Privacy

Lobby Boy stores financial details about trips you take with other people. This page says exactly what is kept, where, and who can see it.

Who is responsible

Lobby Boy is operated by [OPERATOR NAME], [ADDRESS]. For anything on this page, contact [CONTACT EMAIL].

What is stored

• Your identity. Name, email address and profile image, handled by Clerk, our authentication provider. We never see or store your password.
• Your trips. Trip names, destinations, dates, and who is a member of each.
• Your expenses. Descriptions, amounts, currencies, exchange rates, dates, categories, who paid, and how each was split.
• Accommodation. Where you are staying, dates, and any confirmation code or booking link you enter.
• Receipt images you choose to attach to an expense.
• Settlements — records that one member paid another.

Who can see it

Trip data is visible to the members of that trip, and to nobody else. Every request is checked against your membership before any trip data is read; someone who is not a member cannot tell whether a given trip exists at all.

Receipt images are stored privately and are served only through a request that checks your membership first. A leaked image link does not, on its own, give access.

Bear in mind that the other members of a trip can see the expenses you add, including ones you mark private — marking an expense private means it does not affect what anyone owes, not that it is hidden.

Processors we use

• Clerk — authentication and your account details.
• Neon — the database holding trip and expense data.
• Vercel — hosting, and private storage for receipt images.
• Sentry — error reports when something breaks. Configured to strip request bodies and headers, so expense amounts and receipts are not sent.

These providers process data on our behalf and may store it outside your country, including in the United States.

How long it is kept

Trip data is kept until it is deleted. Deleting an expense hides it from balances but retains the record, because other people's figures were calculated against it. To have your account and its data removed entirely, contact [CONTACT EMAIL].

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to how it is processed. Contact [CONTACT EMAIL] and we will respond within the period the applicable law requires.

Changes

If this page changes in a way that affects what is stored or who can see it, we will say so before the change takes effect.

Last updated: [DATE].