1. Information we collect

• There is no sign-up or login. From the person who creates a ledger we receive one email address to recover the manage link (only if you enter it).
• The name people sharing a ledger enter on their device (e.g. Groom's father) is kept in the change history as who made a change.
• Guest information written in the ledger: name, group, amount given (number of bills and other amounts), notes.
• We don't take guests' phone numbers, bank account numbers or addresses. Please don't write them in notes either.
• Gift table devices and share links are used without an account.
• If you use 'Read the name from an envelope photo', the photo is sent to Anthropic (Claude API) for text recognition. Tie doesn't store the photo, and the name read is kept only in the ledger after you confirm it.
• To improve the service we collect visit statistics with Google Analytics (Firebase): the path of pages viewed, device and browser type, approximate region, and a random identifier stored in a cookie. Ledger contents and links (the part after # and ?id= in addresses) are not sent, and the data isn't used for ads. Blocking cookies in your browser or using the Google Analytics opt-out add-on stops collection.

2. How we use it

Only for recording, settling and sharing cash gifts, sending and recovering manage links, retention expiry notices and visit statistics. Never for ads or other services.

3. Retention and deletion

• 12 months after the event date (or, if no date was entered, the day the last entry was added), the whole ledger (entries, guest list, email, links, history) is deleted automatically. We notify you 30 days before (by email if registered) and delete only 30 days after notifying.
• The holder of the manage link can extend by 12 months once, or delete immediately at any time.
• Backup retention is set so data also disappears from backups within 35 days of deletion.

4. Who can see it

• Only people with a link: the manage link, edit/view links and share links the owner creates and sends, and gift table QR + PIN.
• Anyone who has a link can open it. Revoke links you no longer need, and reissue the manage link if it leaked.
• The operator doesn't look at ledger contents except when truly necessary, such as handling an outage.

5. How we keep it safe

All communication is encrypted (TLS), and the database and backups use encryption at rest. All links and gift table PINs are stored only as hashes, never in plain form.