YaplooThis page is public; you don't need to sign in. The policy covers the Yaploo iOS and Android apps, the web app (yaploo-web.vercel.app) and the macOS desktop app.
Data we collect
- Account: an anonymous user ID created when you first open the app, and your display name. If you choose, you can add a backup email address or link your Apple or Google account; the email address and that provider's account ID are then stored. To sign in on another device, a one-time sign-in code is sent to your email.
- Group content: group name, type and your member role (owner, admin, member); tasks, lists, notes, dates, reminder settings and task assignments; expense, debt and payment records (title, amount, currency, exchange rate, split); "Pick Up" items; and the date and location text you enter for event groups.
- Device and session: your device's push notification token and platform, so we can send notifications; your app language; a device-specific key for the home screen widget (only its hash is stored on the server, and it expires after 90 days); and, when you sign in with email, Apple or Google, a session key that keeps you signed in on one device at a time.
Yaploo does not collect bank or card details and does not process payments. It uses no advertising, analytics or tracking tools.
How we use data
Data is used only to provide the app's features: syncing tasks, lists and expenses between group members, sending notifications, recovering your account on another device, and keeping the service secure and running.
Notifications
Reminders are scheduled locally on your device and never reach our servers. Group notifications are sent remotely: when a member adds a task, an expense or debt, or a "Pick Up" item, or taps "I'm on my way", the other members' devices are notified through Expo's push service. These notifications can include the group name, the task or expense title, the expense amount and the display name of the member who added it; Expo delivers them to devices through Apple Push Notification Service and Firebase Cloud Messaging. You can turn notifications off in your device settings at any time.
Home screen widget
If you add the widget, the titles of your pending tasks and the name of your selected group are stored on your device (in the app group storage) so the widget can show them. The widget can read tasks only with its own device key and only from groups you are a member of.
Service providers (processors)
- Supabase: database, authentication, sign-in code emails and real-time sync.
- Expo (650 Industries): delivery of push notifications. The push token and the notification title and text are sent to Expo.
- Apple and Google: delivering notifications to devices; and, only if you choose, signing in and linking your account with Apple or Google.
- Vercel: hosting of the web app and this site.
- Frankfurter (frankfurter.app): exchange rates. The app only asks for a currency and a date; no personal data is sent.
Data is not sold and is not shared for advertising.
Visibility within groups and security
A group's records are visible only to that group's members; other groups cannot see them. You can join a group only with the 6-digit code shared by a group admin. Codes expire after 7 days, and admins can create a new code at any time. Wrong code attempts are rate limited.
Web and desktop apps
The web and desktop apps are read-only companions for viewing the data from your mobile app. You sign in with an email link, Google or Apple and connect to the same account; they collect no additional data.
Device permissions
Notification permission is used for reminders and group notifications. Camera and photo access is requested only when you choose to scan a receipt: the receipt is read on your device (with Apple Vision on iOS and ML Kit on Android), the photo is never sent to any server or stored, and only the amount, store name and date you confirm and save become an expense. The app does not access your location, contacts or microphone.
Retention and deletion
You can permanently delete your account in the app (Group › Delete my account). Groups where you are the only member are deleted with all their content. In groups with other members, ownership passes to another member so the group can continue, and your personal traces are removed; your membership, push token, widget key and personal records are deleted. You can also delete records one by one, leave a group or send a data deletion request.
Your rights
You can ask to access, correct or delete your data. Write to us at the address below.
Children's privacy
Yaploo is not specifically directed at children under 13.