Privacy Policy

Effective: August 16, 2026 · Last updated: August 25, 2026

The Jar is operated by Karen Situ ("we", "us"). This policy explains what the app collects, why, who else can see it, how long we keep it, and how you delete it.

The short version: The Jar keeps a shared record of small agreements between people. It has no analytics, no advertising, no trackers, and no third-party SDKs other than the one that talks to our own database. It never holds, moves, or transfers money.

1. Who this applies to

The Jar is for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe someone under 18 has an account, contact us at karensitu@ymail.com and we will delete it.

2. What we collect

2.1 Information you give us when you sign in

We use Sign in with Apple, and we ask it for one thing: your name. Apple gives us a unique account identifier, and — on your very first sign-in only — the name you approve. We do not receive your Apple ID password, and we do not ask for a password of our own.

We do not receive your email address at all. The app never requests the email permission, so there is nothing for "Hide My Email" to hide from us and no address on file to market to. We store the account identifier to keep you signed in and to recognize you across devices.

2.2 Information you give us about yourself

Display name — the name shown to other people in your jars.
Venmo username (optional) — used for one purpose only, described in section 4.

2.3 Information you create in the app

Jars — name, icon, color, settlement schedule, time zone, payout label, join code.
Rules — rule text, icon, penalty amount, frequency cap, who the rule applies to, who may report it, and whether it requires confirmation.
People you add — the display names of people you invite or keep score for, and, if you picked them from your Contacts, the phone number their invite was texted to. You may add a name for someone who has no account. If they later join, that name becomes theirs to change, and the number is no longer used for anything.
Reports — if you report a jar, the reason you chose and anything you wrote, together with which jar it concerns. Reports are read by us and are never shown to anyone in the jar.
Violations — which rule, who reported it, who it was about, when, the state (pending, confirmed, disputed, expired), the amount, and an optional free-text note you write.
Balances and settlements — the running ledger of amounts and the periods you have marked as settled.
Blocks — the list of people you have blocked.

2.4 Information collected automatically

Device token for notifications — if you allow push notifications, we store an Apple Push Notification service token so we can send them. Turning notifications off in iOS Settings stops this; signing out removes the token.
Notification records — a log of the notifications we queued for you (what kind, which jar, when, and whether it was sent), used to enforce the per-jar rate limit so the app cannot spam you and to make sure a reminder is sent once. Retired within about a day.
Standard server logs — our hosting provider records IP addresses and request metadata for security and reliability. These are not linked to your app activity for any other purpose.

2.5 What we do not collect

We do not collect or use: your address book, your photos, your location, your health data, your advertising identifier (IDFA), your browsing activity, or your activity in other apps. The Jar contains no analytics SDK, no advertising SDK, and no crash-reporting SDK. Because we do not track you across apps or websites, the app does not present an App Tracking Transparency prompt.

On Contacts specifically: when you invite someone "from Contacts", iOS shows its own picker outside the app and hands us only the name and number of the people you tap. The app never reads your contacts and never asks for permission to — there is nothing to grant. The invite itself is sent by you, from Messages, on your phone; we never send a text.

We do not collect your own phone number. Sign-in by SMS exists in the codebase but is disabled and unreachable.

3. Why we collect it, and our legal basis

Account identifier — to create and secure your account. Basis: performance of our contract with you.
Display name and avatar color — to identify you to the other people in your jars. Basis: contract.
Jars, rules, violations, and the ledger — this is the service. Without it there is nothing to keep score with. Basis: contract.
Venmo username — to prefill a payment in Venmo when you choose to. Basis: consent, and it is optional.
Invitees' phone numbers — so you can re-send an invite to the same person. Basis: our legitimate interest in making an invite you chose to send actually reach them; you can invite by name instead and no number is stored.
Reports — to review and act on abuse. Basis: legitimate interest in keeping the service safe.
Device token — to deliver the notifications you asked for. Basis: consent.
Notification log — to enforce our own rate limit and send reminders once. Basis: legitimate interest.
Server logs — security, fraud prevention, reliability. Basis: legitimate interest.

4. Venmo

If you add a Venmo username, the settlement screen can show a button that opens the Venmo app with a payment amount and note already filled in.

Nothing is sent to Venmo by us. The link is constructed on your device and opened by your device. We never contact Venmo's servers, we never learn whether you sent a payment, and no payment ever flows through The Jar. Whatever happens after you leave the app is between you and Venmo, under Venmo's own terms and privacy policy.

Adding a Venmo username is optional. Other people in your jar can see it.

5. Who else can see your information

5.1 Other people in your jars

This is the part worth reading carefully, because The Jar is a shared record by design.

Everyone in a jar can see: the jar's name and settings, every rule, every violation including the notes you write on them, every amount, the full history, and the display name and Venmo username of everyone in it.

Do not write anything in a note that you would not want the other people in that jar to read. Notes are not private and cannot be edited or deleted once the 60-second undo window closes.

Violations you report against someone who has not yet joined will become visible to them when they join.

5.2 Service providers

We use two, and neither uses your data for their own purposes:

Supabase — hosts our database and handles authentication. Data is stored in the United States (AWS us-east-1, Northern Virginia). Supabase acts as our data processor under a data processing agreement.
Apple — provides Sign in with Apple and the Push Notification service.

Both are contractually required to protect your data to at least the standard described in this policy and to use it only to provide the service to us.

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not disclose it to advertisers, data brokers, or AI training services.

5.3 Legal requests

We may disclose information if we are legally required to, or where we believe in good faith that it is necessary to protect someone's safety or to investigate fraud or a violation of our Terms.

6. How long we keep it

While your account exists, we keep your data so the app works.
When you leave a jar, your entries stay in that jar's history for the other members, because deleting them would remove other people's records too. Any outstanding balance is cleared, not collected.
When you delete your account, see section 7.
Notification logs are kept only as long as needed for rate limiting and to send each reminder once — about a day.
Invitees' phone numbers are kept for as long as the invite is open, and are removed with the jar. Reports are kept while they are being reviewed and for a reasonable time afterwards so a pattern can be seen.

7. Deleting your account

You can delete your account from inside the app: Settings → Delete account.

When you do:

Your profile, display name, Venmo username, blocks, and device tokens are deleted.
Any jar you own is handed to its longest-standing member. If nobody else has an account, the jar and everything in it is destroyed outright.
In jars where other people remain, your membership row is stripped of all identifying information and relabeled "Former member", so other people's history stays readable. It is no longer connected to you.
Outstanding balances are cleared, not collected. Nobody is billed and nobody is paid.

Deletion is immediate in the app and completed in our systems and backups within 30 days. It cannot be undone.

You can also revoke The Jar's access to Sign in with Apple at any time in iOS Settings → your name → Sign-In & Security → Sign in with Apple.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict how we use it, and to withdraw consent.

You can do most of this in the app directly: edit your profile, remove your Venmo username, manage blocks, and delete your account. For anything else — including a copy of your data — email karensitu@ymail.com and we will respond within 30 days.

If you are in California: we do not sell or share your personal information as those terms are defined by the CCPA/CPRA, and we will not discriminate against you for exercising your rights.

If you are in the EEA or UK: our legal bases are in the table in section 3. You have the right to lodge a complaint with your local supervisory authority. Karen Situ is the data controller.

9. Security

Data is encrypted in transit (TLS) and at rest. Access to your data is enforced at the database level by row-level security policies, so one account cannot read another account's jars even if the app were modified. We do not store passwords, because we do not use them.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and any required regulator as the law requires.

10. Children

The Jar is 18+. See section 1.

Note that an adult may use The Jar to keep score for someone who does not have the app, including a child in their own household. In that case the adult types a name and reports on that person's behalf. That person has no account with us, and the only information we hold about them is the name the adult typed. If you are that person's parent or guardian and want that name removed, contact the account holder, or email us at karensitu@ymail.com.

11. International transfers

Your data is stored in the United States (AWS us-east-1, Northern Virginia). If you use The Jar from outside that region, your information will be transferred there. Where required, we rely on Standard Contractual Clauses or an equivalent transfer mechanism with our processors.

12. Changes to this policy

If we change this policy in a way that materially affects how we handle your information, we will tell you in the app before the change takes effect and update the date at the top.

13. Contact

Karen Situ
karensitu@ymail.com
Postal address available on request by email