Privacy Policy

Sổ Chi · iOS · Last updated: 26 October 2026

This policy explains what Sổ Chi collects, uses, shares and keeps when you use the iOS app and this legal site.

1. Who controls the data

The data controller is Thanh DAO, an individual developer, at Hanoi, Vietnam. For any question or request about your data: customer-support@quietfleet.dev.

2. What we collect

Account and household

• User ID, sign-in provider (Apple or Google), email and name if Apple/Google shares them (Apple may use a private relay address), display name and language.
• If you sign in with Apple: an Apple refresh token, used only to revoke access when you delete your account.
• Household name, currency, timezone, members, invite code, join time and invite-attempt history for abuse prevention.

Ledger

• Messages you send and the app's replies.
• Expenses and income: amount, note, category, date, creator and soft-delete status.
• Household categories and the categorisation cache (which category a note was assigned to).

Sổ Chi Plus

• Plan, product ID, status, expiry and transaction environment (production or sandbox).
• The household ID used as RevenueCat's App User ID, and webhook events about plan status. Apple processes payment; we do not receive card numbers or full payment details.

AI processing

• Message text (and the original message when you answer a clarification question), household categories, language and the current date are sent to OpenRouter to extract expenses and income.
• Token counts, cost, status and timing are stored in ai_usage to enforce usage limits.

Analytics

• Events such as sign-in, household creation/join, message sent, parsing, expense add/edit/delete, dashboard views, language or appearance changes, AI limit reached and account deletion.
• Event properties contain only counts, lengths, statuses, edited field names, error codes and identifiers. We do not send message content, amounts, notes, household names or email in event properties.
• PostHog receives a pseudonymous user ID (the account ID), the household ID as an analytics group, language, sign-in provider, currency, plan, plus standard technical information sent by the SDK.
• Session replay is currently off. Text and image masking flags are pre-set so that if replay is enabled later, masking is on by default.

On your device

The app stores your sign-in session and a local cache of data (messages, expenses, categories, plan status) so it opens quickly. The cache is cleared when you sign out, leave the household or delete your account.

We do not request access to photos, camera, microphone, contacts or location. We do not show ads and do not use your data to track you across other apps or websites.

3. Why we use data

• To provide the service: authentication, household ledger sync, message parsing and reports.
• To manage the Plus plan and household access.
• For security, abuse prevention, AI-limit enforcement and error handling.
• To analyse usage and improve the app.
• To comply with the law, resolve disputes and protect our rights and our users' rights.

We rely on performing our contract with you, on your consent where the law requires it, and on our legitimate interests in operating, securing and improving the service.

4. Who we share with

Supabase

Hosts the database, authentication and server functions. App data is located in the Singapore region.

OpenRouter

Processes message text, categories, language and date to extract expenses and income. OpenRouter may pass the request to a model provider.

RevenueCat

Manages Plus plan status; receives the household ID and product/transaction information.

Apple

Sign in with Apple, the App Store and payments; receives the Apple refresh-token revocation request when you delete your account.

Google

Sign in with Google when you choose that sign-in method.

PostHog

Analytics events, pseudonymous user ID, household ID and standard SDK technical information. The configured PostHog host is us.i.posthog.com.

Cloudflare

Hosts this legal site and processes page requests (including IP address) under Cloudflare's policy.

Cloudflare R2 (Cloudflare, Inc.)

Stores encrypted database backups. Cloudflare does not hold the decryption key.

We do not sell personal data and do not share it for advertising. We may disclose data if required by law, or to protect our rights, safety and systems and those of our users.

5. Where data is processed

Data may be transferred outside Vietnam to the following parties:

• Supabase: app data is stored in the Singapore region.
• PostHog: US cloud (us.i.posthog.com).
• OpenRouter and the model provider OpenRouter routes the request to: in the United States or where they operate.
• RevenueCat and Apple: in the United States or where they operate.
• Cloudflare R2: encrypted backups, where Cloudflare operates.

Data travels over encrypted connections. This section will be updated as we add information about transfers outside the country.

6. Retention

• Account and ledger data: while the account exists, until you delete it or the data is deleted.
• Backups: Supabase is on the Free plan, with no platform backups. We make our own encrypted copy of the database once a day; it is encrypted before it leaves the backup pipeline and stored on Cloudflare R2, and only the app owner holds the decryption key. Each backup is kept about 30 days and then deleted automatically.
• PostHog events: up to 1 year under the PostHog Free plan.
• Message content sent through OpenRouter: our OpenRouter account is set to Zero Data Retention. This is an account setting; actual retention at each model provider follows that provider's policy, and we do not guarantee it on their behalf.
• Purchase and plan records held by Apple and RevenueCat: retention follows each provider's own policy (Apple, RevenueCat).
• Supabase API and database logs: 1 day under the Supabase Free plan.
• Server logs of Cloudflare and OpenRouter: retention follows each provider's own policy (Cloudflare, OpenRouter).

We do not keep data longer than needed for the purposes above, unless the law requires or permits it.

7. Deleting your account in the app

You can delete your account inside the app:

1. Open Sổ Chi and go to Settings.
2. Under Account, choose Delete Account.
3. Read the warning and confirm.

The Plus screen also has a Delete Account entry. Deletion cannot be undone.

When you confirm:

• If you signed in with Apple, we revoke the Apple refresh token before deleting. If revocation fails, the account is not deleted and you can try again.
• We delete your sign-in account, profile, household membership and invite-attempt history; the app also clears its session and local cache.
• If the household still has other members: messages and expenses you added stay in the shared ledger for the remaining members. That data is no longer linked to your user ID, but the content remains visible to them.
• If you are the last member: the household and all of its data (messages, expenses, categories, invites, AI usage and plan status) are deleted.
• The Plus plan is not cancelled automatically. Cancel it in Settings › [your name] › Subscriptions.
• Deleted data can remain in the encrypted backups for up to about 30 days, and disappears when those backups are deleted automatically.
• Analytics events already sent may remain in PostHog under a pseudonymous ID; see section 6 for retention.

8. Your rights

Depending on the applicable law, you have the right to:

• access and receive a copy of your data;
• correct data (much of it can be corrected directly in the app);
• delete data or delete your account;
• restrict or object to processing;
• withdraw consent;
• complain to a competent data-protection authority.

Send requests to customer-support@quietfleet.dev. We may ask you to verify your identity and will respond as required by the applicable law. Some data controlled by Apple or RevenueCat must be requested from them directly.

9. Security

Data is transmitted over HTTPS. Access to household data is limited to household members by database row-level security (RLS). The Apple refresh token is stored in a column the app cannot read and is revoked on account deletion. No system is completely secure; please protect your device and sign-in account.

10. Children

Sổ Chi is not intended for people under 13 years old. If we learn that we collected data from a child below that age, we will delete it. Contact customer-support@quietfleet.dev if you believe this has happened.

11. Changes to this policy

We may update this policy. The new version is posted on this page with its update date. If a change is material, we will try to notify you in the app or by email where appropriate.

12. Contact

Privacy questions or requests: customer-support@quietfleet.dev.