Privacy Policy

HAMU (“HAMU”, “we”, “us”) is currently operated by an individual, not yet a registered company. This policy refers to that operator as “we” for readability. Until a company is incorporated, the responsible party for the purposes of this policy is the individual operating HAMU, contactable at praethu@gmail.com.

This policy explains what personal data HAMU collects, why, how long we keep it, who we share it with, and the rights you have over it. It is written to meet the stricter end of the laws that could apply to you, wherever you are — principally the EU/UK General Data Protection Regulation (GDPR/UK GDPR), the California Consumer Privacy Act as amended by the CPRA, Singapore’s Personal Data Protection Act (PDPA), and comparable laws elsewhere. Where those laws differ, we apply whichever gives you more protection.

1. What HAMU does, in plain terms

HAMU helps groups of people track shared expenses, split bills, plan trips, and settle up. To do that, it necessarily stores who is in a group, what was spent, and how it should be split. This policy exists because that is genuinely sensitive: it can reveal where you went, what you bought, and your relationships with other people.

2. Data we collect

2.1 Account data

• Email address (used to sign in, and for account-related email).
• Display name and, optionally, a handle you choose.
• If you sign in with Google: your name, email address, and profile picture, as supplied by Google. We do not receive your Google password, contacts, or anything else Google holds about you — only the specific fields your consent screen shows.
• A password, if you sign up directly rather than via Google. It is hashed by Supabase Auth; we never see or store it in plain text.
• An avatar you choose or upload, and cosmetic preferences (e.g. your in-app Hamu character, theme, accessibility settings).

2.2 Financial and group data

• Groups and trips you create or join, and their membership.
• Expenses: amount, currency, category, description, date, who paid, and how it is split.
• Settlements between members (amount, method, status).
• Receipt images or PDFs you upload. These are stored in a private file store and are only ever accessible to members of the group the receipt belongs to, via short-lived signed links — never a public URL.
• Invitation links and QR codes you generate to add people to a group.

2.3 Data from receipt scanning (AI processing)

If you use the “scan a receipt” feature, the photo you take is sent to a third-party AI vision model (currently an OpenAI model) to extract line items, totals, and merchant details automatically. This means:

• The receipt image, which may contain a merchant name, location, items purchased, and a timestamp, is transmitted to OpenAI for processing.
• We rely on OpenAI’s API terms, under which API-submitted content is not used to train their models by default and is retained only briefly for abuse monitoring, unless OpenAI’s terms change. We do not control OpenAI’s infrastructure and cannot independently verify their internal handling.
• You can always enter expenses manually instead of scanning a receipt if you would prefer your receipt images never leave HAMU’s own storage.

2.4 Location and place data

If you search for or tag a place (e.g. a restaurant or activity for a trip), that search text is sent to Google Places, to return matching locations. We store only the place’s name and address you chose, never coordinates — tapping a saved location opens Google Maps in a new tab; HAMU does not render its own map. We do not collect your device’s GPS location unless a future feature says so explicitly and asks first.

2.5 Technical and cookie data

• Strictly necessary cookies — used to keep you signed in (session and refresh tokens set by Supabase Auth) and to remember your cookie choice itself. These are set regardless of consent because the service cannot function without them, in line with the exemption most cookie laws provide for strictly necessary cookies.
• Analytics cookies (Google Analytics) — set only if you actively accept them via the cookie banner. See Section 6.
• We do not currently use advertising or cross-site tracking cookies.

3. Why we process your data, and our legal basis

Under GDPR/UK GDPR, each use of your data needs a legal basis. Ours are:

• Contract — account data, group/expense data, and receipt storage, because we cannot provide the expense-splitting service without them.
• Consent — analytics cookies, and Google sign-in data beyond what’s needed for login, are only processed once you actively agree.
• Legitimate interest — basic security logging (e.g. failed sign-in attempts) to keep the service safe, weighed against your right to privacy.
• Legal obligation — where a competent authority lawfully compels disclosure.

4. Who we share data with

We do not sell your personal data, and we do not share it with advertisers. We share data only with:

• Other members of your group — by design. Expenses, settlements, and receipts are visible to people you have chosen to split costs with; that is the point of the app.
• Supabase (database, authentication, and file storage) — our infrastructure provider, acting as our data processor.
• OpenAI — only the specific receipt image you choose to scan, for the sole purpose of extracting its contents. See Section 2.3.
• Google — the place-search text you enter (Google Places), and, if you use Google Sign-In, Google also acts as an identity provider; see Google’s own privacy policy for how they handle your data on their end.
• Google Analytics — only if you consent to analytics cookies. See Section 6.
• Law enforcement or regulators — only when we are legally required to, and we will notify you first unless prohibited by law.

Some of these providers may process data outside your country, including in the United States. Where that involves transferring data out of the EU/UK, we rely on the provider’s Standard Contractual Clauses or an equivalent safeguard.

5. How long we keep your data

• Account data — kept while your account is active, and deleted (or anonymised where deletion would corrupt other members’ shared financial history) within 30 days of account deletion.
• Expenses and settlements — kept as an append-only audit trail for as long as the group exists, because other members rely on that shared history being accurate. Deleting your account removes your personal identifiers from these records where possible, but the transaction history itself may persist for the remaining group members, consistent with how the app is designed to work.
• Receipt images — kept until you or a group admin deletes them, or the associated expense is deleted.
• Analytics data — retained by Google Analytics per Google’s own retention settings, which we configure to the shortest practical window (see Section 6).

6. Google Analytics and cookie consent

HAMU uses Google Analytics to understand how the app is used, in aggregate, so we can improve it. In line with GDPR, UK GDPR, and the ePrivacy Directive:

• The Google Analytics script does not load, and no analytics cookie is set, until you click “Accept” on the cookie banner.
• You can withdraw consent at any time from the “Cookie preferences” link in the footer of every page, which re-opens the banner and lets you turn analytics off.
• We configure Google Analytics with IP anonymisation and the shortest available data-retention setting, and we do not use Google Signals or ads personalisation features.
• Rejecting analytics cookies does not affect your ability to use HAMU. Only strictly necessary cookies (keeping you signed in) are exempt from this choice.

7. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated personal data (“right to erasure”), subject to Section 5’s note on shared financial records.
• Export your data in a portable format (“data portability”).
• Object to or restrict certain processing.
• Withdraw consent at any time (e.g. for analytics cookies), without affecting processing already carried out.
• Lodge a complaint with your local data protection authority — for example, the ICO in the UK, a national supervisory authority in the EU, or Singapore’s PDPC.

To exercise any of these rights, email praethu@gmail.com. We will respond within 30 days, as required by GDPR/UK GDPR, or sooner where a shorter deadline applies under your local law.

8. Children’s privacy

HAMU is not directed at children, and we do not knowingly collect personal data from anyone under the age of 16 (the general threshold under GDPR/UK GDPR; some countries set it as low as 13). Signup does not currently include an age check. If we learn that someone under the relevant age threshold has created an account, we will delete it and the associated personal data. If you believe a child has provided us with personal data, contact praethu@gmail.com and we will act promptly.

9. Security

We rely on Supabase’s infrastructure, which encrypts data in transit (TLS) and at rest, and we enforce row-level security so that a user can only ever read or write data belonging to a group they are actually a member of. Receipt files are held in a private bucket, never a public URL. No system is perfectly secure, and we cannot guarantee absolute security of information transmitted to us.

10. Changes to this policy

If we make a material change to this policy, we will update the “Last updated” date above and, where the change is significant (for example, a new category of data or a new third-party recipient), notify you by email or an in-app notice before the change takes effect.

11. Contact

Questions, requests, or complaints about this policy or your data: praethu@gmail.com.