Privacy Policy
Last updated 30 October 2026
Sharky keeps your loans, payments, and the people who owe you on your own phone. Unless you choose to join a Shared Space, nothing you record leaves the phone, there is no account, and there is nothing to sign up for.
Shared Space is the one exception, and it is off until you turn it on: if you join one, the name you pick and the transactions you choose to share are stored on our server so the other people in that space can see them. You can leave, or delete all of it, from inside the app.
Third parties see anything only in narrow ways: RevenueCat, so a subscription you paid for stays unlocked, and which passes your advertising ID to Google Ads and TikTok to tell which ad brought you; Google AdMob, for ads in the free version; and Google Play or the App Store, for the purchase itself.
What stays on your device
Everything you do not put in a Shared Space. Loans, installment schedules, payment events, the posts and comments in your own feed, debtors, receivables, nudges, and agreements live in a database in the app’s private storage. Uninstalling the app deletes them.
Photos of receipts. When you scan a receipt, the image is read on your device by Google’s ML Kit text recognizer. The extracted amount, date, and reference number are what get saved; the recognition happens offline and the photo is not uploaded anywhere.
Camera and photo library access. Used only when you tap to scan or attach a receipt, or to scan a Shared Space invite code. The app never opens the camera on its own.
Reminders. Notifications are scheduled locally on your device. There is no push server, and we hold no device token.
Backups. If you export a backup, the file is encrypted with a passphrase you choose and handed to your own share sheet. We never receive it, and we cannot recover it if you lose the passphrase.
What leaves your device
RevenueCat: purchases
Purchases and subscription status are handled by RevenueCat. The app does not create an account for you: RevenueCat issues an anonymous identifier that is not linked to your name, email, or phone number. It receives that identifier along with the purchase and device information needed to validate a subscription. It never receives your loans, payments, contacts, or receipts. See the RevenueCat privacy policy.
The app also sends RevenueCat your device’s advertising ID and IP address. RevenueCat passes them to Google Ads and TikTok so we can tell which ad, if any, led to an install, a free trial or a purchase. Nothing about your money goes with them. If you reset or delete your advertising ID in Android Settings → Privacy → Ads, the app sends zeros instead.
Google AdMob: ads in the free version
The free version shows two kinds of ad. A sponsored card sits in your feed and sometimes appears once when the app opens; you can close it. And where a feature is locked, you may choose to watch a rewarded video instead of subscribing — on the paywall, on a locked feature’s screen, and in Reef Run in exchange for extra runs. Sharky+ has no ads.
Google AdMob serves these ads and may use your device’s advertising ID to select and measure them.
For the video that unlocks Sharky+ for a day, completion is verified by Google’s servers and reported to RevenueCat, which is what grants the unlock. The app does not decide this on the device. The videos that pay out in-app rewards instead — extra Reef Run runs, or Bites toward your level — are counted on your own device, because nothing you buy or own depends on them. You can reset or delete your advertising ID in Android Settings → Privacy → Ads. See how Google uses advertising data.
Google Play: billing
If you subscribe, Google Play processes the payment. We never see your card details. See the Google privacy policy.
Shared Space: only if you join one
Shared Space lets two to six people see one live Feed. It runs on Supabase, with servers in Singapore. If you never open it, nothing in this section applies to you.
Your account is created without an email or password. It is tied to this install of the app by a random identifier the app generates; we do not use your phone’s hardware identifiers. Losing the phone or reinstalling means the space owner has to invite you back. Your name is the one you type, and your photo is optional; the people in your spaces see both. The photo is shrunk to 256 pixels on your phone before upload, which also strips its location data, and is stored privately: only members of a space you are in can open it.
What you share is your choice per space. When you create or join a space, one screen asks what to share from your wallet from then on, with Totals selected and Off one tap away; nothing is sent until you tap Continue, and you can change it any time on the space’s screen. At Totals, only the amount, category and time of each new wallet transaction is sent. At With notes, your note on it is sent too. Loans, collections, people who owe you, receipt photos and everything else stay on your phone. Posts, reactions and comments you write in a space are stored and shown to its members.
Who can see it: only the current members of that space. Every request is checked against your membership on the server. As the operator we can technically read this data; we use it for nothing except running the Feed.
Leaving a space stops sharing straight away. Deleting your Shared Space account, from the Shared Space screen, erases your name, everything you shared, and your posts, comments and reactions from every space, and deletes the account. A short record that you gave and withdrew consent is kept, as the law expects.
Shared ledger: only if you choose to share or join one
A Shared Space owner can choose “Also share my whole ledger” when showing their invite code. Whoever scans that code and is let in gets a full copy of the ledger merged with their own, and both phones stay in sync from then on.
What is copied: loans and their schedules, collections and the people who owe you (their names, and phone numbers if you saved them), your wallet, history, notes, and receipt and proof photos. Settings stay on each phone.
End to end encrypted: everything is encrypted on your phone before it is uploaded. The key is inside the QR code and is passed phone to phone through the camera; we never receive it, so we cannot read the shared ledger. A ledger invite cannot be sent as a link for this reason. Because we do not have the key, if both phones are lost the copy on our server cannot be opened by anyone.
Stopping: “Stop syncing ledger” on the space’s screen ends the sync, and each phone keeps what it has. Deleting your Shared Space account removes what you uploaded from our server. The ledger can contain names and numbers of people who owe you, so share it only with someone you would show your notebook.
Rental space: only if you link a unit
A landlord who keeps a rental in Business can link one unit to their tenant’s phone with a QR code. It is separate from Shared Space: the tenant sees that unit only, never the landlord’s other money, and the landlord sees only what the tenant posts there. It runs on the same Supabase servers in Singapore, with the same kind of account (a name, no email).
What is shared, between the two of you only: the unit’s name, rent, due day, deposit and lease dates; the months the landlord logged as paid; the payment QR the landlord picks, which shows the account name and number it contains; proofs of payment with their screenshots, amounts and reference numbers; receipts; repair and other requests with their photos; comments and chat messages. Your names are shown to each other.
End to end encrypted: all of it is encrypted on the phone before upload, with a key inside the QR code that we never receive. We can see that a room exists, who is in it, and when and how much was posted, but not what. Screenshots are read for their amount and reference on your phone; the picture is not sent anywhere to be read.
Stopping: either side can unlink; the landlord’s “Tenant moved out” closes the room. Each phone keeps what it already has. Deleting your account (Settings, Delete from our servers) removes your membership, your posts and the photos you uploaded; if you are the landlord, the whole room goes.
The community board: only if you open it
The Community screen loads a feedback board we host, in an in-app browser. It is a separate service with its own terms, and anything you post there is public to other users of that board. Nothing from your loans is sent to it. The app only opens the URL. If no board is configured, the screen says so and loads nothing.
What we never collect
No analytics SDK. No crash reporter. No contacts, no location. Voice entry listens only after you tap Say it, and speech is turned into text on your device. No advertising profile built by us. We do not sell personal information. The only personal information we hold is what you put into a Shared Space, and only its members see it.
Children
Sharky is not directed at children under 13, and we do not knowingly collect information from them.
Your control
Every piece of data is under your hand: delete a loan, delete a debtor, export an encrypted backup, or uninstall the app to remove everything at once. If you joined a Shared Space, delete that account from the Shared Space screen; it removes everything of yours from our server without a request to us. Settings → Start over → Delete from our servers removes everything off the phone in one go: the Shared Space account, shared paluwagan links and the purchase record with its advertising ID. See how to delete your data.
Changes
If this policy changes, the date at the top changes with it and the updated version is published at this address.
Contact
Reach us through the Community board linked in the app’s Settings screen.