1. Information we handle
When you sign in with Google or email, we receive the account information needed to identify your account, such as your email address and, when supplied by the provider, your name and profile image.
When you use Purchase Board, we store the voting presets you create, request details, prices, currencies, product links, images, member names and email addresses, votes, comments, and the outcomes you record.
The service also uses necessary cookies for authentication, anonymous voting identity, language, and theme preferences. Hosting and security providers may process basic request and device information under their own terms and privacy policies.
2. How we use information
We use this information to sign you in, keep your voting presets and requests available, deliver voting links, record votes, apply the voting rules you selected, protect the service, troubleshoot failures, and communicate about a request when you ask us to.
Purchase Board does not access your bank account, payment cards, or transaction history, and it does not make purchase decisions for you.
3. When information is shared
A voting link is a bearer link: anyone who obtains it may be able to view the request information exposed on that link and cast a vote. Share links only with the people you intend to invite.
We use infrastructure providers, including Supabase for authentication, database and file storage, and Cloudflare for hosting and delivery. They process information only as needed to provide their services and under their own applicable policies. We do not sell personal information or use it for targeted advertising.
4. Cookies and local storage
Authentication and voting cookies are necessary for the service to work. Preference cookies remember your language and theme. We do not use advertising cookies or third-party tracking pixels as part of the product. We count a few product steps, such as opening a shared link or starting a vote, as anonymous daily totals in our own database, with no cookie, account, IP address or device identifier attached.
Clearing cookies can sign you out or make an anonymous session and its records inaccessible from that browser. A guest session can be made durable by adding an email address before clearing it.
5. Retention and deletion
You can delete your account in the app or on the website through Account settings. This deletes your profile and voting presets, their requests and ballots, and your reports and policy records. Contributions attributable to you in other people’s voting presets and their requests are anonymized: your name, email, comments, images and identity links are removed while vote counts and decisions remain. Where another author is recorded, only the voter identity linked to your account is removed; that author’s content remains. Files are queued for deletion and failed deletions are retried by the operator. Limited copies may temporarily remain in provider backups or legally required records.
We record the last active time of a guest account and its requests to apply retention rules. Guest requests may be removed 90 days after they end or were last used, whichever is later. Requests without a deadline may expire after 180 inactive days and then remain for at least 90 days. Guest accounts with no remaining requests may be removed after 90 inactive days. Linking a permanent sign-in method excludes the account from guest cleanup. A shared voting link stops working when its request is removed.
6. Your choices
You may choose not to create an account and use a guest session where that option is available. You may also stop using the service, update account information, or request deletion through Account settings. Google account permissions can be reviewed or revoked in your Google account settings.
7. Security
We use access controls, row-level database policies, server-side handling for private voting data, and encrypted HTTPS connections to reduce unauthorized access. No internet service can promise absolute security, so protect your account and do not publish private voting links.
8. Changes and contact
We may update this policy when the service or its data practices change. The effective date above will change when a revised version is published. For privacy questions or deletion requests that cannot be completed in Account settings, use the contact details below.
9. Mobile app and content safety
The mobile app stores sign-in tokens and a random voting credential in the device’s secure storage. It uses that credential to remember anonymous voting, policy acceptance, reports and blocked authors. Removing local credentials may prevent us from identifying older anonymous contributions; account deletion also erases contributions linked to the verified credential currently active for that account on that device.
We record policy acceptance, adult eligibility confirmation, reports, author blocks and moderation actions to protect users. You can report a request, vote or author in the app and hide an author’s content by blocking them. The operator reviews reports and can remove content or suspend authors. This release has no advertising, purchases, subscriptions or cross-app tracking.
10. Shared choices, link seats and optional reminders
For a temporary choice or plan, the author may invite each person with a separate link and a display name instead of collecting email addresses. Confirming the name claims that seat for a random credential held by your browser. A name is not identity verification. The same browser can revise its response before closing and view the authorized result afterwards until the item is deleted or access ends. Clearing that credential may permanently lose access; creating an account does not automatically recover or transfer a claimed seat.
We store shared questions, options, responses, decisions and the purchase or expense records their authors provide. Link-seat credentials are stored as hashes on the server. Other participants do not receive private budget associations or invitation email lists, and sealed responses remain hidden until the existing reveal rules allow them.
Email reminders are optional and initially off. When a verified account enables them, we store its selected events, notification language and time zone. Reminder delivery uses Resend and the account’s currently verified email address. Item titles are hidden by default; you can choose to include them. Turning reminders off or confirming unsubscribe stops pending eligible reminders. Delivery diagnostics are kept for up to 30 days; minimal event markers remain with the item to prevent duplicate reminders. Account or item deletion removes the related notification data.
If you are signed in when you claim a seat, we record the account link to limit repeated claims and handle account deletion. Deleting that account removes the linked seat credentials, display name and response text while retaining anonymous choices and counts. Preference cookies also remember your browser time zone. A claimed link seat is separate from an anonymous author account and cannot be recovered by entering the same name. Contact the operator below if you need help identifying or deleting a contribution that has no account.