Share, by Royal Acorn LLC. Effective [EFFECTIVE DATE].
Share is a financial planning app. You connect accounts or type figures in, and it projects what happens next. This page says what we collect, who we send it to, how long we keep it, and how you delete it.
We do not sell your data and we do not share it for advertising. Not now and not later. Our only revenue is the subscription you pay us. We have no advertising business, no data-licensing business, and no plans for either, and saying so here is a commitment rather than a description of current practice.
Royal Acorn LLC, 7533 S Center View Ct, Ste N, West Jordan, UT 84084, United States. Privacy questions: help@joinshare.app, which a person reads.
Share is available to people aged 18 and over.
| What | Why |
|---|---|
| Your email address | To sign you in. We send a one-time code; we do not store a password. |
| If you sign in with Apple: your name, only if you choose to share it on Apple's screen, and the email address Apple gives us (which can be a private relay address) | To sign you in, and so Share can address you by name. Apple sends the name once, the first time, so we keep it with your account. |
| If you sign in with Google: your name, your email address, and a link to your Google profile picture, as Google gives them to us | To sign you in, and so Share can address you by name. Share does not display or download the picture; the link is stored because Google sends it. |
| Account balances, investment holdings (each position's name, quantity and value, as your institution reports it), liabilities and transactions from banks you connect | They are the inputs to your plan. Read-only: Share cannot move money, trade, or initiate a transfer. |
| When you last asked Share to update from your bank | So "Update now" can be limited to once a day, and so your plan can say when it last ran. Nothing else is recorded about how you use the app. |
| Figures you type: income, spending, goals, assumptions | The other half of the plan, and the whole of it if you never connect anything. |
| The questions you ask the app in your own words | To turn a sentence into a scenario the plan engine can run. We do not keep them. The service that passes your question to Anthropic stores neither the question nor your plan's figures; for each request it logs only a request number, how long it took, which model answered, how many tokens it used, and, if it failed, what kind of error it was. |
| Diagnostic data when the app crashes | To find and fix the crash. |
Ten companies process data on our behalf. Each one gets only what its job needs, and the differences below are deliberate.
| Company | What it receives | What it does not |
|---|---|---|
| Plaid bank connections |
The credentials you enter at your bank's own screen, which Share never sees, and the account data your bank returns. | Anything you type into Share. Plaid does not receive your plan. |
| Supabase database and sign-in |
Everything Share stores: your email, your name if you shared it through Sign in with Apple or Google, the account data above, and the plans you author. Hosted in the United States (US West, Oregon). | Your accounts, transactions and plans are not stored anywhere else. |
| Resend sign-in email |
Your email address and the message we send to it: your one-time sign-in code. It delivers the email for us and keeps a log of the emails it sends. | Anything about your plan, your accounts or your money. It only ever sees the email it delivers. |
| Google sign-in, only if you choose it |
If you tap Continue with Google, the sign-in itself, on Google's own page: Google learns that you are signing in to Share. It then sends us your name, email address and profile picture link. | Anything about your plan, your accounts or your money. There is no Google code inside Share; the sign-in happens in your phone's own secure browser sheet. |
| Anthropic reading your questions |
The question you typed, and a short summary of the result once the plan engine has run: a retirement date, a probability, a spending figure. | Your balance sheet, your transactions, your accounts, and your email. It never receives them. |
| Fly.io the plan service |
The figures your plan is computed from, and the questions you type, while a projection or a question is being worked out. It runs the service that computes your plan and passes your question to Anthropic. Hosted in the United States. | Anything to keep. The service stores neither your figures nor your questions; it logs only a request number, timings and token counts. |
| Sentry crash reports |
The technical details of a crash: what code failed and on what device. | No identifier for you and no record of what you were doing. We configure it not to collect those. |
| RevenueCat subscriptions |
A random identifier created for your installation, and whether that installation has an active subscription. | Your account ID, your email, and anything about your plan. The identifier it holds cannot be connected to you by RevenueCat. |
| Expo app updates |
When the app checks for an update: a random identifier created for your installation, the app's version, and your phone's IP address. | Your account ID, your email, and anything about your plan. |
| Vercel the website, visitors only |
Only if you visit joinshare.app: your IP address and the details your browser sends with each request, so that it can deliver the page. | Anything from the app, and anything about your plan, your accounts or your money. |
You can invite one other person, a partner, to share your plan. A partner on your plan sees everything in it: every connected account, balance, investment holding and transaction, from both of your bank connections, every answer you have given, and every change. They can change the plan too. Your bank logins stay yours: neither of you can see the other's credentials, and only the person who connected an account can remove that connection.
To invite someone, Share makes a code that works once and expires after seven days. You send it yourself, by text, email or however you like; Share sends nothing and does not learn who you send it to. We keep only a scrambled form of the code (a hash), never the code itself. When someone uses your code they give their name, and they see nothing of yours until you confirm it is them. You can withdraw a code at any time before then.
Either of you can leave the plan, or remove the other, in the app. The person who leaves keeps their sign-in, their bank connections and a copy of the plan; the other keeps the shared plan, and it stops showing anything of the person who left from that moment.
You can delete your account from inside the app, in Settings. It takes a couple of taps, it needs no email to us, and it is not the same as signing out. This is what happens, in this order:
One thing is not deleted, and it is the subject of the next section.
Share watches for messages that suggest someone is in crisis. When one is detected the app responds with crisis resources and the message is not sent to any AI service. It is stopped before that point.
We keep a record that this happened, so that we can tell whether the safety screen is working. That record contains which rule was triggered, how many characters the message was, and when. It deliberately does not contain the message, any coded version of the message, or any identifier for you.
That last omission is a choice we made on purpose. Attaching a person's identity to a record of this kind would create the most sensitive information a company like ours could hold, and we have no clinical capability to act on it responsibly. So we do not create it.
Because this record contains nothing that identifies anyone, it is not connected to your account and is not removed when you delete your account. There is nothing in it belonging to you to remove.
Share is not an investment adviser. It does not recommend investments, funds, or how to allocate your money, and it never moves money. Projections are arithmetic on the figures you gave it, not predictions or guarantees.
You can see your data in the app, correct it by editing it, and delete it as described above. If you would rather ask us, write to help@joinshare.app.
Under the CCPA, as amended by the CPRA, you have the right to know what personal information we collect and who we disclose it to (this page), to delete it, to correct it, and to not be discriminated against for exercising those rights. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing for you to opt out of. The categories we collect are identifiers, financial information, and internet activity in the form of crash diagnostics; they are used to provide the app and for no other purpose.
Share is offered in the United States only.
We send transactional email only: your sign-in code, and messages about your account or your subscription. We do not send marketing email. Email is delivered for us by Resend, named in the table above. The one exception to "transactional only" is the waitlist, below: if you join it, we send one email, when Share is available.
This website, joinshare.app, is hosted by Vercel, named in the table above. The site sets no cookies, runs no analytics, and loads no scripts from anyone else.
If you join the waitlist, we store your email address and the time you joined, in Supabase. The waitlist record holds nothing else: no name, no IP address, no device details, and it is not connected to an account. We use it to send you one email when Share is available, delivered by Resend, and for nothing else. To be removed, write to help@joinshare.app from that address and we will delete it.
Data is encrypted in transit and at rest. Bank access tokens are encrypted separately and are never sent to the app on your phone. Access to your data is restricted at the database level so that one account cannot read another's.
If we change this policy we will update the date at the top and, where the change is significant, tell you in the app. Adding a new company to the list above is a change to this page, made at the same time, and not afterwards.