Privacy Policy

Effective date: [TO BE SET ON LAUNCH, PLACEHOLDER]. Version: V1 (Friends-and-Family Beta). Status: AI-drafted, pending bar-admitted counsel review before public launch.

Friends-and-family beta. This Privacy Policy governs limited pre-launch use of SharedAnchor. SharedAnchor will publish a counsel-reviewed Privacy Policy before opening signups to the general public.

1. Scope and Beta Status

This Privacy Policy ("Policy") explains how SharedAnchor, Inc. ("SharedAnchor," "we," "our," or "us") collects, uses, discloses, and retains personal information when you use the SharedAnchor web application at app.sharedanchor.com and the SharedAnchor iOS and Android mobile apps (collectively, the "Service").

This Policy applies to individuals who create accounts or use the Service. SharedAnchor is available only to individuals who are at least 18 years of age and reside in the United States.

The current version of SharedAnchor is a limited pre-launch beta available by invitation. This Policy reflects the features and data practices active at the time of writing. Features and data practices may change before general availability; material changes will be communicated as described in Section 14.

SharedAnchor is a co-parenting financial record-keeping platform. SharedAnchor does not hold, transmit, transfer, escrow, settle, or take custody of user funds at any time. SharedAnchor is not a bank, money transmitter, money services business, payment processor, or escrow agent.

2. What SharedAnchor Collects

Information you provide

• Account credentials. Your email address and a one-way password hash (we store a one-way Argon2id password hash, not your password). Google OAuth credentials are stored as an OAuth token reference only; Sign in with Apple credentials are handled by Apple.
• Display name. Your chosen display name for identification within your co-parenting pair.
• Children's information. A child's first name and birth year only when you add a child to your co-parenting record. SharedAnchor does not collect a child's full date of birth, Social Security number, school name, address, or photograph.
• Expense, calendar, and external payment records. All financial and custody records you enter into the platform, including expense amounts, dates, memos, uploaded receipts, custody schedule entries, day overrides, and external payment records.
• Messages to the AI assistant. Text you type to the SharedAnchor AI assistant and SharedAnchor's AI-generated responses, when you use that feature.

Information we collect automatically

• Hashed IP address. SharedAnchor stores a one-way SHA-256 hash of your IP address, not the IP address itself. The original IP address cannot be recovered from the stored value.
• Anonymous device identifiers. Firebase Cloud Messaging (FCM) and Apple Push Notification service (APNs) tokens for push notification delivery. These identifiers are pseudonymous and are not linked to your identity beyond your account.
• Error and log metadata. Stack traces, error metadata, and your account's UUID identifier (not your name or email) for error-tracking and uptime-monitoring purposes. Payment amounts and names are excluded from logs.

Billing information SharedAnchor does not directly hold

For subscription billing, SharedAnchor uses Stripe, Inc. Stripe stores the subscribing co-parent's payment card details. SharedAnchor receives and stores only the card brand (for example, Visa) and last four digits for display purposes. SharedAnchor does not receive or store card numbers, expiration dates, or CVVs.

What SharedAnchor does not collect

SharedAnchor does not collect:

• Your phone number at account signup (phone is an optional post-onboarding field in Settings, not required)
• Venmo login credentials, Venmo balances, or Venmo transaction history
• Bank account or routing numbers
• Stored card numbers in full
• Your last-login time, last-active time, or message read-receipt timestamps
• Government identification or KYC documents
• Your full date of birth or Social Security number

3. How SharedAnchor Uses Your Information

SharedAnchor uses the information it collects for the following purposes only:

• Operate the Service. Maintaining expense records, external payment records, custody calendar records, account access, and record exports.
• Generate and maintain the append-only ledger. Generating the SHA-256 hash chain and daily Merkle root described in Terms of Service Section 6.
• Subscription billing. Processing and managing the monthly co-parenting pair subscription through Stripe.
• Transactional email. Sending account, billing, and notification emails through Resend. Marketing emails include a CAN-SPAM-compliant unsubscribe mechanism.
• Error tracking and service reliability. Identifying and diagnosing errors and outages through Sentry and BetterStack.
• Fraud and abuse detection. Detecting unauthorized access, suspicious activity, and policy violations using hashed IP addresses and account-level signals.
• Legal obligations. Complying with applicable laws, legal processes, and government requests.
• Aggregate service improvement. Analyzing anonymized, non-identifying usage patterns to improve the Service.

SharedAnchor does not use your personal information for targeted advertising, behavioral profiling, cross-context behavioral advertising, or to train SharedAnchor's AI models. SharedAnchor's AI subprocessors are engaged on commercial terms that do not use your content to train their models, as further described in Section 6.

4. Privacy and Safety Protections That Apply to All Users

SharedAnchor applies the following structural privacy and safety protections to every account, regardless of whether you have enabled additional safety settings:

1. No read receipts to your co-parent. SharedAnchor does not tell your co-parent when you read a message, notification, or shared record. The time you opened any item is never shown to the other parent.
2. No financial detail in push notifications. Push notifications sent to your phone or other device do not contain payment amounts, balances, recipient names, or other financial detail. Lock-screen previews are limited to generic messages because lock screens can be seen by anyone near your device.
3. Quiet account departure. If you deactivate or delete your account, SharedAnchor does not send your co-parent a notification or alert that you have left. Your co-parent will see only that the account is no longer reachable.
4. IP addresses are hashed. SharedAnchor stores a one-way SHA-256 hash of your IP address, not the IP address itself. The original IP cannot be recovered from the stored value.
5. Generic error messages. Error responses returned by SharedAnchor's services do not disclose the existence, structure, or membership of any co-parent pair. Errors are written so that they cannot be used to confirm whether a particular person has an account.

These same protections are stated in our Terms of Service Section 7.

5. Who SharedAnchor Shares Information With

Subprocessors

SharedAnchor uses the following third-party service providers to operate the Service. Each subprocessor handles data under its own terms and privacy policy.

Active at launch:

Deferred, not active at launch:

SharedAnchor will update this list when subprocessors are added or removed. Material changes will be communicated in accordance with Section 14 (Changes to This Privacy Policy).

No sale of personal information

SharedAnchor does not sell your personal information. SharedAnchor does not share your personal information for cross-context behavioral advertising.

Government and legal disclosure

SharedAnchor may disclose your personal information to law enforcement, government agencies, or other third parties when required to do so by law, subpoena, court order, or other legal process, or when SharedAnchor in good faith believes disclosure is necessary to protect SharedAnchor's legal rights, to protect the safety of any person, or to prevent illegal activity. SharedAnchor will attempt to notify you of such requests to the extent permitted by law.

Business transfers

If SharedAnchor is involved in a merger, acquisition, reorganization, sale of assets, or similar transaction, your personal information may be transferred as part of that transaction. SharedAnchor will notify you before your personal information is transferred and becomes subject to a different privacy policy.

6. AI Features and Third-Party AI Processors

SharedAnchor uses two separate third-party AI providers for distinct purposes.

Anthropic (Claude), AI assistant

When you use the SharedAnchor AI assistant, the text of your messages and SharedAnchor's responses are sent to Anthropic, our AI subprocessor, so Anthropic can generate replies. Under Anthropic's commercial API terms, these messages are not used to train Anthropic's AI models. SharedAnchor does not send your receipt images, expense records, or custody-calendar data to Anthropic except as text content you choose to include in a message.

AI conversation content is retained only as long as needed to operate the conversation.

Your AI chat history and activity are private to you. SharedAnchor does not share one co-parent's AI conversations or AI activity with the other co-parent, and does not use one co-parent's AI history to personalize the other co-parent's experience.

AI suggestions are generated by software and may be incomplete or inaccurate. The AI assistant does not provide legal, tax, financial, medical, or safety advice, and does not create any professional or advisory relationship between you and SharedAnchor.

Google (Gemini), receipt OCR

When you upload a receipt photo or PDF, SharedAnchor sends the image to Google Gemini, our OCR subprocessor, to extract merchant, date, total, and line-item text. Google's handling of the image is subject to Google's Gemini API terms; SharedAnchor does not control how Google retains or uses the image beyond what those terms permit. The text Gemini extracts is shown to you as a draft pre-fill; SharedAnchor does not write the extracted text to the append-only ledger until you accept the draft.

The receipt image itself continues to be stored in Cloudflare R2, encrypted at rest. If you do not want a particular receipt processed by a third-party AI provider, do not attach that receipt; expenses can be recorded without an attached receipt.

7. External Payments and Venmo

SharedAnchor does not collect, store, or process your bank credentials, bank account or routing numbers, Venmo login credentials, Venmo balances, or Venmo transaction history. When you use "Pay via Venmo," SharedAnchor opens the Venmo app or website with a pre-filled recipient handle, amount, and memo; the payment itself happens entirely inside Venmo under Venmo's own terms and privacy policy. SharedAnchor receives no confirmation back from Venmo. The only payment information SharedAnchor stores is what you and your co-parent type into SharedAnchor: the external payment record (amount, date, memo, recipient handle) and any confirmation or dispute event either of you submits. Subscription billing is separate: Stripe stores the subscribing co-parent's payment card information for the $7/month pair subscription. See Terms of Service Sections 4 and 5 for the full payment-role disclosure.

8. Append-Only Records and Retention

How financial and custody records are stored

SharedAnchor's financial and custody records, including expenses, external payment records, custody schedules, day overrides, swap requests, and related events, are stored as append-only records. SharedAnchor does not update or delete these records once created. Corrections and amendments are made by appending new entries that supersede earlier entries; the original entry remains in the ledger.

Each legal-fact record carries a SHA-256 hash of the prior record in its table, forming a continuous hash chain. A daily Merkle root is computed at 00:05 UTC and recorded to provide a tamper-evident snapshot of the ledger at that point in time. SharedAnchor makes no representation that this structure makes records "court-admissible"; admissibility is determined by the rules of evidence applicable in your jurisdiction.

Right to correct financial and custody records

For records that are part of SharedAnchor's append-only legal-fact ledger (expenses, external payment records, custody schedules, day overrides, swap requests, and related events), correction is performed by appending a new entry that supersedes the original; the original entry is preserved.

Retention period

Account-level data (your email address, display name, password hash, and device tokens) is deleted when you request deletion of your account, as described in Section 9.

Append-only legal-fact ledger records may be retained, in a form stripped of direct identifiers to the extent feasible, for up to six years following the date the record was created. Deletion of these records is constrained by the legal-retention exception in California Civil Code §1798.105(d)(1) (transaction completion), §1798.105(d)(3) (security and fraud detection), and §1798.105(d)(5) (legal obligation). This carve-out is required to preserve the integrity of the SHA-256 hash chain and the daily Merkle root. Retained records are stripped of direct identifiers (name, email, and other direct identifiers) to the extent feasible, consistent with the SHA-256 hash-chain integrity requirements described in Terms of Service Section 6.

9. Your Rights Under California Law

If you are a California resident, you have the following rights regarding your personal information:

• Right to know. You may request a copy of the personal information SharedAnchor holds about you, the categories of sources, the business or commercial purposes for collection, and the categories of third parties with whom we share it. Request access by emailing privacy@sharedanchor.com. You may also export your records at any time through the web app.
• Right to correct. You may request correction of inaccurate account-level personal information (such as your email address or display name). Financial and custody records cannot be modified in place because they are append-only; corrections to those records are made by appending compensating entries that supersede the original, as described in our Terms of Service Section 6.
• Right to delete. You may request deletion of your account and associated personal information by emailing privacy@sharedanchor.com. SharedAnchor will honor your deletion request subject to the following carve-out: records subject to legal retention obligations (including potential litigation hold, court-ordered preservation, and applicable financial-records retention rules) may be retained, in a form stripped of direct identifiers to the extent feasible, for up to six years following the date the record was created. This carve-out is required to preserve the integrity of the SHA-256 hash chain and the daily Merkle root described in Terms of Service Section 6. Retained records are stripped of direct identifiers (name, email, and other direct identifiers) to the extent feasible, consistent with the SHA-256 hash-chain integrity requirements described in Terms of Service Section 6.
• Right to opt out of sale or sharing. SharedAnchor does not sell your personal information, and SharedAnchor does not share your personal information for cross-context behavioral advertising. There is nothing for you to opt out of.
• Right to non-discrimination. SharedAnchor will not deny you service, charge you a different price, or provide you a different level of service because you exercised any of the rights described above.

To exercise any of these rights, email privacy@sharedanchor.com. We will respond within 45 days as required by California law. You may also designate an authorized agent to make a request on your behalf; we will require reasonable verification of the agent's authority.

SharedAnchor does not collect sensitive personal information as defined under the California Privacy Rights Act.

10. Children's Information

SharedAnchor collects only a child's first name and birth year when you add a child to your co-parenting record. SharedAnchor does not collect a child's full date of birth, Social Security number, school name, address, or photograph. Birth year is collected at year granularity only; no more granular date is stored.

SharedAnchor is not directed at children under 13 and does not knowingly collect personal information directly from children under 13. The Service is available only to individuals who are at least 18 years of age. SharedAnchor's data collection practices regarding children's information are structured to remain below the COPPA collection floor.

If you believe SharedAnchor has inadvertently collected personal information from a child under 13, please contact us at privacy@sharedanchor.com and we will delete it promptly.

11. Security

SharedAnchor takes reasonable technical and organizational measures to protect your personal information, including:

• TLS in transit. All data transmitted between your device and SharedAnchor's servers is encrypted using TLS.
• Stripe for card data. Stripe, Inc. stores all payment card information. Stripe is certified at PCI DSS Level 1. SharedAnchor does not receive or store card numbers.
• Cloudflare R2 encryption at rest. Receipt images and PDF exports stored in Cloudflare R2 are encrypted at rest.
• Railway backups encrypted at rest. Database backups hosted on Railway are encrypted at rest.
• Hashed IP addresses. SharedAnchor stores only a one-way SHA-256 hash of your IP address. The original IP cannot be recovered.
• Log scrubbing. Logs exclude names, payment amounts, and other direct identifiers. Only account UUIDs are logged.

No security measure is perfect or impenetrable. SharedAnchor cannot guarantee that unauthorized third parties will never be able to defeat these measures. In the event of a data security incident, SharedAnchor will notify affected users as required by applicable state law.

12. Cookies, Trackers, and Analytics

SharedAnchor uses session cookies that are strictly necessary for authentication and maintaining your logged-in state. These cookies are not used for advertising.

SharedAnchor does not deploy third-party advertising trackers, social media pixels, or cross-site analytics at launch. Sentry and BetterStack, disclosed in Section 5, receive limited technical metadata (error events and uptime probe results) for service reliability purposes.

SharedAnchor does not use cookies to build behavioral profiles or to serve targeted advertising.

13. International Transfers

SharedAnchor's services are operated and hosted in the United States. If you access the Service from outside the United States, your personal information will be transferred to, processed, and stored in the United States. By using the Service, you consent to the transfer of your personal information to the United States. SharedAnchor is not currently offered in the European Union or United Kingdom.

14. Changes to This Privacy Policy

SharedAnchor may update this Policy from time to time. When we do, we will post the updated Policy at app.sharedanchor.com/privacy and update the Effective Date at the top of this document. For material changes, we will provide additional notice by email to your registered address.

Your continued use of the Service after the effective date of the revised Policy constitutes your acceptance of the changes. If you do not agree to the revised Policy, you must stop using the Service and close your account before the effective date.

15. Contact

Privacy and data-rights requests: privacy@sharedanchor.com

Support and account matters: support@sharedanchor.com

SharedAnchor, Inc. Mailing address available upon written request to support@sharedanchor.com.