Skip to content
ShillingShilling

Shilling Privacy Policy

Effective date: October 9, 2026
Developer: Josh Phillips
Contact: josh@shilling.finance

This policy covers:

  • the Shilling household budgeting app on Android (package finance.shilling.android), iOS, web (app.shilling.finance), and desktop, along with the hosted Shilling service at api.shilling.finance (together, the "app"); and
  • the Shilling website at shilling.finance (the "website"; see section 5).

It explains what data each one handles, where that data goes, and the choices you have.

1. Summary

  • Your budget data stays on your devices. Accounts, categories, schedules, transactions, imported CSV rows, and receipt images are stored on your device. They are never uploaded to Shilling servers.
  • Device sync is peer-to-peer. If you sync between devices, your budget data goes directly between your devices over encrypted WebRTC connections. Our server only helps devices find each other. It does not receive, store, or relay your budget data.
  • App usage analytics are optional and off by default. If you turn them on, the app sends a small fixed set of anonymous usage events to PostHog.
  • Website analytics are always on. The shilling.finance website records anonymous page views and download clicks with PostHog for every visitor, and it uses a PostHog cookie to do so. See section 5 for how to block this.
  • We do not show ads, sell your data, or use third-party crash reporting.

2. Ways to use Shilling

  • Guest / hosted mode: The app creates an anonymous account with our authentication provider (Supabase) so your devices can sync. You can later upgrade it to an email account.
  • Self-hosted mode: You connect the app to a Shilling server that you or someone else runs. That server's operator, not us, is responsible for the data the server handles.

3. Data stored only on your device

The following data stays in local storage on your device (an on-device SQLite database and app settings):

  • Budget accounts, categories, schedules, transactions, and balances
  • CSV files you choose to import, plus the transactions created from them
  • Receipt images you attach, whether taken with the camera or picked from your files
  • App settings, such as server address, analytics choice, a random analytics installation ID, a device ID, and your saved sign-in session (access and refresh tokens)

Android cloud backup is turned off for this app (allowBackup="false"), so Google's automatic app backup does not copy this data. If you uninstall the app or reset it, this data is deleted from that device.

4. Data sent off your device

4.1 Account and sync metadata (hosted mode)

To run accounts and device sync, our hosted service (using Supabase) stores:

  • A user ID and account tier (anonymous/guest or registered)
  • Your email address, if you upgrade from a guest account or sign in with email. We use it for sign-in and account confirmation emails, which are sent through our email provider, Resend.
  • A password, if you set one. Supabase Auth stores it in hashed form. We also store whether a password has been set.
  • A household / "finance space" ID, the space's name and type (for example "Home" or "Business"), and your role and membership in each space
  • Device registrations: a random device identifier for each device in a space, the time it was registered, and which account registered it

When your device contacts our server, the server receives your IP address as part of normal network traffic. Server, access, and TURN relay logs, which may include IP addresses, are kept for about 30 days and then deleted. Email delivery logs held by Resend are also kept for about 30 days.

4.2 Peer-to-peer sync

When sync is active, your devices send connection setup messages through our signaling server. These messages contain network addresses and session descriptions, not budget data. To discover network paths, devices may contact a STUN server (by default Google's public STUN server, stun.l.google.com), which sees your IP address. If you are on a paid plan and turn on Cloud relay, encrypted WebRTC traffic may pass through a TURN relay server. The relay cannot read the contents.

4.3 Subscriptions

If you buy a Silver or Gold subscription, the purchase is processed by Google Play and managed through RevenueCat. RevenueCat receives your Shilling user ID and your purchase and subscription status. Our server checks your active entitlements with RevenueCat. We do not receive your payment card details.

4.4 Optional usage analytics (PostHog)

Analytics are off by default. They are sent only if you turn on Share usage events during onboarding or in Settings → Product analytics. When analytics are on, the app sends these events directly to PostHog Cloud in the United States:

  • onboarding completed (with mode: guest, hosted, or self-hosted)
  • budget account created
  • schedule created (with type: expense, income, or transfer)
  • one-off transaction saved
  • CSV import completed
  • receipt attached

Each event includes a random installation identifier. This identifier is separate from your login, household, and device identifiers. Events never include balances, amounts, transaction descriptions, account or category names, filenames, receipt or CSV contents, household IDs, or error text. We do not use autocapture, session replay, or error capture. PostHog receives your IP address and uses it to estimate an approximate location (this is not GPS location). You can turn analytics off at any time to stop future events. Turning analytics off does not delete events that were already sent.

5. Website (shilling.finance)

This section covers the marketing and documentation website at shilling.finance. It does not cover the web app at app.shilling.finance, which is described in sections 2–4.

5.1 Website analytics (PostHog), always on

Unlike app analytics, website analytics are on for all visitors. There is no opt-out switch on the site. When you visit, the site sends these to PostHog Cloud in the United States:

  • Page views and page exits: the page address, the referring page, and basic browser and device details such as browser type, operating system, screen size, and language
  • Button clicks: clicks on "Open Web App" and on download links. A download click records which platform, file format, and release you chose.

We do not use automatic click capture or session recording, and we do not create a named profile for website visitors. PostHog receives your IP address and uses it to estimate an approximate location (country, region, city).

5.2 Cookies and local storage

The site does not use advertising or cross-site tracking cookies. It uses:

  • A PostHog analytics cookie (ph_<project>_posthog), plus matching browser local storage. It holds a random visitor ID and session information so that repeat visits can be counted together. It is set on shilling.finance and lasts up to one year.
  • A theme preference (light or dark) saved in your browser's local storage. It never leaves your browser.

5.3 How to limit website analytics

  • Block or delete cookies and site data for shilling.finance in your browser settings. Blocking them stops visits from being linked together.
  • Use a content blocker or a privacy-focused browser that blocks PostHog (us.i.posthog.com). This stops website analytics completely.
  • Using a private or incognito window gives you a new visitor ID each time.

5.4 Other services the website uses

  • Hosting: Cloudflare Pages serves the site and receives standard request information, including your IP address, to deliver and protect it.
  • Blog: blog posts and their images are loaded from WordPress.com, which receives your IP address and browser details when you view the blog.
  • Downloads: download links point to GitHub release files. GitHub's privacy policy applies when you download from GitHub.
  • No forms: the website has no sign-up, waitlist, or contact forms and does not ask for your email address.

6. Device permissions

  • Internet: used for sign-in, sync signaling, subscriptions, and optional analytics.
  • Camera: used only when you choose to photograph a receipt. Photos stay on your device and are shared only with your own synced devices.

The app does not access your location, contacts, microphone, or SMS.

7. What we do not do

  • We do not sell or rent personal data.
  • We do not use data for advertising and do not include advertising SDKs.
  • We do not connect to your bank. Live bank connections are not available.

8. How we use data

We use the data described above only to provide accounts, device sync, plan limits and subscriptions, and, if you opt in, to understand which app features are used. We use website analytics to understand traffic to the website and interest in downloads.

9. Security

Connections to our servers and the website use HTTPS/TLS. Sync traffic between devices is encrypted by WebRTC (DTLS). Our database restricts account metadata so that only our server can access it.

10. Retention and deletion

  • On-device data: You can delete it by resetting the app or uninstalling it.
  • Account data: We keep account data for as long as your account exists. You can delete your account at any time from within the app. If you can no longer access the app, email josh@shilling.finance to request deletion. Within 30 days of your deletion request, we remove your account profile, email address, space memberships, and device registrations. Budget data stored on your devices is not affected; delete it by resetting or uninstalling the app.
  • Device registrations: Space owners and admins can remove these in Settings.
  • Server and email logs: About 30 days, as described in section 4.1.
  • Analytics (app and website): PostHog keeps analytics events for up to 12 months and then deletes them. Analytics events are not linked to your account. To ask about deleting them, email josh@shilling.finance.
  • Website cookie: The PostHog cookie expires after up to one year. You can delete it at any time in your browser.

11. Children

Shilling is not directed at children under 13, and we do not knowingly collect their personal data.

12. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data. To make a request, contact josh@shilling.finance.

13. Changes to this policy

If we update this policy, we will post the new version at this URL and change the effective date above.

14. Contact

Josh Phillips, josh@shilling.finance