Fondue — Privacy Policy

Fondue ("we," "us," "the app") is a group expense-splitting app. This policy explains what data Fondue collects, why, and where it goes.

Contact: support@gofondue.app — reach out here for any privacy question, deletion request, or concern.

Who we are: POLARYS LAB, operating as a sole proprietorship registered in Malaysia.

1. Fondue is local-first, by design

Your groups, expenses, splits, and payment history are stored on your device, in a local database. You don't need an account to use the app, and there is no central Fondue server that holds your data by default. Nothing described below changes that unless you explicitly turn it on (like signing in, or Cloud Sync).

2. What we collect, and why

Data	When	Why	Where it goes
Group, member, expense, and split data you enter	Always	Core functionality — this is the app	Stays on your device (local SQLite database) unless you enable Cloud Sync for a group
Contacts (name, phone/email if present)	Only if you use "Add from Contacts"	To prefill a member's name without typing it	Stays on your device — never uploaded or transmitted anywhere
Camera / photo library access	Only if you scan a receipt or attach a photo	To read a receipt's contents (OCR) or attach it to an expense	Receipt photos scanned for OCR are sent to Google Cloud Vision for text extraction, then discarded by us. Photos attached but not scanned stay on your device.
Payment handles you enter (e.g. a bank transfer or payment-app handle)	If you add one in your Profile	To build a payment link when someone settles up with you	Stays on your device; used only to construct a link/QR that opens your chosen payment app — never sent to us or any third party
Email address, or basic profile info from Google/Apple (name, email, account ID)	Only if you sign in — required to make a purchase or use Cloud Sync, optional otherwise	To create and secure your account, and to link a purchase or synced group to you	Handled by Supabase Auth (our authentication provider); with Google or Apple sign-in, Google/Apple issue us only the profile fields you approve at their own sign-in prompt
Purchase and subscription status (which plan, renewal date — not your card number)	Only if you buy Fondue Plus or a Melt Pass	To unlock the features you paid for and manage renewals/restores	Processed by Apple/Google's own purchasing systems and RevenueCat (our subscription-management provider); we never see or store your card details
Crash reports and diagnostic data	Automatically, on a crash or error	To find and fix bugs	Sent to Sentry (our crash-reporting provider)
Anything you type into the in-app feedback form	Only if you submit feedback	To read and act on your feedback	Sent to Sentry along with the report
Group data, if you enable Cloud Sync	Only if you turn on Cloud Sync for a specific group	To sync that group across your own devices, or share it with someone you invite	Encrypted on your device before it ever leaves, then stored by Supabase as unreadable ciphertext

We do not collect your location, do not show ads, do not use any advertising or tracking SDK, and do not sell or share your data with anyone for marketing purposes.

3. Third parties we use

Google Cloud Vision (receipt scanning) — when you scan a receipt, the photo is sent to Google's Vision API to read the text. See Google's Privacy Policy.
Supabase (sign-in and opt-in Cloud Sync) — handles account sign-in (email code, Google, or Apple), and, if you turn on Cloud Sync for a group, stores an encrypted copy of that group's data. Supabase only ever holds ciphertext for synced group data — the encryption key never leaves your device except when you deliberately share a pairing code or invite link. See Supabase's Privacy Policy.
RevenueCat (subscription management) — if you buy Fondue Plus or a Melt Pass, RevenueCat tracks your purchase and entitlement status on our behalf so the app knows what you've unlocked; it doesn't receive your payment card details, which Apple/Google handle directly. See RevenueCat's Privacy Policy.
Sentry (crash reporting & feedback) — collects crash logs, device information (model, OS version, IP address), and app usage context automatically when something goes wrong. See Sentry's Privacy Policy.

4. Your choices and rights

Contacts, camera, and notification permissions can be revoked at any time in your device's system settings.
Signing in is optional except to make a purchase or use Cloud Sync — you can use the rest of the app as a guest, and you can sign out at any time from Settings.
Cloud Sync is opt-in per group and can be turned off at any time from that group's settings — turning it off deletes that group's data from our sync provider.
Deleting a group or the app removes its data from your device. If that group ever had Cloud Sync enabled, contact us to confirm removal from our sync provider as well.
You can request access to, correction of, or deletion of any data associated with your account by contacting us at support@gofondue.app. We'll respond and act on verified requests within a reasonable time.

5. Children's privacy

Fondue is not directed at children under 13 (or the relevant minimum age in your country), and we do not knowingly collect data from them. If you believe a child has provided us data without appropriate consent, contact us and we'll remove it.

6. Data retention and security

Data that stays on your device (the default for everything except sign-in, Cloud Sync, and purchase status) persists until you delete it or uninstall the app. Cloud Sync data and account data are retained until you delete the group, sign out and request deletion, or delete your account by contacting us. We rely on our providers' security practices (encryption in transit and at rest) and, for Cloud Sync data, end-to-end encryption on top of that — no method of transmission or storage is 100% secure, but we don't hold anything we don't need to.

7. Changes to this policy

If this policy changes in a meaningful way, we'll update the "Last updated" date above. We recommend checking back periodically.