Skip to main content

Privacy policy

Last updated: 7 August 2026

The short version: FEN has no servers, and we receive none of your data. Your expenses live on your device and, when you share a group, in storage you provide — encrypted so only that group's members can read them. The rest of this page is the detail.

Who this policy is about​

FEN is an app you install and run. There is no FEN service behind it — no account server, no analytics, no backend operated by its developers — and nothing in the app sends data to us.

So most of what a privacy policy usually covers (the accounts we keep, the profiles we build, the third parties we share with) does not exist here. What follows is where your data actually goes, so you can judge it yourself.

Data we collect​

None.

We operate no server that your app talks to. We have no way to see your name, your expenses, your groups, your contacts, your IP address, or whether you use the app at all.

There is no analytics, no telemetry, no crash reporting, no advertising, and no third-party SDK that phones home. FEN does not track you across apps or websites.

Data FEN stores on your device​

Everything the app knows is kept locally on your device:

  • Your account key. Created on first launch, held in the device's secure storage. It is your identity in FEN; there is no email address or password.
  • Your display name, and any private names you set for friends.
  • Your groups — expenses, splits, settlements, members, categories, exchange rates.
  • Receipt photos you attach.
  • Your friends list and any invites you've sent.
  • Your settings, including your storage backend credentials.
  • A local app log, for troubleshooting, kept only on the device.

Deleting the app deletes all of it.

Data that leaves your device​

Two things leave your device, and only when you make them:

1. Group data, to storage you choose​

To share a group you configure a storage backend — a Nextcloud instance. That storage is yours, or the group owner's. It is never ours.

What gets written there is encrypted on your device before it is uploaded, and can only be decrypted with the group's key, which the storage never receives. The operator of that storage can see:

  • encrypted files, their sizes and timestamps;
  • folder names derived from group identifiers;
  • file names derived from members' public keys.

They cannot see expense amounts, descriptions, balances, receipt images, or the real-world identity of any member. Those identifiers are pseudonymous.

Your relationship with that storage provider is your own, and their handling of the data is governed by their terms, not ours.

An invite link contains the key material needed to join. That material sits in the fragment part of the URL — the part browsers never transmit to a web server — so it is not disclosed by opening the link.

But anyone who has the link can use it until it expires (24 hours). Send invites through a channel you trust.

What FEN does not do​

  • No user accounts, sign-ups, email addresses or passwords.
  • No push notifications, and therefore no push metadata anywhere. Notifications are generated on your device when it syncs.
  • No address-book, contacts or location access.
  • No selling, sharing or disclosure of personal data — we hold none to sell.

Permissions the app asks for​

  • Camera and photo library — only to attach receipt photos to expenses. Photos are downscaled on your device and their embedded metadata, including any location, is stripped before they are encrypted and stored.
  • Files you pick — a receipt can also be attached from the file system (an emailed PDF, say). Only the single file you choose is read, and it is encrypted on your device like everything else.
  • Background app refresh — to sync opportunistically. It moves the same encrypted data to the same storage you configured.
  • Access to a folder you pick — only the folder you choose as your local save path, used for closed-group archives and your key backup.

Local backups​

Once you set a saving folder, FEN backs your keys up into it and archives closed groups there. That backup is what recovers your account if you lose the device, so it is on by default — see Backup & recovery.

Set a folder password and both are encrypted before they are written. Skip it and the keys are written unencrypted: anyone with access to that folder can read your groups. Since the folder that best survives a lost phone is a cloud-synced one, that password is what keeps the provider out — and whatever you put there travels under their policy, not this one.

Your data rights​

Because your data is in your hands rather than ours, these are things you do, not things you request from us:

Access / portabilityExport a group's expenses to CSV from ⋮ › Export expenses. Closed groups are archived in full to your save folder.
Erasure (your device)Delete the app, or delete the group.
Erasure (shared storage)The group owner deletes the group's data from their own backend. Other members keep their local copies until they delete them.
RectificationEdit or delete any expense in the app, subject to the group's edit-permission setting.

One honest caveat: a group is a shared history replicated across the members' devices. Removing your own copy does not remove the copies other members hold, any more than deleting your messages removes them from other people's phones. Leaving a group stops you contributing to it; it does not retract what you already contributed.

Children​

FEN is not directed at children and collects no data from anyone, including children.

Changes to this policy​

If this policy changes, the updated version is published on this page with a new date. Since the app gives us no contact details for you, there is no way for us to notify you individually — checking this page is the only mechanism.

Contact​

Questions about privacy, and reports of anything in the app that contradicts this page, go to info@fenapp.net — the same address as Support, reachable in the app from Settings → Help & Support. FEN is developed in the open, so you can equally raise them at github.com/mapemono/fen.

Writing to us means we hold your message and your email address for as long as it takes to answer. That is the only personal data we ever receive, and only because you chose to send it.