) to app.oumox.com. The app asks for its own consent before storing these codes and connecting them to a signup or group. Campaign URLs contain no identity, amount, group identifier or advertising identifier. No Meta Pixel or CAPI is used. Refusing does not limit any feature. Change the website choice in its footer and the app choice in My profile.

Pending provenance expires after 30 minutes in the tab. Measurement links are retained for 90 days, then purged by hourly maintenance after aggregation. Daily totals by code are retained for 24 months without person or group identifiers. Withdrawing consent removes codes still linked to the account and its groups; account deletion also removes its measurement row. Previously aggregated totals can no longer be linked to an account. Creations without provenance are counted as unknown. No amount or expense details are copied into measurement tables.

When you delete your account

Your profile name and email are removed, your sessions and tokens are deleted, and your password is replaced with a random unusable value. Shared transactions remain under “Deleted account” while active members remain, so their balances stay accurate. When the last active member deletes their account, the group and its shared records are deleted from the active database. Older archives with no active members are also deleted through regular maintenance. Shared labels and descriptions may still contain personal information entered by members; contact us to request its removal.

Cloudflare D1 automatically keeps Time Travel restore points for 7 days on the free plan or 30 days on a paid plan. An older version of your information may therefore remain recoverable during that window before disappearing through normal backup rotation. Learn how Time Travel works.

Your choices

You can edit your information, download a JSON export, and delete your account directly from Profile, even with an unsettled balance. For each group you own, you can choose another active member as owner or archive the group in read-only mode. Archiving is the default. Shared history and outstanding balances remain under Deleted account; deleting an account does not settle or cancel a debt.

For a privacy question not covered in the application, write to rupert@oumox.com.