Privacy Policy

1. Overview

AccountHouse helps households track shared expenses, income, budgets, payables, Split groups, documents, and related tools. During beta, access is by invitation or approved interest registration. We aim to collect only what is needed to operate the service, send account and security notices, and improve reliability.

We do not sell your personal data. Household financial entries you create belong to your household context and are not used for advertising profiles.

2. Data we collect

• Account data — name, email, username, household membership, and role (admin, member, or viewer).
• Financial and product data you enter — expenses, income, budgets, payables, categories, Split payments and settlements, goals, asset registry entries, card labels, shopping lists, calendar reminders, and similar records you choose to store.
• Documents (DocuVault) — files you upload. Client-side encryption is used so document contents are not stored as plain readable files for routine server browsing; unlock is gated by your PIN (and on mobile, biometrics where enabled).
• Technical and security data — session metadata, IP address at sign-in, approximate location hints derived for session display, device or browser type, push notification tokens on Android, and security event logs (for example sign-in, 2FA, session revoke, password reset).
• Beta interest form — name, email, household details, and any message you submit when requesting access.
• De-identified receipt price observations (ForeSense) — if your household owner turns on receipt-price sharing, the individual product lines on receipts you scan — the item as printed, its size and quantity, its price, the shop and branch, the date and the currency — are recorded separately from your household data. Card numbers, loyalty and member numbers, cashier and customer names, phone numbers, e-mail addresses, web addresses and long digit runs are removed before anything is stored. These records carry no account, no household and no link back to you (see Household isolation, below, for the limits of that guarantee). Receipt totals, payment methods, who was shopping and household names are never included, and pharmacy receipts and medical lines are rejected in full.

3. How we use data

• Provide dashboards, analytics, alerts, Split, DocuVault, calendar reminders, and household collaboration.
• Authenticate you, enforce roles and permissions, and maintain sessions across web and mobile.
• Send transactional email and Android push for budgets, payables, login notices, 2FA codes, calendar reminders, and security recovery when required.
• Detect and respond to suspicious sign-in activity (see Security below).
• Operate and improve the beta service, including diagnosing outages and abuse.
• With the household owner’s consent, pool de-identified receipt price observations across households to produce the price ranges, basket estimates and shop suggestions ForeSense shows. This is the only place where information derived from your household’s receipts is pooled into a shared record that other households read, it is off unless the owner turns it on, it can be turned off at any time, and it never involves anything that identifies a person, a household or an account (see Household isolation, below, for the limits of that guarantee).

4. Security practices

Security is layered. The following describes controls available in the current suite release (6.26.1) across web 5.1.11 and Android 4.2.1. Availability of optional features depends on your Settings and device capabilities.

4.1 Account authentication

• Passwords are stored hashed; they are not kept in clear text.
• Email verification supports account activation; password reset uses email recovery flows.
• Optional email two-factor authentication (2FA): after password check, a one-time code is sent to your registered email and must be verified on web and mobile before the session is established.
• Successful sign-ins can trigger login notification email and push.

4.2 Sessions and audit

• Active sessions are listed in Settings (web and mobile) with device and location context where available. You can revoke other sessions remotely; that ends access on those devices, including sessions that were opened from the Android app.
• A security activity log records events such as sign-in, 2FA-related actions, session revoke, and password reset so you can review recent access.

4.3 PIN, app lock, and biometrics

• An optional account PIN can hide sensitive views (for example income and related totals), gate app lock, and unlock DocuVault, card amount reveals, goals, bank accounts and payment instruments where those options are enabled.
• Optional app lock on web (PIN) and Android (PIN, with biometric unlock on supported devices) adds a local gate when the device stays unlocked but the app should not.
• Biometric data (fingerprint or face) is processed by the device platform. AccountHouse does not receive or store your biometric templates on our servers.

4.4 Suspicious activity and account security lock

• Automated monitoring looks for patterns such as failed-login bursts, repeated 2FA failures, credential spray across addresses, and sign-ins from unfamiliar locations.
• When activity appears abusive, an account may be placed under a security lock, which blocks normal access until recovery completes through the email recovery path.
• Elevated alerts may also be reviewed by system administrators so incidents are not ignored during beta operations.

4.5 Household isolation

Data is scoped to your household. Roles and permissions limit what each member can see or change on web and mobile. Other households cannot access your ledger through the normal product APIs.

ForeSense is the one deliberate exception, and it does not weaken that boundary: it holds de-identified price observations in a separate store that has no account or household column at all, so ForeSense itself has no route from a price back to a household. De-identified is not the same as untraceable in every case: where very few households in a market are sharing, someone who separately holds a copy of one of your receipts could in principle match it to a shared price; broader participation is what closes that gap. No household ever reads another household’s ledger, entries, receipts or totals.

5. Sharing

We do not sell personal data, and we do not share it for advertising. We use the following providers to run AccountHouse, each processing data under our instructions and only for the purpose named:

• Google Cloud — hosting, the database, file storage, and the optical character recognition behind receipt scanning.
• Google Gemini — the optional AI features, where you have enabled them, and only for the request you made. It also answers the assistant on our public pages: what you type there, and the recent turns of that conversation, are sent to Gemini to compose a reply. That assistant is not a support channel — please do not type anything into it you would not put on a postcard, and use support@theaccounthouse.com for anything about your own account.
• Google Maps and Places — maps and place lookup on the location screens.
• Firebase Cloud Messaging — push notifications to the Android apps.
• Mailgun (EU region) — email delivery.
• Vercel — serving the web apps.
• LiveKit — household voice and video calls, where your household uses them.
• Google reCAPTCHA Enterprise or Cloudflare Turnstile — bot protection on public form pages.
• Frankfurter — published exchange rates. We ask it for rates between currencies; it receives nothing about you.

The approximate location shown beside a session in your session list is worked out on our own servers from a local database, not by asking an outside service where you are.

We may disclose information if required by law or to protect the service against abuse or fraud.

Where a household owner has turned on ForeSense receipt-price sharing, the de-identified price observations described in section 2 are readable by other households of the service as price ranges and estimates. They are not sold, not licensed to third parties, and not used for advertising. They contain no personal data: no name, no account, no household, no total and no payment method, and, within the product itself, no way to look up which household a price came from (see Household isolation, above, for the limits of that guarantee).

6. Retention

We retain account and household data for as long as your household remains active in the beta, and for a limited period afterward as needed for security, backup integrity, and legal obligations. Security logs are kept long enough to investigate access issues. Interest-form data is retained to process access requests.

De-identified ForeSense price observations are kept for up to 730 days and are not deleted when an account is deleted. They carry no identity and belong to no household, so there is nothing of your household left in them to return or erase (see Household isolation, above, for the limits of that guarantee), and removing them would remove the price ranges other households rely on. For the same reason they are not part of a household backup archive. Everything that does belong to your household — entries, receipts, documents and lists — is purged on deletion as described above.

7. Your choices

• Enable or disable email 2FA and app lock in Settings (where available).
• Revoke other sessions from Settings on web or mobile.
• Use PIN and biometric options to limit what appears on shared devices.
• Request access correction or deletion during beta via your household administrator or the contact path below.

8. Cookies and browser storage

AccountHouse uses cookies and browser storage only to sign you in and keep you signed in safely. We do not use advertising cookies, analytics cookies, tracking pixels, or any third-party tracker, and nothing here is used to profile you or follow you across other websites. Because all of it is strictly necessary to provide the service you asked for, we do not show a cookie consent banner.

• Session cookie — identifies your signed-in session. It is HttpOnly, so page scripts cannot read it, and it is cleared when you sign out.
• Installation identifier — a random value, kept for up to a year, that lets the service recognise the same browser across the AccountHouse sites. It is used for security — recognising a new device, showing you your own session list — and is not linked to any advertising or analytics profile.
• Local storage — holds your session and its security token so a reload does not sign you out, plus small preferences such as which company workspace you last had open and whether the sidebar was collapsed. It stays on your device.
• Site assistant counter — if you ask the assistant on our public pages a question, a signed HttpOnly cookie (ah_mkt_rag, kept for seven days) holds a random identifier and the number of questions asked, so the assistant can apply its per-browser limit. Your question and the reply are also kept in this tab’s own storage so the conversation survives a page change; they are discarded when you close the tab. Nothing about the conversation is stored on our servers, and neither the cookie nor the tab storage is used to profile you or follow you elsewhere.

Clearing cookies and site data in your browser removes all of the above and signs you out. Blocking cookies for this site will prevent sign-in from working.

Two third-party components can set cookies of their own, and neither runs until you open the screen that needs it. A Google map loads when you choose a location for an expense or open the location map, under Google’s privacy policy. A bot-protection check (Google reCAPTCHA Enterprise or Cloudflare Turnstile, depending on configuration) loads on public form pages, to stop those forms being submitted by scripts; it reads signals about the browser for that purpose only. Neither is used for advertising.

9. Children

AccountHouse is intended for adult household administrators and members they invite. It is not directed at children under 16, and we do not knowingly collect personal data from a child under 16. A household administrator who adds a member under 16 is responsible for holding parental consent for that member’s data. If you believe a child has provided personal data without appropriate consent, contact us at the address in section 11 and we will delete it.

10. Changes to this policy

We may update this policy as the beta evolves. Material changes will be reflected here with a new “Policy last updated” date and, where appropriate, matching suite / web / Android version references. Continued use after an update constitutes acceptance of the revised policy for beta participation. Related product terms are in our Terms of Service.

11. Who we are, and how to contact us

AccountHouse is operated by IA Systems, based in Dubai, United Arab Emirates. IA Systems is the controller of the personal data described in this policy.

For any privacy request — access to your data, correction, a copy of it, or deletion of your account and its contents — write to support@theaccounthouse.com or use the contact form. We answer usually within one business day. You can also delete your account yourself from Settings, which exports a backup first and then purges your data — see section 6.

Report a security incident involving your account to the same address as soon as you can. If you are not satisfied with how we have handled a privacy request, you may complain to the data protection authority in your country.