Draft. 2 things are not settled: a named privacy officer, who sells the subscription. Not yet reviewed by a lawyer.

Privacy

The short version: we hold what you type, we never connect to your bank, and we never sell or share any of it. The rest of this page is that sentence with the details filled in.

1. The three that matter most

• We never connect to your bank. There is nowhere in this product to put a bank password, and there never will be. Everything here is what you typed.
• We never sell or share your data. Not to advertisers, not to data brokers, not to a partner, not "anonymized and aggregated". There is no version of this where somebody buys it.
• We never tell you what to buy, own, or hold, so we have no reason to build a profile of you and nobody paying us to.

2. What we collect

Your email and the name you chose

To sign you in, to prove the address works, and to tell you when something changes about your login.

What you write down

Amounts, dates, the word you used, the reason you tapped, and anything you noted in a weekly or monthly reflection. What you own and owe, if you choose to keep that here.

Your password, as a hash

We cannot read it, which is why we can never send it back to you and can only let you set a new one.

Your two-factor secret, encrypted

With a key held outside the database and outside the backups, so a copy of either one alone is useless.

Ordinary server logs

Which pages were asked for and when, so we can find a fault. Never the contents of a page, and never the query part of a link, because a link in this product carries dates and identifiers. When something breaks, the fault is recorded with a reference; the alert that reaches us carries the reference and the route and nothing from inside your book.

Anything you send through the contact form

Your address and your message, so we can answer. Kept while the conversation is open and no longer.

We do not collect your postal address, your date of birth, your government identifiers, or your bank details, because the product does not need any of them. The age check asks for a month and a year and keeps neither: it is used once, on the screen, and never written down.

3. What we do with it

Run the product for you: sign you in, add up your own figures, show them back to you, and keep them safe. Send you the few messages the product owes you, which are the one that proves your address and the ones that tell you your password, your email or your two-factor setting changed.

That is the whole list. We do not profile you, score you, or train anything on your book.

4. What we do not do

There are no analytics, no advertising pixels, and no third-party scripts anywhere in the product. Nothing is loaded from another company's server: the one stylesheet and the one script are ours and are served from here.

We do not sell, rent, broker, or trade your data, and we do not share it for anybody else's advertising. This is a binding refusal rather than a current policy.

5. Paying

A merchant of record handles the card and becomes the seller. We will name them here before anybody is charged. We never see your card number. We see that a subscription started, renewed, or stopped, and nothing else about the payment.

6. Who else touches it

Nobody sells it and nobody browses it. A small number of companies handle part of running the service, and each gets only what its job needs:

Email delivery

Resend. Sends the message that proves your address and the notices about your login. Sees your address and that message, and nothing from inside your book.

Hosting

DigitalOcean, which runs the server your book lives on.

Payment

A merchant of record, named here before anybody is charged.

Backups

Backblaze B2, holding an encrypted copy off our own machines.

We keep this list current. If it changes in a way that matters we will tell you rather than quietly editing the page.

We will also hand something over if the law genuinely requires it, and we will tell you unless we are forbidden to.

7. Inside a household

A household is more than one person, and the walls between them are real ones, built into the database rather than into a screen.

What the others can see depends on how the household said it keeps money: everything together, together with personal money kept aside, or mostly apart. Anything you marked personal is yours alone, and stays that way even if the household later changes how it keeps money.

A shared entry stores no author. Nobody can ask the book which of you bought the groceries, because the answer is not written down.

8. How long we keep it

While you have a login, and then until you delete it.

Deleting is immediate. It is self-serve, it shows you exactly what would go before it goes, and it removes the data from the live book at once rather than deactivating it for a while first.

Backups age out within thirty days, so that is the outside edge of how long a deleted book can exist anywhere. We keep nothing beyond that except where tax or accounting law requires us to keep a record of a payment, which contains no part of your book.

9. Your rights, wherever you are

• Take a copy, any time, of everything, as a file you can open. No reason asked and no delay. It contains what you could see on screen and nothing more.
• Correct anything. Every entry can be edited or deleted by anybody who can see it.
• Delete all of it, yourself, without emailing anybody.
• Ask what we hold. The export is the answer and it is faster than asking.
• We do not sell or share your data, so there is nothing to opt out of.
• No decision with a legal effect is made about you automatically. There is no such decision anywhere in this product.

Canada

Canada is a market we deliberately serve, so this is not a footnote.

A named privacy officer will be here before launch. Until then, use the contact form and it reaches a person. You may ask what we hold about you and challenge its accuracy, and we will answer within thirty days.

Your data is processed in the United States by DigitalOcean, which means it can be reached by lawful process there. We say so plainly because you are entitled to know it before you decide.

If we have not dealt with a complaint properly you can take it to the Office of the Privacy Commissioner of Canada, at priv.gc.ca.

California

The categories we collect are in section 2 and the list is the whole of it. You may ask what we hold, ask us to correct or delete it, and we will not treat you differently for asking.

We do not sell or share personal information as those words are used in the CCPA, and we have not in the twelve months before this page was written. We do not use or disclose sensitive personal information for anything beyond running the product.

Europe and the United Kingdom

This product is not offered to people in the European Economic Area or the United Kingdom: we do not price in euro or sterling, do not market there, and do not track anybody. If you are there anyway and want to know what we hold or want it deleted, ask and we will do it.

10. How it is kept

• Encrypted in transit and encrypted at rest.
• Every household separated at the database level, not by a filter in the code. The application refuses to start if it is connected in a way that could see past those walls.
• Passwords hashed. Two-factor secrets encrypted with a key kept away from both the database and the backups.
• Every administrative access across households is logged.
• A second step at sign-in is available to anybody who wants it.

11. Cookies

One cookie. First-party, HttpOnly, marked Secure in production, and strictly necessary: it signs you in and does nothing else.

No tracking cookies, no advertising cookies, no third-party cookies, and no analytics. The capture screen keeps unsent entries in your own browser so it works without a signal; signing out erases them.

Because nothing here is optional, there is no consent banner to click through.

12. If something goes wrong

If your data is exposed we will tell you what happened, what was in it, and what we did, in plain words and quickly. We will not wait for a lawyer to write a sentence that says nothing. Where the law sets a deadline for telling you or a regulator, we will meet it.

13. Children

This is for adults keeping a household book, and you must be 18 or older to use it. We do not knowingly hold data about anybody under 18. If we find that we have, we delete it and end the login.

14. Changes, and how to reach us

If we change this in a way that matters we will email you before it takes effect and say what changed in one sentence.

Bound Less Living Institute. Use the contact form, or write to P.O. Box 731184, Ormond Beach, FL 32173.

Last changed 4 August 2026.