Privacy policy

Who we are

The Pot is an independent product operated by a sole proprietor based in Pennsylvania, United States. It is not a company, and there is no team behind it beyond the two people who built it. For anything in this policy, including a request about your own data, write to hello@usethepot.com.

The part that matters most

Amounts, notes, category names, pot names and display names are encrypted on your device, with a key derived from your password, before anything is sent to us. What our database holds for those fields is ciphertext. We do not have your password, and we have no copy of the key that opens it.

We will not tell you it is impossible for us to read your data, because we serve you the JavaScript that does the encrypting, and a future version of that code could behave differently. Anyone who tells you otherwise about a website is overstating it. What we can say, and what is true today: the app encrypts before it sends, we store what it sends, and we hold no key.

The practical consequence is the one you should plan around: if you forget your password and lose your recovery code, your history is gone. Not gone pending a support request — gone. We cannot recover it for you, and any service that can recover it for you can also read it.

What encryption does not hide

Encrypting the contents of a row does not hide that the row exists. We can see, and a court order could compel, the following:

• Your email address, and when the account was created.
• Which accounts share a pot, and when each joined. The relationship between two people is visible even though nothing they logged is.
• The date of each expense and each no-spend day, and the time each row was created — but not the amount, the note or the category name.
• How many expenses you log and how often — enough to tell an active account from a dormant one, or a busy week from a quiet one.
• Your currency, and your plan and billing status.

This is inherent to the design rather than an oversight: dates are what let the database return the right month without reading a single amount. It is written out here because a policy that said "everything is encrypted" and left this unsaid would be the misleading version.

What you give us

Your account

An email address, and a verifier derived from your password. The password itself never leaves your device; what our authentication provider stores is a hash of a value derived from it, which cannot be turned back into the password. If you sign in with Google, we receive your email address and a Google account identifier, and nothing else — no contacts, no profile beyond that, no access to any other Google service.

What you log in the app

Expenses, notes, categories, budgets, pot names and display names. All encrypted, as above. Dates and counts are not.

Payment

Paid plans are handled by Paddle, which acts as the merchant of record. Your card details go to Paddle and never reach us — we never see, store or process a card number. What we receive back is a subscription status, an amount, and the identifiers needed to keep your plan in sync. Paddle's own privacy notice governs what they collect at checkout.

What you write to us

If you email support, we have your email and whatever you chose to put in it, for as long as it is useful to have.

What is collected automatically

Server logs

Our hosting providers keep ordinary request logs — IP address, timestamp, user agent, the path requested — which is how any website on the internet works and is what makes abuse and outages diagnosable. We do not build profiles from them.

Analytics, on the marketing site only

usethepot.com loads Google Analytics 4, which sets a first-party _ga cookie to count returning visitors. It is not loaded on app.usethepot.com. That split is enforced in two places — the code checks the hostname, and the Content-Security-Policy on the app refuses the script outright — because putting a Google tag on the page where your plaintext lives would make the rest of this document false.

If your browser sends Do Not Track or Global Privacy Control, the tag is not loaded at all and no cookie is set. Advertising signals are switched off; nothing here is used for ads, and there is no advertising on this product.

Fonts

The marketing site loads a display typeface from Google Fonts, which means your browser makes a request to Google and Google sees your IP address. The app itself uses your device's own fonts and makes no such request.

Cookies and what is stored in your browser

• Session token — kept in local storage on the app, so you are not signed out every time you close a tab. Strictly necessary; there is no signed-in product without it.
• Your unlocked key — kept in session storage, for that tab only, so a page refresh does not ask for your password again. It is discarded when the tab closes. It never reaches us.
• _ga — analytics, marketing site only, described above.

Who else touches your data

We use as few providers as the product can be built with. They are:

• Supabase — the database, authentication and the emails that carry sign-in and password-reset links. Holds the ciphertext and the metadata described above.
• Vercel — hosting and delivery of the site and the app. Sees request logs.
• Paddle — payments, as merchant of record. Sees your billing details; we do not.
• Google — analytics on the marketing site, the display typeface, and sign-in if you choose it.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising — under the CCPA/CPRA meaning of both terms. There is no data broker in this list and there will not be one. We would disclose data if legally compelled, and what could be disclosed is the metadata above, not your spending.

Where your data lives

Our providers operate globally and your data may be processed in the United States and elsewhere. Where personal data moves out of the UK or the EEA, our providers rely on the standard contractual clauses or an equivalent transfer mechanism.

How long we keep it

Your account and its contents stay until you ask us to delete them. When an account is deleted, the rows attached to it are removed, and the encrypted contents become unreadable to anyone including us. Billing records are kept as long as tax and accounting rules require. Server logs are short-lived and controlled by our hosting providers.

Cancelling a paid plan does not delete anything. Extra pots become read-only; your history stays. A budgeting app that ate your records over a failed card would deserve to lose you.

Your rights

Depending on where you live — the UK and EEA under the GDPR, California under the CPRA, and a growing number of other US states — you have the right to know what we hold about you, to get a copy, to have it corrected, to have it deleted, and to object to or restrict some processing. You can exercise any of these by writing to hello@usethepot.com from the address on the account. We do not charge for it and we will not treat you differently for asking.

One honest limitation, which is a consequence of the design rather than a way of avoiding the obligation: a copy of your data from us would be ciphertext, because that is what we hold. The readable version exists only inside your signed-in session, where the key is. For the same reason we cannot correct the contents of an entry on your behalf — you can, and we cannot.

There is not yet a self-serve delete button or data export in the app. Both are planned; until they exist, email us and a person does it.

If you are in the UK or EEA and think we have handled this badly, you can complain to your national data protection authority. We would rather you told us first.

Children

The Pot is not for anyone under 16, and we do not knowingly collect anything from a child. If you believe a child has created an account, write to hello@usethepot.com and we will remove it.

Security

Beyond the encryption described above: access to each row is enforced in the database itself, not in the app, so a bug in the interface cannot show you someone else's pot. Keys are derived with Argon2id and rows are sealed with AES-GCM. Sharing a pot happens through a single-use invite code that carries the key, which is the only reason a second person can read a pot at all.

No system is beyond compromise. What this design changes is the value of compromising it: an attacker who took the whole database would hold ciphertext and dates.

Changes to this policy

If we change how any of this works, we change this page in the same release and move the effective date at the top. For a change that materially affects you, we will email the address on your account rather than relying on you to re-read a web page.

Contact

hello@usethepot.com. One person reads it.