Skip to main content

Privacy policy

Last updated: 31 July 2026

The short version: FEN has no servers, and we receive none of your data. Your expenses live on your device and, when you share a group, in storage you provide — encrypted so that only the members of that group can read them.

The rest of this page explains that in detail.

Who this policy is about​

FEN is an app you install and run. There is no FEN service behind it: no account server, no analytics service, no backend operated by the developers of FEN. Nothing in the app sends data to us.

Because there is nothing for us to hold, most of what a privacy policy usually covers — the accounts we keep, the profiles we build, the third parties we share with — does not exist here. What follows describes where your data actually goes, so you can judge it for yourself.

Data we collect​

None.

We operate no server that your app talks to. We have no way to see your name, your expenses, your groups, your contacts, your IP address, or whether you use the app at all.

There is no analytics, no telemetry, no crash reporting, no advertising, and no third-party SDK that phones home. FEN does not track you across apps or websites.

Data FEN stores on your device​

Everything the app knows is kept locally on your device:

  • Your account key. Created on first launch, held in the device's secure storage. It is your identity in FEN; there is no email address or password.
  • Your display name, and any private names you set for friends.
  • Your groups — expenses, splits, settlements, members, categories, exchange rates.
  • Receipt photos you attach.
  • Your friends list and any invites you've sent.
  • Your settings, including your storage backend credentials.
  • A local app log, for troubleshooting, kept only on the device.

Deleting the app deletes all of it.

Data that leaves your device​

Two things leave your device, and only when you make them:

1. Group data, to storage you choose​

To share a group you configure a storage backend — a Nextcloud instance. That storage is yours, or the group owner's. It is never ours.

What gets written there is encrypted on your device before it is uploaded, and can only be decrypted with the group's key, which the storage never receives. The operator of that storage can see:

  • encrypted files, their sizes and timestamps;
  • folder names derived from group identifiers;
  • file names derived from members' public keys.

They cannot see expense amounts, descriptions, balances, receipt images, or the real-world identity of any member. Those identifiers are pseudonymous.

Your relationship with that storage provider is your own, and their handling of the data is governed by their terms, not ours.

An invite link contains the key material needed to join. That material sits in the fragment part of the URL — the part browsers never transmit to a web server — so it is not disclosed by opening the link.

But anyone who has the link can use it until it expires (24 hours). Send invites through a channel you trust.

What FEN does not do​

  • No user accounts, sign-ups, email addresses or passwords.
  • No push notifications, and therefore no push metadata anywhere. Notifications are generated on your device when it syncs.
  • No address-book, contacts or location access.
  • No selling, sharing or disclosure of personal data — we hold none to sell.

Permissions the app asks for​

  • Camera and photo library — only to attach receipt photos to expenses. Photos are downscaled on your device and their embedded metadata, including any location, is stripped before they are encrypted and stored.
  • Background app refresh — to sync opportunistically. It moves the same encrypted data to the same storage you configured.
  • Access to a folder you pick — only the folder you choose as your local save path, used for closed-group archives and your key backup.

Local backups​

If you enable Back up encryption keys, FEN writes your keys to your chosen folder unencrypted. Anyone with access to that folder can read your groups. Closed-group archives in that folder can be password-encrypted separately with Encrypt exports. See Local store and backup.

If that folder is itself synced to a cloud service, your data goes wherever that service takes it — under that provider's policy, not this one.

Your data rights​

Because your data is in your hands rather than ours, these are things you do, not things you request from us:

Access / portabilityExport a group's expenses to CSV from ⋮ › Export expenses. Closed groups are archived in full to your save folder.
Erasure (your device)Delete the app, or delete the group.
Erasure (shared storage)The group owner deletes the group's data from their own backend. Other members keep their local copies until they delete them.
RectificationEdit or delete any expense in the app, subject to the group's edit-permission setting.

One honest caveat: a group is a shared history replicated across the members' devices. Removing your own copy does not remove the copies other members hold, any more than deleting your messages removes them from other people's phones. Leaving a group stops you contributing to it; it does not retract what you already contributed.

Children​

FEN is not directed at children and collects no data from anyone, including children.

Changes to this policy​

If this policy changes, the updated version is published on this page with a new date. Since we hold no contact details, there is no way for us to notify you individually — checking this page is the only mechanism.

Contact​

FEN is developed in the open. Questions about privacy, and reports of anything in the app that contradicts this page, can be raised at github.com/mapemono/fen or through the contact route on fenapp.net.