Privacy

What we hold

Your name and the email address or phone number you signed up with. The groups you are in and the people in them. Every expense you or they record: what it was, what it cost, who paid, how it split, and anything written in its comments. Any photo you choose to keep on an expense, and a group's cover photo. The devices you are signed in on, with the date each was last used. If you have bought Pro, a receipt from the store confirming it — never a card number, which we are never shown.

When you ask for a sign-in code by text message, we keep a note of the request for ninety days: when it was, whether it was sent or refused, whether the code was used, the country of the number, the number with all but its last few digits hidden, and the internet address the request came from. It is there to spot someone using our sign-in to send texts to strangers' phones, and it is deleted with your account. If you write to us from the website or the app, we keep your message, your name and the address to reply to for as long as we need them to help you, and delete them with your account.

When you sign in with a phone number, the app asks Apple (App Attest) or Google (Play Integrity) to confirm the request comes from a genuine copy of Antemate on a genuine device, to stop automated abuse of our text-message codes. On Android we send Google the resulting token and get back only whether the app and device passed; on iOS the check is between your device and Apple, and we keep a device key that identifies the app install, not you. The result is kept with the sign-in request record and deleted after ninety days.

What we never touch

Your bank. Your card. Your GPS location. Your other apps. We do not buy data about you and we have nothing to sell about you.

Antemate never connects to your bank and never asks for a bank login. If you choose to import a statement you downloaded from your bank yourself (Pro), the file is read once to show you its lines and is not kept. Only the lines you tick become expenses in the group, and before they are saved their descriptions are checked for abusive content by OpenAI's moderation service, like anything typed. The running balance and the account number in the file are never stored or shown to anyone.

Your contacts stay on your phone. When you add friends, the app shows your address book so you can pick people — only if you allow it, and you can always type a number or email instead. The people you tick are the only ones sent to Antemate: their name and the number or email you chose, so they can be invited and linked when they join. The rest of your address book is never uploaded, and we do not use it to find out who else is on Antemate.

When you add somebody by number or email, the other people in that group see who they were invited as, masked: the first letter and the domain of an email (j•••@gmail.com), or the start and the last three digits of a number (+61••••••678), so everyone can tell two Sams apart without seeing anyone's details. For a person who has not joined, we keep a one-way hash of the number or email they were invited with, which is how the place becomes theirs when they sign up and confirm it, and that masked form. Both are kept for as long as the group is, and are erased with the person's own account if they make one and later delete it.

Your face and your fingerprint stay on your phone too. App lock, which you can switch on under You → On this phone, asks your phone to check it is you — with Face ID, a fingerprint or your passcode — and the phone tells the app only yes or no. Antemate never sees or stores anything about your face, your finger or your passcode.

The home-screen widget shows nothing until you add it to your home screen yourself — the app never puts it there. Once added, the app writes what you are owed and what you owe, across your groups and friends, and the three biggest of those balances into storage on your phone that only the widget reads; nothing is sent anywhere. Anyone who can see your home screen can see it. If you turn on app lock, the widget goes blank unless you switch it back on under You → On this phone, where you can also switch it off at any time. It is never offered on the lock screen, and switching it off or signing out clears the figures at once.

Pressing and holding the Antemate icon shows shortcuts: adding an expense with the people or groups you used most recently, scanning a receipt, and settling up or translating a menu. On an iPhone each one can say where that balance stands. The list is kept by your phone's own system, is never sent anywhere, and shows no amounts while app lock is on. Signing out clears it.

"Your spending" adds up your share of the expenses already in your groups and friendships, on our server, when you open it. Nothing new is collected for it, nothing is stored from it, and nobody else sees it — not even the people you split with.

The ledger is shared, so the group can see it

Everyone in a group sees its expenses, its balances, who paid what, and every edit anybody made. That is the product working. It also means an expense you add is not private to you, and the person you add by email will be able to read the whole group's history once they join. A group's checklist is shared the same way, with who ticked each item.

The ways you like to be paid (a PayID, a UPI id, a Venmo username…) are shown to the people in your groups who owe you money, on the screen where they settle up — and to nobody else. If a rail has its own app, tapping it opens that app with your handle filled in; Antemate never sees the payment.

Anyone in a group can make a read-only link to it, so a friend without the app can see where the money stands. Whoever holds the link can open a web page showing the group's name, each person's first name and balance, who should pay whom, and the most recent shared expenses — what each was, how much, who paid and when. Beside a payment owed to someone, it shows the payment handles that person saved in the app to be paid with (a PayID or a PayPal address, say) — theirs only, and only while someone owes them. Apart from those, it never shows an email address, a phone number, a photo, a note or a comment. The page sets no cookie and is kept out of search engines. We keep only a fingerprint of the link, never the link itself. Anyone in the group can turn it off at any time, and it stops working the moment they do — and when the group is archived or deleted.

Reporting and blocking

You can report a comment, a photo, an expense or a person from inside the app. We keep a copy of what you reported, taken at the moment you reported it — so it can still be read if the person deletes it — with your reason and anything you add. A person at Antemate reads it and can remove a comment or a photo. The person you reported is never told who reported them. A copy of a reported photo is deleted once the report is decided; the words stay with the record of what was decided.

You can also block somebody. After that you don't see their comments, photos or profile photo, nothing they do notifies you, and they can't add you to a group or as a friend. They are not told. Expenses and payments they are part of stay in the groups you share, because other people's balances are calculated from them — leave the group, or ask its admin to remove them, to stop sharing it. You can undo a block under You → Blocked people.

When someone at Antemate looks

A small number of staff can see an account and the groups it is in through an internal tool: to answer a question you have sent us, to act on a request to delete an account or stop emails, to look into abuse or a security problem, or when the law requires it. Nobody browses it for any other reason.

Every time staff open an account or a group, it is recorded — who looked, what, and when — along with every change they make and the reason they gave. Signing in to the tool takes a password and a code from an authenticator app. The tool cannot add, edit or delete anybody's expenses, payments or balances: the ledger's history is the group's, and not even we can rewrite it. What it can remove is a comment, a photo or a profile photo somebody reported, when it breaks the terms.

What we measure, and what we don't

The app reports crashes, failures and some usage to three services, so we can find out that it broke before you have to tell us, and see which parts of it people actually use. It is switched on by default and you can switch it off in Settings, on the phone, whenever you like.

Sentry receives a report when the app crashes or hits an error: what went wrong, where in the code, which version and what kind of device. When the app shows you a failure that came from our servers — a sign-in code that could not be sent, a scan that did not work — Sentry is told that as well: which kind of failure, which kind of request and which part of the app. Never what you typed, and never the message itself. PostHog and Firebase Analytics receive events like "opened a group" or "added an expense", with a random identifier for your install so two events can be known to come from the same phone. Like any website, they also work out a rough place — a country or a city — from the internet address the report arrives from. The app never asks your phone where it is, and never sends a GPS position; switching the reports off stops this too.

What none of them receive is the ledger. Not an amount, not a description, not a group or a person's name, not an email address or a phone number. We do not sell any of it, we do not use it for advertising, and there is no advertising SDK in the app. If that ever changes it will be on this page before it is in a release.

Our servers report as well. When something breaks on our side, or a request fails in a way that stops something working for you, Sentry receives what went wrong in our code and the number of the account it happened to — not what you sent, not your name or email address, and not the ledger. Email addresses and phone numbers are taken out before a report leaves; a phone number appears at most with most of its digits hidden. That is about our code rather than your phone, so it carries on whatever the switch says. While the switch is on, the server also tells PostHog about each request the app makes, under the same random identifier as your install: which kind of request it was, whether it worked and how long it took. Never what was in it.

Turning it off in Settings stops the app sending anything to all three, and stops the server noting your requests. Crash reports are the one thing worth leaving on if you are undecided — a crash we never hear about is a crash that stays.

When a photo or a question goes to AI

We ask first. The first time you use receipt scanning, menu translation, Ask Antemate or adding an expense by sentence, the app says what will be sent and to whom, and sends nothing until you tap Allow. We record when you said yes, and you can take it back at any time under You → Privacy → AI features — after that the four ask again, and our server refuses them until you do. Everything else in Antemate works without it.

One check is not one of those features, and does not wait for your yes. Before anything typed into Antemate is saved — what an expense was for, its notes and lines, a comment, a payment's note, the name of a group, a person, a pot or a friend, your own name, the ways you like to be paid, a checklist item, the lines of a bank statement you import, or a message to us — the words are sent to OpenAI's moderation service, which answers whether they break our rules. Photos you keep or scan are checked the same way. It happens for everyone, because what you write in a shared ledger is shown to other people, sometimes in their inbox or on their lock screen. Only the words go, not who wrote them or where. Words that have already been checked are not sent again: we remember the answer against a fingerprint of the words, never the words themselves.

Scanning a receipt or translating a menu sends that one image to OpenAI, which reads it and sends back text. It only happens when you tap the button, and we do not keep the image afterwards — you confirm the reading and the photograph is done with.

Asking Ask Antemate a question is the other time something goes to OpenAI. To answer it, the assistant reads that one group: its members' names, its expenses with who paid and each person's share, the comments on them, payments between members and what has happened recently. It sees only the group you are asking about, and only when you send a question. It cannot change anything — when you ask it to add an expense it shows you one to confirm, and nothing is added until you tap it. Nothing in the app sends your ledger to a model on its own.

Saying or typing an expense — "I paid 60 for dinner with Jo and Priya" — sends that one sentence to OpenAI, with the names of the people in that group so it can tell who you mean. What comes back fills in the expense form for you to check; nothing is added until you save it. When you say it rather than type it, your phone's own speech recognition turns your voice into text — Apple's on an iPhone, Google's on Android, under their terms, and it may use their servers to do it. Antemate never receives or keeps a recording, only the words. The microphone is only on while the button says it is listening.

Keeping a photo is a separate choice. When you add one to an expense, or set a group's cover, we store it so the group can see it: everyone in that group can view it, and nobody outside it can. Before it is stored it is checked for abusive content by OpenAI's moderation service, and it is re-saved from scratch — which strips the details a phone camera writes into every photo, including where it was taken. It stays until whoever added it removes it (or a group admin does), or until that person's account is erased, which deletes the photo itself and not just our record of it.

A profile photo is the same, with a wider audience: it is shown to everyone you share a group or a friendship with, in place of your initials, and to nobody else. It is checked and stripped the same way, kept small and square, and replaced or removed whenever you change it — the old file is deleted, not hidden.

What a notification says, and who carries it

When someone adds an expense you are on, records a payment to or from you, a repeating expense lands, or someone you owe sends a reminder (by tapping Remind, or on the group's weekly or monthly schedule), the app can tell you. The notification says which group, who did it, what it was for and your share — "Jo added Dinner — your share AUD 30.00" — because that is the point of it. It appears wherever your phone shows notifications, including the lock screen.

In a home or couple group, on the 1st of each month the app can also send a summary of the month just gone: what the group spent, your share, and who you owe or who owes you — "August: AUD 1,240.00 spent, your share AUD 410.00. You owe Jo AUD 62.50." It has its own switch, Monthly summaries.

When someone comments on an expense you are on, or replies in a thread you have written in, the notification also carries the first 120 characters or so of what they wrote — "Sam on Dinner: 'Wasn't this $16 each?'". So a comment you write can appear on the lock screens of the people the expense is split between and of anyone already in its thread. Nobody else in the group is sent it.

To reach your phone it passes through Google's Firebase Cloud Messaging and, on an iPhone, Apple's push notification service. They deliver it; they are not given anything else from the ledger or the thread. We keep the notification for a week so a question about one can be answered, then delete it.

Each kind can be switched off in the app under Account → Notifications, and all of them in your phone's own settings. A phone that signs out stops receiving them straight away.

Who else is involved

Everyone outside Antemate who handles anything about you, and what each of them gets:

• Amazon Web Services hosts our servers and database, and sends our email, in Sydney.
• Cloudflare carries every connection to antemate.com and to our servers — from this website and from the app — to keep them quick and to fend off attacks. It sees the internet address each request comes from as it passes the request on to us.
• OpenAI, in two ways. Its moderation service checks the words people type before they are saved, and the photos they keep, as described above. And when you use one of the four AI features, having said yes to them, it reads the photograph, the sentence or the question you sent.
• Twilio sends the code when you sign in with a phone number: it receives your number and sends the code to it by text message.
• Apple and Google take the payment for Pro and tell us only that it happened — and when it renews, ends or is refunded. So a purchase stays with the account that made it, we give the store a random identifier for your account with each purchase; it says nothing about you. They also confirm that a phone-number sign-in comes from a genuine copy of the app, as described above; deliver notifications, which carry the short line described above — including the start of a comment — and nothing more; and, if you say an expense out loud, turn it into text on your phone.
• Sentry takes the crash reports and the reports of failures that stopped something working, and PostHog and Firebase Analytics take the usage events described above — none of them ever sees the ledger.

That is the whole list. Linking Antemate with Yanvara is not switched on yet; when it is, the two apps will exchange exactly what you switch on and nothing else, you will be able to see it and revoke it in the app, and this page will say so first.

Cookies on this website

This website sets two cookies, and both are strictly necessary. There is no analytics, advertising or tracking on antemate.com, which is why you were not asked to accept anything.

• antemate-session keeps the site's forms — support, confirming an address, resetting a password — working between the page and the submission. The cookie itself holds only a random identifier. If the form turns down what you typed, the address is kept against it briefly so you do not have to type it again. It expires 4 hours after your last visit.
• XSRF-TOKEN proves that a form submission came from this site and not from another one pretending to be it.

The app is a different thing: what it measures, and who receives it, is described in What we measure, and what we don't above.