Privacy Policy

Who runs Parejo

Parejo is operated by a sole proprietor based in Florida, United States — one individual, not a company. It is available at https://parejo.pickline.app and runs on a private virtual machine hosted with Oracle Cloud.

Reach us at support@parejo.pickline.app about anything on this page.

What we hold about your account

When you register we store your email address, the display name you choose and which plan tier your account is on. If you unsubscribe from announcements, we also store when you did, so we stop sending them.

Parejo has no passwords. To sign in — or to confirm that you want your account deleted — you ask for a six-digit code and we email it to you. We never store the code itself: we keep a one-way hash of it, a hash of the email address it was sent to, when it expires (ten minutes later) and how many times someone tried to enter it. A code works once, and expired codes are deleted the next time anyone asks for a code, a day after they expire at the earliest.

Each time a code is requested, and each time one is entered wrongly, we record the event so that repeated requests and guessing can be slowed down and then temporarily blocked. That record holds a hash of the email address involved, a hash of the IP address the request came from, and the time; neither is stored in readable form. A successful sign-in clears the record of wrong codes for that account. A record stops counting after fifteen minutes, and a daily clean-up deletes it — in practice within a day, and never more than two.

One exception exists, and it is not yours. A single dedicated account, named in the server’s configuration, is used by Apple’s app reviewers, who cannot read our email: it accepts one fixed code set on the server instead of an emailed one. That account holds only demonstration data and cannot send any mail. No ordinary account can use that path.

What you put into Parejo

The rest of what we hold is what you enter: the groups you belong to, the expenses you record (amount, currency, date, note and category), who paid and how each expense splits, settlements between members, any custom categories and recurring expenses you set up, and the converted amounts we calculate when a group uses more than one currency — together with the date of the exchange rate used and where that rate came from.

This data exists so that the app can do its job. We do not analyse it for advertising, and we do not sell it or rent it to anyone.

Receipts and other attachments

You can attach an image or a PDF to an expense. Those files are stored as private files on the operator's server disk, outside any web root, readable only by the system user the app runs as.

Alongside the file we store its original file name (with unusual characters replaced and the name trimmed to 120 characters), its size, its type, a SHA-256 checksum of its contents, which group and expense it belongs to, who uploaded it and when. The file itself is stored under a random identifier, never under the name it arrived with.

Receipts are never public and have no shareable link. Every download goes through a membership check: only a signed-in member of the group the receipt belongs to can fetch it, and anyone else gets a 404. Files are served with Cache-Control: private, no-store and X-Content-Type-Options: nosniff, so browsers and intermediaries do not keep copies of them.

Before an image is stored we strip its embedded metadata, including EXIF GPS location and camera information. Only JPEG, PNG, WebP and PDF files are accepted, and we check that by inspecting the file's actual contents rather than trusting its name.

Scanning a receipt in the iPhone app happens on your phone. The text is read by Apple's on-device text recognition, and Parejo's own code in the app turns it into an amount, a date, a merchant and a list of items. The photo is not sent to any text-recognition service, ours or anyone else's. What reaches Parejo is what you save: the expense, and the item lines with their amounts and who had each, which are stored with the expense and visible to the group like the rest of it. If your plan includes receipt storage, the photo is also attached to the expense as a receipt, as described above; if it does not, the photo is read and then discarded. We count how many scans a Free account has used, and nothing else about them.

What the other people in your group can see

This is the most important thing to understand about Parejo. Anyone who is a member of a group can see that group's expenses and the receipts attached to them, including the expenses and receipts you added.

If a receipt shows something you would rather other members not see, do not attach it.

If you no longer want someone to see a group’s contents, note who can act: only the group’s owner can remove a member, so ask the owner if that is not you. You can leave a group yourself at any time — and if you are the owner and you leave, the group passes to its longest-standing other member rather than closing. An owner can also delete the group outright, which deletes its expenses and its receipts for everyone in it. Removing someone does not remove the expenses they already recorded: those stay with the group, because the rest of the members’ balances are built from them.

Family plans: what the person who pays can see

A Family plan is paid for by one person and can cover up to five other people, each on their own Parejo account. The person who pays invites people by email address. Nobody joins a household unless they accept the invitation themselves, signed in with the address it was sent to.

To send an invitation we store the address it went to, when it was sent, when it expires (seven days later) and a one-way hash of the single-use code in its link — never the code itself. The email shows the display name of the person who sent it, not their email address. Accepting links the invitation to your account and deletes that hash, so the link stops working. An invitation that is declined or cancelled is deleted; one that expires stays on the payer’s list, marked expired, until they send it again or cancel it.

The person who pays can see, for each person in their household, their display name, the email address the invitation was sent to, and whether they have joined or are still invited. They also see one number for the whole household: the total receipt storage it uses.

They cannot see anything else about you through the household: not your groups, your expenses, your balances, your receipts, or how much storage you use yourself. Being in a household changes nothing about who can see a group — that is still decided only by who is a member of it, as described above.

Paying does not make them your account’s owner in any other sense. They are Stripe’s customer, not you: the card, the receipt and the renewal are theirs, your card is never involved, and nothing about how you use Parejo reaches them because they pay.

If someone’s Family plan covers you, you see their display name and that you are covered. You can leave the household at any time from Your plan, and the person who pays can remove you; either way your own plan applies again at once, and your groups and expenses are not touched. If their Family plan ends, the household stops covering anyone but keeps its list of members, so it covers them again if the plan restarts. Deleting your account removes you from any household; deleting the account of the person who pays deletes the household.

If your employer uses Parejo for expenses

A company can use Parejo to handle employee expenses. If yours does, it invites you by email address and you join with your own Parejo account — the same account, the same sign-in, and any personal groups you already have. You are not moved anywhere and nothing of yours changes.

Nobody joins a company without accepting the invitation themselves, signed in with the address it was sent to.

In a company space you submit claims: an amount, a currency, a date, a category, a merchant, sometimes a project or cost centre, an optional note, and usually a receipt photo. Someone at the company reviews each one and approves, partly approves, returns or declines it. When they pay you, they record that they did. Parejo never moves the money itself — your employer pays you the way it always has.

What the company can see about you: your name, the email address it invited, the roles it gave you, whether you have accepted, and the claims and receipts you submitted to that company — with their history of what was submitted, what was changed, when, and by whom. Your drafts are yours alone until you submit them; nobody at the company can see a draft, including approvers and the owner.

What the company can never see. Not your personal groups. Not your expenses or balances outside the company. Not your receipts outside the company. Not which personal plan you are on, or whether you pay for one. Not whether somebody else’s Family plan covers you. And not that you belong to any other company — not even that one exists. An invitation sent to an address that already belongs to another company behaves exactly like one sent to an address with no Parejo account at all, so nothing can be inferred from the difference. This is enforced in the code that reads company data, which never touches the tables holding your personal side, and not only by a policy.

Paying for a seat gives a company no ownership of your account in any other sense. A company seat covers your use of that company space. Your personal plan is your own and is not changed by it.

Your claims stay with the company. If you leave it, are removed, or delete your Parejo account altogether, the claims and receipts you submitted to that company stay with it, under the name you had. They are its financial records — the evidence behind money it paid you — and not only yours. What ends is your access to that company space. Your personal Parejo is untouched, and deleting your Parejo account still deletes everything personal exactly as described below.

Because those claims belong to the company, it is the company — not Parejo — that decides what happens to them. If you want your expense data corrected or removed, ask your employer. Parejo holds it on the company’s behalf and follows the company’s instructions about it. If you ask us, we will tell you that, and tell the company you asked.

The company chooses how long it keeps claims and receipts — up to ten years, seven by default — after which Parejo deletes them automatically. As everywhere else in Parejo, something deleted can still exist inside a backup for up to 14 days, after which it is gone.

What a Parejo administrator sees: company metadata only — the company’s name and currency, who owns it, how many people and claims it has, how much receipt storage it uses, and its billing status. Never your claims, your receipts or your history — and where a billing figure counts how many people were active in a month, the administration screens show the count and never the names.

A receipt can say more than you think. It can carry an address, a partial card number, the time you were somewhere. The people at your company who review expenses will see the receipts you attach. That is the point of them; it is worth a second’s thought before attaching one.

Paid plans and payments

Paid plans bought on this website are billed by Stripe. Paid plans bought in the Parejo app for iPhone are billed by Apple as App Store subscriptions, under Apple's terms; Apple handles their renewal, cancellation and refunds, and we receive the transaction, the plan and its dates — never your card.

Stripe is the merchant of record for the sale. You buy through Link, Stripe’s checkout, and it is Stripe — not Parejo — that takes the money, is responsible for sales tax, VAT and GST, runs the fraud checks, sends your receipt and your renewal reminders, and handles refunds and disputes. Your card details, and the name and billing address Stripe collects in order to work out tax, are given to Stripe and never reach Parejo. We could not show them to you if you asked. Card statements read LINK.COM* PAREJO.

What Parejo itself stores about a payment is: your Stripe customer identifier and subscription identifier, the identifiers of the invoice, payment and charge behind each payment, the amount, Stripe’s fee, what was left after it, the currency, which plan was bought and when the paid term ends. Refunds and lost chargebacks are recorded the same way, as negative entries. None of it includes a card number, and none of it can be used to charge you.

Opening checkout is what creates that customer record at Stripe, and it is created whether or not you go on to pay — so having a Stripe customer record does not mean you were ever charged. This is why this page does not say, as it once did, that no payment information of any kind is collected.

We also keep an audit trail of plan changes: the tier before and after, who made the change, and any note. It exists so that a wrong plan or an unexpected charge can be explained afterwards. Switches between Stripe’s test and live modes are recorded the same way, with the administrator who made them.

Stripe’s own privacy policy covers what Stripe does with your data: https://stripe.com/privacy. You can ask Stripe directly to delete what it holds about you. When Stripe acts on such a request it cancels the subscription and redacts its own records; Parejo is told the subscription ended, and your Parejo account is unaffected.

If you are invited before you have an account

A member can invite someone to a group by email address. If that address has no Parejo account yet, we store it together with a display name made from it, add it to the group as invited, and send one invitation email. Group members can include an invited person in expenses straight away, so their share appears in the group before they have signed up.

If you create an account with that address, those records become part of your account. If you never do, they stay until you ask us to delete them — write to support@parejo.pickline.app.

Who else your data reaches

We do not sell your personal information and we do not share it for advertising. There is no ad network and no data broker in this picture; the one measurement tool we use, Google Analytics, is described below.

A few companies touch it because they run the machinery underneath, and it is only fair to say what each of them can see. Oracle Cloud hosts the single virtual machine that runs Parejo: its database and every receipt file sit on that machine’s disk. Stripe, through Link, takes payments as merchant of record — the only one on this list that ever sees your card details, and the one that holds the name and billing address it collects for tax and sends you your receipts. A third-party email host (cPanel SMTP) sends our outgoing mail and holds the support@parejo.pickline.app mailbox, so it sees every address we write to, every subject line and the contents of those messages — including the sign-in codes we email you and anything you tell us in a support conversation. The European Central Bank’s reference rates, which we fetch through the Frankfurter API, are asked for a currency pair and a date and are sent nothing about you at all.

Those four are the only outside services Parejo’s server sends anything to on your behalf. Apple’s public App Store feeds are read once a day as well, but that is a one-way read of Parejo’s own rating and its public reviews; nothing about you is sent there.

Each of them acts on our behalf and gets your data for nothing else.

One more company receives something, from your browser rather than from our server: Google, through Google Analytics. When a page of this site loads — in a browser or inside the Parejo app for iPhone, which shows the same pages — it tells Google which page was opened and when, the rough location the connection comes from, and the kind of device and browser in use, so that we can see how many people visit, which screens they use, and whether people manage to sign up and buy a plan. We send Google no email address, no name and no account identifier; invitation links and record identifiers are removed from the page addresses before they are reported; and the Google Analytics advertising features (“Google signals” and ads personalisation) are switched off, so this data is measurement for us and feeds no advertising. Google’s privacy policy covers what Google does with it: https://policies.google.com/privacy.

We would also disclose information where the law requires it — a court order or a valid legal demand. If that happened we would tell you, unless we were forbidden from doing so.

Cookies

We set a session cookie when you sign in. It is HTTP-only, which means page scripts cannot read it. It keeps you signed in while you use Parejo: each day you use the app moves its expiry back out to 30 days, so it ends after 30 days without use — and in any case 180 days after you signed in, when you will be asked to sign in again. We also set two small cookies that remember choices you make — your language and whether you prefer the light or dark theme. Each holds only that choice and lasts a year.

Two more are set only while something is in progress. Between asking for a sign-in code and entering it, an HTTP-only cookie holds the address you typed — and, if you are registering, the name — so the code page knows who is signing in without putting your address in a URL, where it would end up in server logs and browser history. It lasts fifteen minutes. And if you open a Family plan invitation link, an HTTP-only cookie holds that invitation’s code for up to a day, so it survives signing in; accepting or declining the invitation removes it.

Google Analytics sets its own cookies — named _ga, and _ga_ followed by our property’s code — so that it can tell a returning browser from a new one. They hold a random identifier that Google generates, nothing about you, and last up to two years. One more small cookie, set the moment an account is first created and removed by the next page, carries the single character that tells that page to count the sign-up; it lasts at most ten minutes. Apart from those, there are no advertising cookies, no third-party trackers and no ad networks on this site.

Email

We send you email when it is part of using Parejo: sign-in codes, group invitations, invitations to join someone’s Family plan, replies about support requests, and occasional announcements about the app.

Those messages leave through an outside email hosting provider, which handles them on our behalf and therefore sees the address we send to and what the message says. We do not give that provider your data for any other purpose.

Announcement emails contain a small open-tracking image, served by Parejo itself, which records that the message was opened. That record holds the address the announcement was sent to, which announcement it was, how many times it was opened, and when it was first and last opened. Nothing about it is shared with anyone else, and ordinary mail — sign-in codes, invitations and support replies — is not tracked. Announcement emails include an unsubscribe link, and unsubscribing stops them for good.

Support conversations

If you write to support@parejo.pickline.app, or open a request from the Support page in the app, we keep the conversation so we can help you: your email address, your name as it appears on your account or your email, the subject, and the messages in both directions.

Email you send to that address arrives in a mailbox hosted by the same outside email provider described above, which therefore holds a copy of it.

Support conversations are not deleted automatically, and deleting your Parejo account does not remove them: the conversation stays, no longer linked to an account. Ask us at support@parejo.pickline.app and we will delete it. When a conversation is deleted we keep only a note that it existed — its reference number, how many messages it had, and when and by whom it was deleted — and never what it said.

Exchange rates

When a group mixes currencies, we convert amounts using the Frankfurter API, which publishes European Central Bank reference rates.

We only ask it for a currency pair and a date. No personal data, and nothing about you or your group, is sent with that request.

Rates we have already fetched are cached on our own server, and a daily job fetches the pairs your groups actually use before anyone needs them, so that saving an expense does not depend on an outside service answering at that moment. That cache holds currency codes, dates and rates, and nothing about anybody.

Server logs and job records

Like almost every website, the web server in front of Parejo writes a line for each request it handles: the IP address the request came from, the time, the page or file requested, the page that linked to it, and your browser’s identification string. We use these logs to keep the service running and to investigate abuse, and they are deleted after about two weeks.

Parejo’s own application logs record errors and events such as an email having been sent. They are not written to record your IP address or the addresses we send email to. When something fails, though, the error is logged as it is — a mail server refusing a message, say, or a database error — and an error message can occasionally include an email address. The system journal these go to keeps 30 days.

Two plain-text files on the server are kept longer, around six months: the log of the scheduled jobs and the log of the nightly backups. They record that a job ran and the counts it reported — how many rates were fetched, how large a dump was — not who did what.

Parejo also records one row for each run of each scheduled job: which job, when it started and finished, whether it succeeded, and a one-line summary. Without it a job that quietly stopped running would leave no trace anywhere. The summary is cleaned before it is stored — email addresses are replaced with a placeholder and anything that looks like a password, token or key is redacted — and these rows are kept indefinitely.

Where your data lives, and backups

Everything lives on one private virtual machine, operated by the person who runs Parejo. The database is dumped every night on that same server, and those local dumps are kept for 14 days before they are deleted.

This is worth knowing, because it is the one place deleted data can persist for a short while: something you remove today can still exist inside a nightly dump for up to 14 days, after which that dump is deleted.

Who at Parejo can see your data

Parejo is run by one person, who administers the server and the database underneath it. That access is complete, in the way any server administrator’s is: technically, everything stored here can be read, including group contents and receipt files. We do not read them. We would rather write that plainly than imply a separation that does not exist.

The administration screens inside Parejo deliberately show much less. They list accounts (email address, display name, plan, whether the account is an administrator), groups with their members and pending invitations, how many receipt files a group holds and how many bytes they occupy, support conversations, and the record of plan changes. They do not show anyone’s expenses, balances or receipts.

An administrator can also act: add someone to a group or remove them, cancel an invitation, delete a group, change an account’s plan, send announcements, and delete an account. An administrator who added themselves to a group would see its expenses like any other member — and would appear in that group’s member list, exactly like anyone else.

A small number of operator accounts, named in the server’s configuration rather than flagged in the database, belong to the people who run Parejo. They are never charged, never counted in revenue figures, and cannot be deleted through the admin screens.

How we protect it

Connections to Parejo use TLS, so what travels between your device and the server is encrypted in transit.

There are no passwords to steal: sign-in codes are stored only as scrypt hashes, expire after ten minutes, work once and stop working after five wrong tries, and repeated requests or wrong entries are slowed down and then temporarily blocked. Receipt files sit outside any web root, readable only by the system user the app runs as. The database accepts connections only from the server itself.

No system is perfect and we would rather say so than claim otherwise. If you find a weakness, write to support@parejo.pickline.app and we will fix it.

Children

Parejo is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. You must be at least 13 to have an account.

If you believe a child under 13 has given us personal information, write to support@parejo.pickline.app and we will delete it.

How long we keep your data, and deleting it

We keep your data for as long as your account exists.

You can delete your account yourself, in the app, at Settings → Delete account. You do not need to ask us. It removes your profile, your sign-ins, your group memberships, the expenses and recurring expenses you created, the receipt files you uploaded, invitations you sent, and your share in other people's expenses and in settlements — which changes the balances the rest of the group sees. It is permanent and there is no undo.

Doing it yourself takes effect immediately. If you would rather we did it, or you cannot sign in, write to support@parejo.pickline.app and we will delete your account within 30 days — except where the law requires us to keep something, or where the deletion is held up by something neither of us can wave away: a group you still own has to be deleted or handed to another member first, and a subscription has to be cancelled at Stripe, which needs Stripe to be reachable. If either is holding it up we will tell you, rather than leave you wondering.

Three things to know before you do it. Expenses that other people created stay with their group, because they are part of that group's shared record and not only yours. If you own a group, Parejo asks you to delete it or hand it to another member first. And any support conversations you have had with us are not removed with the account — ask us and we will delete those too.

If you have a paid plan, deleting your account cancels the subscription at Stripe first. If that cannot be done at that moment, the deletion is refused and you are asked to try again, rather than leaving a subscription renewing for an account that no longer exists.

Some records outlive the account on purpose, and it is fairer to say so than to discover it later. A payment we recorded keeps its Stripe identifiers, its amounts and its dates, with the link to your account removed — a business has to be able to account for money it received. If an announcement email was sent to you and its open was tracked, that record keeps the address it was sent to. Support conversations stay unless you ask for them to go. And Stripe keeps its own record of the sale under its own policy: ask Stripe if you want that removed.

Once an account is removed, the 14-day backup window described above is the only place its data can still briefly exist.

Your rights

Access — you can ask what personal data we hold about you, and we will tell you. Write to support@parejo.pickline.app.

Correction — your display name you can change yourself in Settings. For anything else that is wrong, write to us and we will correct it.

Deletion — you can delete your account and its data yourself, in the app, at Settings → Delete account. If you would rather we did it, or you cannot sign in, write to support@parejo.pickline.app.

Export — every group has a CSV export of its expenses and settlements, available from the group to any member whose own plan includes it. For a copy of anything else we hold about you, write to us.

Changes to this page

If this page changes, the “last updated” date at the top changes with it. We will not quietly broaden what we do with your data.