Privacy policy

What we collect

For your account: your email address, your name, and your password — the password only as a bcrypt hash, never as text anyone can read, including us.

For your mess: the entries you and your mess-mates make. Meal counts, grocery trips and their items, deposits, shared costs like rent and bills, standing meal plans, and a log of who changed what. That is what a ledger is; without it there is nothing to show you.

We do not ask for a phone number, a postal address, a date of birth, or payment details. There is no card field anywhere in the product.

Analytics

This site loads Google Analytics. It tells us how many people came, which pages they landed on, roughly which country they were in, and what kind of device they used. We read it to decide what to write and what to fix. It is the only third-party script on the site, and there is no advertising network, no Facebook pixel and no session recorder.

It is not told anything from your ledger. Google receives the path of the page you are on — /mess/settlement, /privacy — and never the query string after it, which is where this site puts the id of the mess you have open and the token in a password reset link. That is deliberate: the page strips it before sending, rather than leaving Google to be trusted with it.

It is not told your email address, your name, your meal counts, your deposits, or any figure from your mess. Those go to our own API and nowhere else.

If you would rather not be counted, any ad or tracker blocker stops the script loading, and nothing else about the site changes.

What we do not collect

Our request logs record the method, the path, the response status, how long the request took, and a random request id. They do not record IP addresses, and they do not record who you are. They are kept for seven days and then deleted.

Your IP address is used once, in memory, to limit how many sign-in attempts can come from one place — which is how a password-guessing attempt gets stopped. It is not written to disk and not kept.

Cookies

One cookie, named mh_refresh. It keeps you signed in. It is HttpOnly, so no script on the page can read it — including any script an attacker manages to inject. It is Secure, so it only travels over HTTPS. It is SameSite=Strict and scoped to the sign-in endpoints, so another site cannot cause your browser to send it. It expires after thirty days, and signing out deletes it immediately.

Google Analytics sets two more: one named _ga, and one whose name begins _ga_. They hold a random id, so that two visits from the same browser are counted as one person rather than two. They carry nothing about you or your mess, they are set by this site rather than by Google's own domain, and blocking the analytics script stops them being set at all.

There is no advertising cookie, because there is no advertising anywhere in the product.

Your browser also remembers five preferences on your own device: the theme, the background and the font you picked, the language you picked, and which mess you opened last. These never leave your browser and are never sent to us.

Who can see your data

The members of your mess can see that mess's entries — that is the point of a shared ledger, and everyone in it can see the same numbers. Someone who is not a member of your mess cannot see it, cannot list it, and is not told it exists.

We do not sell your data, and we do not share it with advertisers or data brokers. The one thing that leaves is the page view described under Analytics — a path and a device, to Google. Your ledger is not part of it.

Where it is kept

The application runs on Amazon Web Services in the Singapore region, and the database is hosted with Neon. Pages and images are served through Amazon CloudFront, which has servers worldwide, so the page itself may be delivered from a machine near you. Your account and mess data stay in the database. The page views described under Analytics go to Google, on Google's servers, under Google's terms.

Everything travels over HTTPS. The site sends HSTS, so once your browser has visited it will refuse to connect any other way.

Getting your data out, or deleting it

The settlement screen exports a month as CSV, which you can open in any spreadsheet.

There is a Delete account button, at the bottom of the More page in the app and on the web. It closes the account immediately: every session ends, the password is destroyed, and your email address is overwritten so it is free to sign up with again. You do not have to ask anyone.

One honest limitation: entries you made in a shared mess are part of that mess's ledger, and removing them would silently change other people's settled figures. We remove your account and your personal details; historical entries stay in the mess's own record.

Children

Mess Ledger is not aimed at children and we do not knowingly collect data from anyone under 13. If you believe a child has created an account, write to us and we will remove it.

Changes to this policy

If this changes in a way that affects what we collect or who can see it, we will update the date at the top and say what changed. Small corrections of wording will not be announced.