Privacy policy

Eider is a shared-expense app for couples, roommates, and small households. You create a shared space - your nest - agree on how to split costs, add expenses against that rule, watch a running balance, and settle up directly with each other. This Privacy Policy explains what information Eider collects, how we use it, who we share it with, and the choices you have.

This policy applies to the Eider mobile apps, the Eider website, and related services. By using Eider, you agree to the practices described here. If you do not agree, please do not use Eider.

We collect the information you give us to run your nest, plus a small amount of technical information needed to operate the app securely. We aim to collect only what Eider needs to work.

When you create an account, we collect:

• Your name and email address, and a password if you sign up with one (passwords are stored only as a salted hash, never in readable form).
• If you sign in with Google, the basic profile information Google shares with us - your name, email address, and profile picture.
• Optional profile details you add, such as a display name, profile photo, language preference, and your public Venmo username (used to prefill settle-up payments).
• Verification and sign-in codes we send to confirm it's you.
• If you buy or are given Eider Plus, a record of your membership, such as how you got it, its status, and its dates.

To run a shared ledger, we store:

• Your nest's name and settings, including the split rule that decides who pays what.
• Membership details - who belongs to a nest and their role.
• Email addresses you enter to invite someone, and the name you give an as-yet-unregistered partner so the app can show their share before they join.

The core of Eider is the expenses you record. For each one we store:

• The amount, date, merchant or payee, category, and any title or notes you add.
• How the expense is split between members, and who paid.
• Settle-up records - the amount, who paid whom, the method you noted, and when - along with a history of changes that keeps the ledger accurate.

To keep the app secure and deliver notifications, we collect:

• Your IP address and browser or device type, recorded with each sign-in session.
• Session identifiers that keep you signed in.
• If you enable push notifications, a device push token plus your device's platform and name, so we can deliver alerts to the right device.
• Crash and error diagnostics. When something goes wrong, the app sends us an automatic report with the error, the app version, your device or browser type, a random per-install id, and, if you are signed in, your Eider account id, so we can tell whose account ran into the problem. We filter out other personal details (names, email addresses, and your expense amounts and merchants) before the report leaves your device.
• Product-usage events, so we can see which parts of Eider people actually use. These record that something happened - you added an expense, settled up, invited someone - along with plain counts such as how many people are in a nest. They never carry an amount, a merchant, a description, or anyone's name or email address.
• Performance timings from our servers. To find and fix slow app opens, we record how long our servers take to answer the requests that load your home screen, and how long each step of that work took, along with the app version. These timings carry no name, email address, account id, or anything about your expenses.
• Masked session recordings. On the website and in the apps, we record how the screen was laid out, its headings, labels, and buttons, and where you tapped, so we can see where people get stuck. Amounts, merchants, descriptions, the names of people and nests, email addresses, and anything you type are hidden before a recording leaves your device, and images such as receipt photos and profile pictures are left out, so none of those are in them. What we get back is the screen as the app drew it, with your information blanked out, and the path you took through it.

If you begin adding an expense and don't finish, we temporarily save your in-progress entries so you can pick up where you left off. These drafts expire automatically.

If you connect a bank or card account, Eider imports the charges on it so your spending is in one place, and so a charge can be added to a nest or linked to an expense already in one. Connecting an account is optional, and Eider works fully without it.

You connect the account through Plaid, a financial-data provider. You enter your online banking credentials with Plaid, never with Eider, and we never see or store them. Plaid returns a connection token that we use to read that account's transactions and its basic details, such as the institution, the account type, and the last four digits. What Plaid collects when you connect is covered by Plaid's own privacy policy at plaid.com/legal.

We keep our own copy of the charges we import, rather than fetching them from your bank each time you open the app. That copy is what the app searches, filters, and charts, and it is how Eider tells which charges are new. When you first connect an account, we ask for up to 24 months of past charges, so your history is there from the start. For each connected account we store:

• The institution's name, the bank's own name for the account, the account type such as checking or credit card, the card brand where there is one, the last four digits of the account number, and the identifier Plaid uses to recognize the account.
• For each charge: the amount, the currency, the date, the description your bank sends, the tidied-up merchant name, and the category.
• Whether a charge is still pending at your bank, and whether it has been added to a nest or linked to an expense in one.
• The state of the connection itself, including when charges last arrived and whether it needs you to sign in to your bank again.

We ask Plaid for your transactions and the basic details of the account itself. We do not store your account balance, and we never request your full account or routing numbers, your identity records, or any income or liability information. Eider cannot move money through the connection.

The charge details, including the merchant name and category, are stored in readable form in our database, because searching, filtering, and charting your spending run against them directly. They are covered by the protections described in How we protect your information, and by access controls that scope every read of them to you.

When you scan a receipt, we keep a copy of it and the details we read from it, and use them to fill in the expense and to run the receipt features you use. Scanning a receipt is optional, and Eider works fully without it.

We use your information to provide and improve Eider:

• To run your nest - record expenses, apply your split rule, keep the running balance, and help you settle up.
• To show shared activity to the members of your nest.
• To send the notifications you've enabled, such as when a member adds an expense or records a settle-up.
• To authenticate you and keep your account secure.
• To provide automated features, such as reading the receipts you scan.
• To import charges from a bank or card account you connect, show them to you privately, add the ones you choose to a nest as expenses, and link a charge to an expense already in a nest when the two are the same purchase.
• To operate, maintain, troubleshoot, and improve the app, and to comply with our legal obligations.

When you scan a receipt, we may keep details from it in a form that doesn't identify you, and use them to improve Eider for everyone. They never include personal information, and we will not try to identify anyone from them.

To recognize items, we may look up item names printed on a receipt in outside product databases. We never send anything about you.

We don't sell your personal information. We share it only in the limited ways described below.

Eider is a shared ledger, so your activity in a nest is visible to the other members of that nest. This includes the expenses you add, how they're split, the running balance, settle-up records, your display name and profile photo, and the Venmo username you choose to share for payments. Only share a nest with people you trust with this information.

Charges imported from an account you connect are private to you. Nobody else in your nests can see them, however many nests you belong to. A charge reaches a nest's activity, balance, or totals only when it is added to that nest or linked to an expense already in it.

A charge you add to a nest becomes an ordinary expense in that nest, and the other members see its amount, date, merchant name (or the description your bank sent when there is no merchant name), category, and anything you add to it. A charge can also be linked to an expense already in a nest, by you or automatically, and that expense can then take the charge's amount. Either way, the other members can see that the expense was added or linked through an account you connected, and which account paid for it, shown as your name with the card brand or account type, such as "Alex's VISA".

They do not see the last four digits of your account number, the name you gave the account, your balance, or any charge that has not been added to that nest or linked to an expense in it.

We rely on trusted companies to run Eider. They may process your information only to provide services to us, under contracts that limit how they use it. These include:

• Cloud hosting and database providers that store and serve the app's data.
• Authentication and sign-in providers, including Google when you choose Google sign-in.
• Push-notification delivery services, when you enable notifications. A delivery service passes each notification to Apple's or Google's operating-system push system, so it receives the notification's text along with your device's push token.
• An email provider that sends account and verification emails.
• A crash-, error- and performance-diagnostics provider that receives the automatic error reports and server timings described above, so we can find and fix problems.
• A product-analytics provider that receives the usage events and the masked session recordings described above, so we can see which features are used and where people get stuck.
• Plaid, when you choose to connect a bank or card account. You sign in to your bank with Plaid rather than with us, and Plaid passes us that account's transactions. Plaid's handling of your information is governed by its own privacy policy at plaid.com/legal.
• Stripe, when you subscribe to Eider Plus on the web. You enter your card details with Stripe rather than with us, and Stripe processes the payment, calculates any sales tax, and sends your receipts. We share your email address and an Eider account identifier so the subscription reaches the right account, and Stripe tells us the subscription's status and renewal dates, never your card number. Stripe's handling of your information is governed by its own privacy policy at stripe.com/privacy.
• Apple or Google, when you buy Eider Plus in the iPhone or Android app. You pay through the App Store or Google Play rather than through us, and the store processes the payment under its own terms. We give the store an identifier for your Eider account so the membership reaches the right account, and the store tells us the membership's status and renewal dates, never your card number. Each store's handling of your information is governed by its own privacy policy, at apple.com/legal/privacy for Apple and policies.google.com/privacy for Google.
• An AI provider that helps us tell whether a charge from an account you connect and an expense already in a nest are the same purchase. It receives only how each one describes the purchase, such as the business name, and nothing else about you, your nest, or your accounts.
• An AI provider that reads the receipts you scan. It receives only the receipt itself, and nothing else about you, your nest, or your accounts.

Eider does not move money. When you settle up, we open your chosen payment app - such as Venmo - with the amount and a note prefilled, using the public username you provided. The payment itself happens in that app under its own terms; Eider never sees your payment credentials or transfers funds.

We may disclose information if required by law, to respond to lawful requests, to enforce our terms, or to protect the rights, safety, and security of our users, the public, or Eider. If Eider is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We use technical and organizational measures designed to protect your information. Traffic between your device and Eider is encrypted in transit with TLS, the connection to our database is encrypted, and our database provider encrypts stored data at rest. No method of transmission or storage is ever completely secure, but we work to protect your information and to limit who can access it.

On top of that:

• Where we store the last four digits of an account number, or the standing credential that keeps a connected account importing, we add a second layer of authenticated encryption (AES-256-GCM) on top of the database's own, with the key held outside the database.
• Account passwords are stored only as salted hashes; we never store them in readable form.
• Sessions use secure, signed, HTTP-only cookies, and sign-in is validated on our servers.
• Eider never collects or stores your payment-card numbers. You pay through Stripe on the web, or through Apple or Google in the apps, and your card number stays with them. We never see it.
• Your online banking credentials are never sent to Eider. You enter them with Plaid, and we receive only a connection token, which we use to read that account's transactions and its basic details.

We keep your information for as long as your account is active and as needed to provide Eider, resolve disputes, and meet our legal obligations. Some specifics:

Your nest data - expenses, splits, settle-ups, and settings - is retained so your shared history and running balance stay accurate over time.

If you leave or are removed from a nest, your membership ends, but the expenses and settle-ups you recorded remain part of that nest's shared history so the remaining members keep an accurate ledger. Your name may appear as a former member on those past entries.

You can delete your account from Settings, or by emailing support@eider.app. Deletion has a seven-day grace period: your account is deactivated straight away, and signing back in during those seven days restores it. After that we remove the associated personal information - keeping only what we must to meet our legal obligations, and the shared nest history that other members still need, as described above. A subscription you bought on the Eider website ends when the deletion becomes permanent, with no refund. A subscription you bought through an app store is billed by that store, so cancel it there: deleting your account does not.

How to delete your account

Notification records are kept so your history and unread counts stay consistent across your devices, and are removed only through our normal data-cleanup processes.

A receipt saved on an expense stays with that expense, as part of the nest's shared history. The copy of a receipt you scan but don't save is removed automatically.

Receipt details we keep in a form that doesn't identify you stay after you delete a receipt or your account, because they are no longer linked to you.

Imported charges are kept for as long as you keep the connection, so your own record of your spending does not shrink over time. You can turn an account's import off at any time, which stops new charges from arriving and leaves the ones already imported in place.

Disconnecting an account stops new charges from arriving straight away, and we release our access to that account with Plaid. The charges already imported stay on your private list, and any expense you have already added to a nest stays on that nest's ledger.

Deleting your Eider account removes your imported charges outright. Expenses you added to a nest remain part of that nest's shared history, as described above.

You have choices about your information. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA.

You can request a copy of the personal information we hold about you from Settings. We prepare the file and email you a download link, which stays valid for seven days. You can also email support@eider.app if you'd rather we handle it.

You can delete your account from Settings, or ask us to delete your personal information by emailing support@eider.app. Some shared nest history may remain with the other members, as described in How long we keep your information.

You can edit your profile and your own expenses directly in the app. If you can't change something yourself, contact us and we'll help.

You can turn push notifications on or off in the app or in your device settings. We may still send essential account and security messages.

If you are in the European Economic Area or the United Kingdom, you may have rights to access, correct, delete, restrict, or object to our processing of your personal data, and to data portability. Our legal basis for processing is generally the performance of our contract with you, your consent, or our legitimate interests in operating and securing the app.

If you are a California resident, you may have rights to know what personal information we collect, to request its deletion, and not to be discriminated against for exercising your rights. We do not sell your personal information. To exercise any of these rights, contact us at support@eider.app; we will verify your request and respond as required by law.

Eider is for adults. You must be at least 18 years old (or the age of majority where you live, if that's higher) to use it, and we do not knowingly collect personal information from anyone under that age. If you believe someone underage has provided us information, contact us and we will delete it.

Eider is operated from the United States, and your information is processed and stored there. If you access Eider from outside the United States, you understand that your information will be transferred to and processed in the United States, where data-protection laws may differ from those in your country.

We may update this Privacy Policy from time to time. When we make material changes, we'll update the date above and, where appropriate, notify you in the app. Your continued use of Eider after an update means you accept the revised policy.

Questions about this policy or your information? Email us at support@eider.app.

Eider is operated by Loftery LLC, 1500 N Grant St, Ste R, Denver, CO 80203, USA.