Shoddy privacy policy

1. Information on your device

You can use local-only Bill Groups without an account. Shoddy stores your groups, bills, due dates, recurrence settings, amounts and currencies, payment history, payment notes, payment website links, and reminder and appearance preferences on your device.

Local-only Bill Groups are not uploaded to Woodglue Studios or Supabase just because you sign in. Cloud storage starts when you explicitly enable backup or sharing for that group. Website icon requests, described below, can still occur for local-only bills.

Reminders are scheduled on your device. Notification permission lets Shoddy show them; notification content can include a bill’s name and due date. Visibility depends on your Android notification settings.

You can export a Bill Group as a JSON backup file to a location you select and import compatible files as local-only groups. These files can include bills, payment history, names and identifiers recorded in that history, and reminder settings. The export is readable JSON, not a password-protected archive. A file provider you choose may store the file in its own cloud service. Protect your exports and delete unwanted copies yourself. Shoddy cannot remove copies you have saved or shared.

2. Accounts, backup, and sync

If you create an account, your email address and password are sent to Supabase Authentication to create and authenticate your account. Supabase also handles verification and password recovery. Account information includes an account identifier and authentication records. Shoddy stores a session on your device so you can remain signed in.

You may set a display name, which is required for cloud backup and sharing and is visible to other Members of shared Bill Groups.

When you enable cloud backup or sharing for a group, Shoddy sends that group’s name, bills, schedules, amounts and currencies, notes, payment website links, payment history and attribution, and related identifiers and timestamps to Supabase. Memberships, permissions, invitations, activity records, and sync records support access control, collaboration, and synchronization across devices. Reminder preferences stay on each device.

These records are used to provide your account, backup, sync, and shared bill features. Shoddy does not connect to bank accounts or process bill payments. Avoid putting passwords, bank credentials, card numbers, or other sensitive information in bill notes or website links.

3. Who receives information

• Supabase: provides account authentication and the database used for cloud backup and shared Bill Groups. Network requests expose connection information such as your IP address. Authentication systems can record account events and request metadata for operation and security.
• Other Members: can access shared group information according to their permissions, including bills, notes, recorded payments, display names, and attribution. Treat invite codes as private: someone with a valid code can use it to join with the assigned permissions.
• Email services: handle verification, password recovery, account notices, and support messages. They receive the email address and message content needed to deliver or handle those messages.
• Website hosting: Cloudflare serves woodglue.studio and receives connection and request information, including IP addresses, when you visit.
• Provider websites and file destinations: receive information as described in the website and export sections of this policy.

The Shoddy app contains no advertising, analytics, or third-party crash-reporting SDK. We have not added trackers, cookies, or analytics scripts to this website. Hosting and authentication infrastructure can still process operational and security information. Data sent to a service provider is not necessarily limited to the country where you live.

4. Provider icons and payment websites

To display a provider icon, Shoddy can automatically request the payment website URL saved on a bill, then request an icon from that website or another host it identifies. Redirects can involve additional hosts. Those hosts receive your IP address, the requested URL (including its path and query, if any), and request information such as Shoddy’s user agent. This can happen without opening the payment link and without a Shoddy account. Icons are cached on your device.

Choosing a provider can populate its website link. If you do not want icon requests for a bill, leave its payment website field empty or remove the saved link. Removing a link does not undo requests already sent. If you open a payment website, your browser and that website handle your visit under their own policies.

5. Keeping and deleting information

Local records remain on your device until you delete the relevant local Bill Group, clear Shoddy’s app storage, or uninstall the app. Archiving an individual bill keeps its history; it is not permanent deletion. Clearing storage or uninstalling does not delete a cloud account, cloud records, or exported files. Device backup or transfer behavior can also depend on Android and your device manufacturer.

You can delete a local Bill Group, delete a cloud Bill Group you own, or leave a shared Bill Group you do not own from the group’s management screen. Leaving a shared group does not erase its bills or your historical contributions for other Members.

Account deletion removes your sign-in account and profile, cloud Bill Groups you own that have no other active Members, and their bills and payment history. For each shared group you own, you must choose another active Member as the new Owner. You lose access to all cloud groups, and the app attempts to remove that account’s cloud cache and pending edits from the device where deletion was performed. Local-only Bill Groups and other accounts’ caches are kept.

Shared records remain: shared bills and payment history remain available to other Members. Saved display names and historical attribution in membership, activity, and sync records can retain names and account identifiers. Account deletion does not erase every reference to you or copies held on other devices. A small device record of the deleted account identifier and cleanup state can remain to finish cleanup and prevent an obsolete session from restarting cloud work.

The deletion steps above describe active application records. They do not guarantee immediate erasure from service-provider backups, operational or security logs, email systems, or files saved elsewhere. This policy does not promise a fixed erasure period for those systems. Contact us about retained information or a specific privacy request.

For in-app instructions or to request deletion without the app, see Delete your Shoddy account.

6. Security and your choices

Cloud access uses authenticated sessions and database access rules to restrict group records to authorized accounts. The website is served over HTTPS. No system can guarantee complete security. Protect your device, account credentials, invite codes, and backup files.

You can use local-only groups without creating an account, choose which groups to back up or share, manage notification permission in Android, and contact us about access, correction, or deletion of your information.

7. Contact and policy updates

Email support@woodglue.studio for privacy questions or requests concerning Shoddy. Include enough information to locate the relevant account or record, but never send your password, verification codes, recovery links, or session tokens. We may need to verify that you are authorized to make a request.

Updates to this policy will appear on this page with a revised effective date.