Flatwise Privacy Policy and Privacy Notice

1. Who provides Flatwise and the scope of this notice

The service provider and data controller for Flatwise is Orçun Demir, operating under the Moonshot Labs brand. You can contact us about privacy and data-rights requests at support@moonshotlabs.app. This notice covers the Flatwise app and related support. The separate privacy notice for the Moonshot Labs website and early-access list also applies to those services.

This notice provides information required, where applicable, by the EU General Data Protection Regulation (GDPR), the UK GDPR, and Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK). Reading this notice or using the app does not amount to blanket consent to every processing activity.

2. Data we process and where it comes from

We receive data from you, from shared records entered by other members of your household, from the sign-in or payment provider you use, and from technical records created while the service operates.

• Account and profile data: email address, sign-in provider and its account identifier, Flatwise user identifier, display name, the illustrated avatar you choose, language, and currency preferences. Flatwise has no password of its own: you sign in with Sign in with Apple or Sign in with Google, handled through Supabase Auth. With Apple, we receive your Apple account identifier, the email address Apple shares (a private relay address if you choose Hide My Email) and, on first sign-in, the name you let Apple share. With Google, we receive your Google account identifier, email address, name, and a link to your Google profile photo. The shared name only prefills the display name you confirm after sign-in. Flatwise does not show or download the Google photo; choosing an illustrated avatar replaces the link, and account deletion removes it.
• Signing in on Android. On Android you sign in with your Google account. Android's Credential Manager shows Google's own account sheet; Google then gives Flatwise a signed token with your Google account ID, your name, your email address and the address of your Google profile picture, and our backend (Supabase) uses it to create or open your Flatwise account. We use your name to prefill the nickname you confirm, which your housemates see; you can change it at any time. We store the address of your profile picture with your profile but do not download or show the picture; choosing one of Flatwise's illustrated faces replaces it, and deleting your account removes it. Flatwise never sees your Google password.
• Household data: household name, time zone, currency, membership and administrator role, join and departure dates, periods when a member is away, and invitation details.
• Shared content: chore titles and notes, schedules, assignments, completion history and points; shopping lists, items, buyer information and notes; and household-board posts.
• Shared financial records: expense and bill titles, amounts, currencies, payer, shares, dates, category, notes, and payment or settlement records between members. This also includes receipt images you choose to attach. We do not connect to your bank account, and the app does not require you to enter a full payment-card number.
• Subscription data: Apple transaction and product identifiers (on Android, the Google Play purchase details described in section 5), their association with your Flatwise account, purchase and restore events, renewal, expiry, refund and grace-period status, and Premium entitlement. Apple processes payment details in its own systems; we do not receive full card details.
• Support requests: when you use "Report to support" on a subscription notice in the app, we store the topic, your optional message, the email address of your account (so that we can reply), the household concerned when the app includes it (only one you are a member of), and the app version, build, iOS or Android version, language, and the notice shown. No device identifier is added. Emails you send to support@moonshotlabs.app are also support requests.
• Technical data: session and synchronization events, limited error, security and diagnostic records, and information used to prevent invitation abuse. If you enable notifications, we process the device push token, delivery environment, language, delivery state, and notification preferences. When you open the paywall or buy, restore, or renew Premium, the Adapty SDK also sends your device's identifier for vendor (IDFV) and device metadata (see Adapty in section 5). Internet services necessarily receive an IP address when a connection is made. The precise device and operating-system information available to infrastructure providers depends on their service logs and settings.

3. Purposes and legal bases

Under the GDPR, we rely on the following legal bases for the relevant processing. Granting an optional device permission does not change the legal basis for unrelated processing.

• Creating an account, authenticating you, storing and synchronizing shared household content, and providing purchased features: performance of the service contract you request, Article 6(1)(b) GDPR. These features cannot be provided without the necessary account and household data.
• Preventing unauthorized access and abuse, maintaining reliable synchronization, verifying subscriptions, keeping limited diagnostic records, and providing support: our legitimate interests in operating the service securely, Article 6(1)(f) GDPR, and performance of the contract where applicable. You may object to processing based on legitimate interests, and we will consider your interests and fundamental rights.
• Records required by accounting rules, lawful requests from public authorities, and other applicable obligations: compliance with a legal obligation, Article 6(1)(c) GDPR. Limited records may also be retained where necessary to establish, exercise, or defend legal claims.
• Optional notifications: enabled through your notification preference and the relevant device permission. Where this processing relies on consent, Article 6(1)(a) GDPR, you may withdraw it. Disabling notifications does not delete the underlying household records.
• Under the KVKK, the applicable basis may be formation or performance of a contract (Article 5/2-c), compliance with a legal obligation (5/2-ç), establishment, exercise or protection of a right (5/2-e), legitimate interests that do not harm fundamental rights (5/2-f), or explicit consent where required.

4. Sharing with members of your household

Current members of a household you join can see that household's shared chores, assignment and completion history, away status, shopping records, expenses, shares, settlement records, bills, board content, and attached receipts. Your display name and profile information may also be visible within the household. These shared areas are not a private personal journal.

Share invitation links only with people you want to join. Leaving a household, deleting your account, or uninstalling the app does not automatically erase shared history from other members' accounts or copies they previously obtained. We consider the rights of other members when handling access, deletion, and copy requests.

5. Service providers and other recipients

We do not sell personal data or share it for behavioral advertising. The following recipients process data only as needed to provide the service or meet lawful obligations.

• Supabase: authentication, database hosting, private file storage, synchronization, realtime updates, in-app support requests, and server functions. Flatwise's main project is configured in the eu-central-1 region. This does not mean that every support operation, log, backup, or subprocessor activity necessarily remains in the same country.
• Adapty (subscriptions): when you open the paywall or buy, restore, or renew Flatwise Premium, the Adapty SDK sends Adapty your Flatwise account identifier, your App Store subscription and transaction details, the identifier for vendor (IDFV) of your device, and device metadata (device model, operating-system version, language, time zone, and user agent). Adapty uses this to verify purchases, keep your subscription status current, and measure how the paywall performs. Flatwise disables advertising-identifier (IDFA) and IP-address collection in the SDK; network providers may still receive the connection IP address. Household content is not intentionally sent to Adapty. Adapty acts as our processor.
• Adapty and Google Play (subscriptions on Android). On Android, Flatwise Premium is bought, renewed and restored through Google Play billing; Google handles the payment and Flatwise never receives your card details. When you sign in, open the paywall, or buy, restore or renew Premium, the Adapty SDK sends Adapty your Flatwise account ID, your Google Play purchase details (product, purchase token, subscription status and history), the Android ID of your device and an ID Adapty creates for this installation, and device information (device model, Android version, language, time zone, the user agent of your device's web view, app version and the country of your Google Play store), together with an event each time the paywall is shown. Adapty uses this to verify purchases, keep your subscription status current and measure how the paywall performs. Flatwise passes your account ID to Google Play with a purchase so the subscription can be matched to your account. Flatwise turns off the collection of the advertising ID and of your IP address in the SDK, leaves out Google's App Set ID, and does not use install attribution. Adapty acts as our processor; see adapty.io/end-users-privacy.
• Apple: Sign in with Apple, App Store payments and subscriptions, and APNs notification delivery. When you delete an account created with Sign in with Apple in the iPhone app, we ask Apple to revoke Flatwise's sign-in token. Apple applies its own privacy terms to its services.
• Google: Sign in with Google, when you choose it (on Android, it is the only way to sign in); Google shares the account data described in section 2. Google applies its own privacy terms to that service. On Android, Google also provides Google Play billing and Firebase Cloud Messaging notification delivery, described in this section and in section 6.
• Support and infrastructure providers: email and technical details you send to support may be processed by communications and infrastructure providers. Send only information needed for support; do not send passwords, one-time codes, or full card details.
• Public authorities and professional advisers: only where necessary to comply with an applicable obligation or valid request, or to protect legal rights.

6. Device permissions, local records, and notifications

When you attach a receipt, Flatwise receives the image you select with the system photo picker; it does not scan your entire photo library. The current app does not request location, contacts, microphone, or camera access for its core features. An image may be resized and converted to JPEG before upload.

Notifications are optional and can be disabled in the app and in iOS settings. Content such as a chore title may appear on the lock screen. You can control preview visibility in iOS. Delivery depends on the device and network.

Notifications on Android. Reminders on Android are delivered through Google's Firebase Cloud Messaging. Only after you turn notifications on does the app ask Firebase for a registration token for this installation (Firebase creates an installation ID for it); we store that token with your account, your phone's language (to write the reminder in it) and whether notifications are on, so our backend can send you chore and money reminders. The text of a reminder is a short generic line written by our server; it passes through Google to reach your phone. When you turn notifications off or sign out, we try to mark the registration as off and the app tries to delete the token on your phone; once the token is deleted, it can no longer receive anything, and if deleting it fails, the app tries again the next time it starts. The switched-off entry stays with your account until it is replaced by newer ones (we keep at most 20 per account) or you delete your account, which removes all of them. Google acts as our processor for this delivery.

For offline use, a copy of household data, operations waiting to synchronize, and preferences are stored on the device. When a session ends, the app clears its local cache, outgoing-operation queue, and staged receipt files. Uninstalling the app does not delete the server account or cancel an Apple subscription.

7. Retention and deletion

We retain account and shared household data for as long as needed to provide the service. Some delete actions first mark a record as deleted so that deletion can synchronize and shared financial history remains consistent. Disappearance from a screen does not mean immediate permanent erasure from servers and backups.

We assess private account data separately from shared household records when handling an account-deletion request. Other members' expense and settlement history, related receipts, and shared content may remain where needed to preserve the shared ledger or protect rights. Identifying profile fields may be removed or reduced, but remaining user or transaction links mean those records should not always be treated as fully anonymous. Deleting a household with only one remaining member may remove a broader set of records.

Retention criteria include whether the account or household remains active, synchronization needs, unresolved expenses or disputes, security reviews, and applicable legal obligations. Support and diagnostic records should be erased or de-identified when their purpose ends; in-app support requests are deleted with your account in any case; backup copies are removed according to the provider's backup cycle. We do not state a fixed retention period where one has not been operationally established. You may contact us for the criteria applied to your request.

Where the installed version offers an account-deletion option, you may start a request in the app. If the option is unavailable or the process cannot be completed, contact support@moonshotlabs.app. The production deletion workflow may depend on current server configuration, so the appearance of an in-app control alone does not guarantee that every cleanup step has completed. For an account created with Sign in with Apple, the iPhone app asks you to confirm with Apple once more so that we can revoke Flatwise's Apple sign-in token. If you are the only member of your household, the household is deleted with the account. A household administrator may first need to transfer the administrator role. That does not prevent you from submitting a data-rights request. An Apple subscription must be cancelled separately through Apple.

Deleting your account (Android). In the Android app go to More → Settings → Delete account (the same option is in your profile, on the household setup screen and in the paywall's Account menu). Your sign-in, email address, notification registrations, subscription records with us and in-app support requests are deleted at once, you leave your household, and your profile becomes "Deleted member" without a name or picture; your Adapty profile and the receipt photos that are not part of a shared expense are removed shortly after by a background job. If housemates remain, the household and everything in it stay for them — expenses, settlements, receipts attached to expenses, chores and their history, shopping lists, bills and board posts — with your entries shown as "Deleted member", so their balances and history remain correct. If you were the household's last member, the household and all its content are deleted too. If you are the only admin of a household that still has other members, hand the role to a housemate first. Deleting your account does not cancel a Google Play subscription: cancel it in Google Play → Payments & subscriptions. You can also ask us to delete your account without the app: see moonshotlabs.app/flatwise/support or write to support@moonshotlabs.app.

8. International processing

Cloud, subscription, Apple, and support services may process data outside the country where you live. This can include support access or subprocessor activity from outside the European Economic Area. We do not promise that all data remains only within the European Union.

Where the GDPR applies to a restricted transfer, a valid adequacy decision or another appropriate safeguard, such as applicable standard contractual clauses and any necessary supplementary measures, must be used. Transfers subject to the KVKK must likewise follow the transfer conditions in force. You may ask us for information about relevant providers, processing locations, and safeguards applicable to your data. This notice is not itself a transfer agreement, proof that a particular safeguard has already been executed, or blanket consent to international transfers.

9. Your rights and how to make a request

Depending on applicable law, you may have rights to access and receive a copy of your data, correct inaccurate data, request deletion, restrict processing, object to processing based on legitimate interests, and receive or transfer eligible data in a structured, commonly used, machine-readable format. You may withdraw consent for future processing where consent is the legal basis. Your rights under Article 11 KVKK, including rights to information, correction or deletion, notice to recipients, and other statutory remedies, remain available.

Send a request to support@moonshotlabs.app, preferably from the email associated with your account (if you used Apple's Hide My Email, say so, so that we can match the request to your account), and describe its scope. We may verify your identity using proportionate methods; do not send a password or unnecessary identity documents. GDPR requests are answered without undue delay and generally within one month; if the law permits an extension, we will explain it within the initial month. KVKK applications are concluded as soon as possible and no later than thirty days.

The expense CSV generated in the app is a local snapshot of non-deleted expenses in the selected household. It does not include every category of personal data, all server records, settlement details, splits, or receipt files, and it is not a complete data-rights export. Broader access and portability requests can be assessed through support, subject to other people's rights and applicable exceptions. You may complain to the competent data-protection authority where you live or work or where an alleged infringement occurred, including the Turkish Personal Data Protection Authority or the UK Information Commissioner's Office where relevant.

10. Automated chore allocation and access checks

Chore assignments may be calculated from the allocation mode selected for the chore, member availability, rotation order, completed and pending chore points, and chore history. Members can change chores, allocation settings, or assignments to the extent allowed by their role and the app. Premium access is checked against Apple and Adapty subscription status. Reminder eligibility is checked against chore status, household membership, Premium status, device registration, and notification preferences.

These processes organize household activity and control access to purchased features. We do not use them to build advertising profiles, and the service is not designed to make solely automated decisions that produce legal or similarly significant effects. Contact support if an assignment or access result appears incorrect.

11. Children and sensitive content

Flatwise is designed for adults managing a shared household and is not directed to children. If you are below the age at which you can enter into the relevant agreement or give valid permission where you live, do not use Flatwise without the required involvement of a parent or legal guardian. Tell us if you believe a child's data has been processed without the required permission.

Do not add unnecessary health information, identity documents, full payment-card numbers, or another person's sensitive information to chores, notes, receipts, or household-board posts.

12. Security and changes to this notice

Flatwise uses HTTPS in transit, session authentication, household-membership access controls, and private receipt storage. Protection of local data also depends on the operating system and your device-security settings. Authorized systems used to operate the service can process the data; Flatwise does not promise end-to-end encryption.

We will update the date shown on this page when this notice changes. If a new purpose or permission requires additional notice or consent, we will provide it as required. Send questions to support@moonshotlabs.app.