Last updated 11 October 2026
Privacy Policy
Ghar handles shared money at home, with friends and on trips, which means it handles things you would not want loose. This page says exactly what we collect, why, where it sits, and how to get rid of it. No hedging.
The short version. We collect the information needed to run your shared household, trips and private balances with friends. We do not sell personal information or give advertisers names, emails, addresses, household records or individual profiles. We do not track you across other apps or websites.
Who we are
Ghar is operated by Bixu Studio. For anything on this page, write to hi@gharapp.co.
What we collect
| What | Why |
|---|---|
| Name and email | To sign you in and so housemates can tell who paid for what. New people choose a name and username after entering the code sent to their email. If you set a password before 19 September 2026, Supabase Auth still stores its hash for an older build in App Review. The current app does not ask for or change passwords. If you choose Continue with Google, Google provides your name, email address and profile-photo URL instead of you entering those details. On iOS, Continue with Apple provides your name at first sign-in and your email address or a private relay address, with no profile photo. |
| Early-access email | If you join the website waitlist, we store the email address you provide so we can send your TestFlight invitation and limited launch updates. It is kept separately from your Ghar account and is not shared with advertisers. |
| Your house and housemates | House name, membership, invite code, written street address and map coordinates, when you joined, and whether you are an admin. |
| Expenses and splits | Amounts, dates, descriptions, who paid, and how each one is divided. This is the ledger — it is the app. |
| Receipt photos | Stored so the house can check a line item later. Only members of the house or trip sharing that receipt can open it. |
| Profile photo | An image you choose to upload. It is stored publicly and shown on your public profile card. |
| Public profile and friendships | Your @username, name, photo, city, country, short bio and year of arrival in Australia; friend connections, requests and blocks, to help you find and connect with people. Your public card is visible to friends and people searching your exact handle. |
| Placeholder housemates | A name supplied by a housemate for someone who has not joined Ghar. It is visible to the group until the person claims their place or the placeholder is removed. |
| Trips | Trip details, membership, invitations, expenses, splits and attached receipt photos, to maintain the trip's shared ledger. New trip participants must have a Ghar account. |
| User reports | Reports you submit about another person, to let Bixu Studio investigate. Reports are emailed to the founder's inbox through Resend; the reported person is not notified. |
| Friend ledgers and private photos | A friend's display name, expenses, balances and images attached to payments. A linked ledger is visible only to the two people sharing it; an unlinked ledger is visible only to its owner. |
| Days at home | A monthly total of nights at home, only if your house pro-rates a bill like electricity. Ghar does not keep a diary of which dates you were home. |
| Rosters, shopping list, meals, alerts | The day-to-day features, if your house has them switched on. |
| Push token, platform and app version | To send notifications you have not muted, and to reproduce bugs you report. |
| Notification history | A record of the notifications you were sent: title, text, destination screen, who caused it, when it arrived and when you read it. Only you can read your inbox. Records are stored in Sydney for 90 days, then pruned, or deleted with your account. |
| Crash diagnostics | Stack traces, app version, device model, OS version, screen route names before a crash and your account ID, to diagnose and fix app failures through Sentry. |
| Product analytics | A random ID for your device before you sign in, then a random account ID, features used, app version, device model, OS version and your country, taken from your phone's region setting, to understand how Ghar is used and improve it. You can turn this off in Settings → Share usage stats. |
| Optional receipt scan reports | With your permission, misread receipt photos, recognised text and corrections, store name, total, app version and platform, to improve receipt scanning. |
| Anything you send us | Feedback, ideas and bug reports, so we can reply and fix things. |
| Feedback screenshots | Up to three images you choose to attach to a bug report. Screenshots may contain household or ledger information visible on your screen. They are private to your account and are not visible to housemates. |
We do not collect your live device location, contacts, bank logins or advertising identifier. The house address is provided by a house member; it is not obtained from your phone's location services. Ghar has no third-party advertising tracker and does not follow you across other apps or websites.
House address and map
During onboarding, address searches are sent to Google Places, restricted to Australian results. Ghar stores the selected formatted address, its structured address components and coordinates. Home and House may request Google Maps Static imagery using those coordinates; Google therefore receives the map area being requested and the device's network information. The existing address editor still sends a written address to OpenStreetMap's Nominatim service when it is saved. It does not send the address again merely because the screen is rendered. The address belongs to the household, not to a particular member. Ghar does not request your phone's live location.
Signing in
Enter your email, then type the six-digit code we send you. New people then choose a name and username. Supabase Auth sends the code through Resend in the United States from hi@gharapp.co. The email contains the code and nothing else about you. To change your email, enter a six-digit code sent to the new address, and a second code sent to your current address if secure email change is on. The current app does not ask you to set, change or reset a password. Supabase Auth still accepts passwords for one older build in App Review.
You can also choose Continue with Google. Google shares your name, email address and profile-photo URL with Ghar, and learns that your Google account is being used to access Ghar. Google does not receive your house, ledger, receipt or other Ghar data through sign-in. Signing in by emailed code does not use Google for authentication.
On iOS, you can also choose Continue with Apple. Apple provides your name only at first sign-in, and your email address or an Apple-generated private relay address if you choose Hide My Email. In that case, invitation emails from hi@gharapp.co reach you through Apple's email relay. Apple learns that your Apple ID is used with Ghar, but provides no profile photo and receives no house, ledger or receipt data through sign-in. Apple and Google act only as identity providers; your session and authentication records remain in Supabase in Sydney. Android offers Google and emailed-code sign-in.
Public profiles, friends and invitations
Every account has a public @username and a public card containing name, photo, city, country, short bio and “in Australia since” year. Friends and anyone searching your exact handle can see the card; Ghar does not provide a public directory of all users. Your public card does not make your private ledger or household expenses public.
Ghar stores friend connections, requests and blocks. You can report a person to Bixu Studio; the report is sent from hi@gharapp.co to the founder's inbox through Resend in the United States. The reported person is not told about the report.
A housemate can add a placeholder by name only for someone who has not joined Ghar. The group can see that name until the person claims their place or it is removed. Claiming a place links its existing shared ledger records to the person's account.
You can add someone to your personal ledger by name and email, even if they are not on Ghar. We store the email address you enter on the invite and send one invitation through Resend in the United States, from hi@gharapp.co. It contains only your first name and a join link. The email has an unsubscribe link. The unsubscribe list keeps a one-way hash of the address, never the address itself, so we do not email it again. If the invited person later deletes their Ghar account, open invites to their address are deleted and answered invites lose the address.
Travel Mode
A trip is a separate group using the same ledger features as a house. Its members can see the trip details, participants, expenses, splits and attached receipts. Joining a trip by invitation link also connects the joiner and inviter as friends. New trip participants must have a Ghar account; older placeholder guests can claim their place or have their place absorbed by an existing member.
Trips use one currency with an optional reference amount. Trip records are stored in Supabase in Sydney and follow the shared-ledger access and receipt-processing practices described on this page.
Receipt scanning
When you scan a receipt, the photo is sent through our Supabase function to Amazon Web Services (AWS) Textract, our primary receipt reader, in Sydney, Australia (ap-southeast-2). The reader receives the receipt photo, without your split or payer details.
If Textract cannot read the receipt, or its reading does not add up to the printed total, the receipt image may also be sent to Anthropic's Claude API in the United States as a fallback or second opinion. This is part of receipt scanning and does not have a separate consent toggle. You can enter an expense manually instead of scanning it.
Screenshots of a payment that you add to an expense are read in Australia first; if Ghar can't make out the amount and who was paid, the screenshot is sent to Anthropic (US) to read those details, and isn't kept there.
Separately, Ghar asks once whether you want to help Bixu Studio improve receipt scanning. This is optional and off by default. You can change it in Settings → Improve receipt scanning. When enabled, a scan that does not add up or that you correct sends a report containing the receipt photo, recognised OCR text, item names and prices as scanned and as saved, store name, total, app version and platform. Long digit sequences such as card or loyalty numbers are masked in the OCR text on your phone; this does not mean those details are removed from the receipt photo. Reports never include the split or who paid.
Scan reports and their photos are stored in Supabase in Sydney and emailed to a Bixu Studio inbox through Resend in the United States. They are used only to fix the receipt parser and are deleted with your account. Turning the setting off stops future reports.
Notifications and announcements
Each push notification also has a record in your private in-app inbox, including its title, text, destination screen, who caused it, when it arrived and when it was read. These records are stored in Supabase in Sydney, kept for 90 days and then pruned, and deleted if you delete your account. Only you can read your inbox. Push delivery still passes the token and message through Expo and, on Android, Firebase Cloud Messaging.
Bixu Studio may send service notices, such as outages or required app updates, to every account and device with push delivery enabled. News and offers appear in everyone's in-app inbox, but promotional push notifications require your opt-in. Settings → Notifications → News and offers is off by default, and you can turn it off again in the same place.
Crash reporting
When crash reporting is configured in a build, Ghar sends diagnostic reports to Sentry overseas to help fix crashes. Reports contain the stack trace, app version, device model, OS version, the sequence of screen route names visited before the crash, and your account ID. Your account ID accompanies these technical diagnostics without your name, email or financial records attached. Reporting runs automatically without an in-app consent toggle; it is disabled entirely in builds without a crash-reporting connection configured.
Ghar does not include your IP address or other default personal data in crash reports. Screen history contains route names only, with no field contents, amounts or names. No house, expense, receipt or balance information is attached. Session replay and screen recording are disabled.
Product analytics
Ghar uses PostHog Inc.'s US cloud to understand which parts of the app are useful and where we should improve them. Before you sign in, it receives a random ID for your device. When you sign up, that ID is linked to your random account ID. Neither ID is your name, email address or phone number. PostHog also receives feature events such as “expense added” or “house created”, the app version, device model, OS version and your country, taken from your phone's region setting.
Product analytics never include amounts, receipt contents, names, notes or messages. PostHog is told not to look up your location from your IP address, and session replay is disabled. We do not use this information for ads, sell it or share it for advertising. You can stop future product analytics at any time in Settings → Share usage stats.
Where it is stored
Ghar's database, authentication records, public profiles, friendships, trip records, receipts, friend-ledger photos and feedback, scan reports and notification records sit in a Supabase project hosted on AWS in Sydney, Australia (ap-southeast-2). Access is enforced row by row in the database according to group membership, private ledger access, public-profile visibility or account ownership, as appropriate to the record.
Email addresses submitted through the website waitlist are stored separately in Cloudflare D1. Cloudflare may process this website data through infrastructure outside Australia.
Some information is processed overseas to provide particular features: receipt images and payment screenshots may be processed by Anthropic in the United States; push tokens and message contents by Expo and, on Android, Google's Firebase Cloud Messaging in the United States; invitation email addresses and sign-in codes by Resend in the United States; and saved addresses by OpenStreetMap services operated by a UK foundation using European infrastructure. Address searches, coordinates and map-image requests may be processed by Google in the United States. If you use Google sign-in, Google also processes your name, email address and profile-photo URL in the United States. If you use Apple sign-in, Apple processes your sign-in identity and, when used, relay email in the United States. Optional receipt scan reports and user reports are emailed through Resend in the United States. Crash diagnostics, including your account ID, are processed by Sentry outside Australia. Product analytics are processed by PostHog Inc. in its United States cloud. Supabase Edge Functions are globally distributed and may execute outside Australia even when they access data held in Sydney.
Who processes data for us
- Supabase — database, authentication, private inbox records and photo, feedback and scan-report storage.
- Amazon Web Services — primary receipt reading through Textract in Sydney.
- Anthropic— receipt-reading fallback and second opinion when Textract's reading does not match the printed total, and payment-screenshot reading when Ghar cannot make out the amount and who was paid.
- Resend — sending invitation and account emails, and optional receipt scan reports and user reports to Bixu Studio.
- Expo — routing push notifications to your device.
- OpenStreetMap — converting a saved house address to coordinates through its Nominatim service.
- Google — address autocomplete through Places and map imagery through Maps Static; optional Google sign-in; and Firebase Cloud Messaging delivery on Android. Depending on the feature, Google receives address queries or coordinates and network information, Google account profile details, or the push token and notification content needed to provide that service.
- Apple — app distribution and push delivery on iOS, optional Apple sign-in and Hide My Email relay delivery.
- Sentry — diagnostic crash reporting, including your account ID and technical crash details.
- PostHog Inc. — product analytics in its United States cloud, using a random device ID before sign-in and a random account ID afterwards, without your name, email address or phone number.
- Cloudflare — hosting the website waitlist and its email records.
What other people can see
Everyone in your house can see the expenses, splits, balances, receipt photos, rosters and alerts for that house, along with your name and uploaded profile photo. That is the point of a shared ledger. They cannot see your email address, your sign-in code, your notification settings, or anything from a different house or trip they have not joined. Trip records are shared with that trip's members.
If you add a PayID, people in your houses and trips, and anyone who owes you on a settle-up, can see it to pay you back. It's deleted with your account.
Friend ledgers are separate from house records. A linked friend ledger can be read only by the two people sharing it, while an unlinked ledger can be read only by its owner. Ghar does not make these ledgers public or use them for social discovery.
Deleting your account
You can delete your account at any time from Settings → Account & security → Delete account. It is immediate and permanent.
Your sign-in, name, email, username, bio, city, country and arrival year are erased, your devices are unregistered and your avatar, receipt photos, feedback screenshots, receipt scan reports and their photos, notification inbox records, friendships (including requests and blocks) and claim codes you created are deleted. User reports are retained as evidence for support, including reports you submitted or that concern you. Feedback reports may be retained for support history, but their attachment paths and link to your user account are removed. Content you contributed to a shared house or trip remains with that group under “Former housemate” with no email. This includes expenses, splits, transfers, house alerts, meal descriptions, shopping items and shared assets. Keeping the financial records prevents everyone else's ledger and balances from silently changing; the other shared content remains available to the household it was contributed to. Your scrubbed profile row is retained so this shared history continues to resolve to “Former housemate” rather than your identity.
An unlinked friend ledger is deleted outright with its display name, note, photo, entries and attached images. In a linked friend ledger, entries and their splits remain so the other person's balance does not silently change. The departing person's name is replaced for the other user, their note and friend photo are removed, and their payment screenshots are deleted with their storage pointers cleared. These retained entries remain visible only to the other person who already shared that private ledger.
The website waitlist is separate from your app account. To remove your waitlist email, write to hi@gharapp.co from that address.
Your rights
Under the Australian Privacy Principles — and the GDPR if you are in the EEA or UK — you can ask for a copy of your data, ask us to correct it, or ask us to delete it. Deletion is built into the app; for the others, write to hi@gharapp.co and we will respond within 30 days.
Children
Ghar is not intended for anyone under 16. If you believe a child has an account, tell us and we will remove it.
Changes
If we change how data is handled in a way that affects you, we will update this page and note it in the app before the change takes effect.