Owesome 🌙

Privacy Policy

Last updated: April 14, 2026

Owesome ("we", "us", "our") is operated by Guzman Technologies LLC. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the rights you have over your data.

By using Owesome (the web app, mobile clients, AI assistant integrations via MCP or ChatGPT, or the REST API), you agree to this policy.

1. Information we collect

We collect only what is needed to provide the service:

• Account information — email address, display name, and (if you sign in with Google or Microsoft) the profile picture URL and provider-assigned user ID.
• Authentication credentials — bcrypt-hashed passwords (for email/password accounts), hashed refresh tokens, OAuth provider identifiers.
• Expense and loan data you create — amounts, descriptions, participants, dates, notes, receipts you choose to upload, group memberships, and settlement records.
• Contacts — the user IDs and optional nicknames of people you split expenses with.
• Usage and diagnostic data — IP address, user-agent, request paths, and error traces, retained in logs for up to 30 days.
• Phantom user data — if another Owesome user adds you as a participant before you've signed up, we store your email address and a name chosen by that user so they can split expenses with you. When you claim your account, this data is merged into your profile.

2. How we use your information

• Provide the core service: split expenses, track balances, manage loans, and send settlement reminders.
• Authenticate you across sessions and AI assistant integrations.
• Send transactional emails: account verification, password reset, phantom invites, expense notifications, group additions.
• Diagnose errors and improve reliability.
• Comply with legal obligations.

We do not sell your data, use it for advertising, or train machine learning models on it.

3. Third parties we share with

We share data only with service providers that are essential to operating Owesome. Each is bound by their own privacy terms:

• Google Cloud Platform — hosts our application, database, and object storage.
• Cloudflare — serves DNS, CDN, and the landing page you're reading now.
• Google and Microsoft (Entra ID) — only if you choose to sign in with them; they receive our client ID and return your basic profile.
• Resend — sends transactional email on our behalf.
• AI assistants you connect (Claude, ChatGPT, etc.) — receive an OAuth access token scoped to your account and can call the endpoints you've authorized. You can revoke this access at any time.

We do not share data with any party other than as described above.

4. AI assistant integrations

Owesome is designed to be used through AI assistants via the Model Context Protocol (MCP) and ChatGPT Actions. When you connect an assistant, you authorize it via OAuth to act on your behalf within the scopes you approved (e.g., expenses:read, expenses:write). The assistant vendor receives your access token and may retain conversation context per their own privacy terms. Owesome only sees the API calls made by the assistant, not your full conversation with it.

5. Data retention

• Account and financial data — retained while your account is active. We keep expense and loan history so balances remain consistent.
• Request logs — 30 days.
• Audit logs — 12 months, then deleted via automated partition drops.
• Expired tokens — purged nightly.
• Account deletion — on request, we delete your personal information. Aggregated financial records linked to other users' accounts are anonymized rather than removed, to preserve their balance history.

6. Your rights

You can:

• Access and download your data.
• Correct inaccurate information.
• Delete your account and associated personal data.
• Revoke AI assistant access at any time.
• Object to or restrict certain processing (GDPR / CCPA).

Email privacy@owesome.ai to exercise any of these rights. We respond within 30 days.

7. Security

All traffic is encrypted in transit (TLS 1.2+). Passwords are stored as bcrypt hashes. Tokens are hashed (SHA-256) before storage. OAuth keys are managed via Google Secret Manager. We enforce least-privilege access for all production systems. We will notify affected users promptly if we ever experience a data breach that materially affects their data.

8. Children

Owesome is not directed to children under 13. We do not knowingly collect data from children. If you believe a child has provided information, contact us and we will delete it.

9. International transfers

Our infrastructure is hosted in the United States (GCP us-east1). If you use Owesome from outside the US, your data will be transferred to and processed in the US. By using the service you consent to this transfer.

10. Changes to this policy

We may update this policy as the service evolves. Material changes will be communicated via email to registered users at least 14 days before taking effect. The "Last updated" date at the top of this page reflects the most recent change.

11. Contact

Guzman Technologies LLC
Email: privacy@owesome.ai
General: hello@owesome.ai