Last updated 19 September 2026
Rinn is an app for splitting shared costs — trips, dinners, one-off bills — between people. This policy describes what it stores, where, for how long, and how to have it removed. It is written to be read, not to be survived.
Rinn is operated by an individual developer, not a company. Questions, corrections and deletion requests all go to the same place: rinnappsupport@gmail.com.
Sign-in is handled by Clerk, a third-party authentication provider. Clerk holds your email address and password (or your linked sign-in method); Rinn never sees or stores your password. From Clerk, Rinn stores your user identifier, your email address once verified, and your name.
Anything you choose to add on the profile screen:
Payment handles are never transmitted to Venmo, Cash App, Revolut or PayPal by Rinn. They are put into a link that opens on your own device; whether you follow it is your choice, and those companies’ own policies apply from that point.
If you photograph a receipt, the image is stored so you and the people you shared the expense with can look at it later. One copy is kept, at viewing size, and only if you attach the photo to the expense. The smaller copy made for reading the receipt is sent to Anthropic (see “Receipt scanning” below) and is not kept by Rinn.
Rinn stores the names of people who do not have accounts. If someone adds you to a trip by typing your name, Rinn creates a record holding that name and the amounts attached to it. You will not have agreed to this policy, you may never have heard of Rinn, and you will not be told the record exists.
That record holds a name, and money amounts associated with it. It holds no email address, no password and no way to sign in, unless you are later invited by email and choose to create an account — at which point the record becomes yours.
This is how splitting a bill with someone who does not use the app works at all, but it is worth being plain about: it means information about you can be in Rinn because somebody else typed it.
The iPhone app sets no cookies. The web app sets one essential sign-in cookie, from Clerk, which keeps you signed in between pages — and nothing else. There are no analytics cookies and no tracking cookies.
| Data | Provider | Region |
|---|---|---|
| Accounts and sign-in | Clerk | Clerk’s infrastructure |
| Trips, expenses, balances, names | Neon (PostgreSQL) | AWS us-east-2 (Ohio, United States) |
| Receipt images | Cloudflare R2 | Western North America (WNAM) |
| Application server | Railway | EU West (Amsterdam, Netherlands) |
| Receipt scanning | Anthropic API | United States |
| Place-name suggestions (web only) | Photon, by komoot | Germany |
Rinn is not hosted in one place, and the pieces do not sit in the same jurisdiction. It is worth being specific rather than implying a single location:
So a single action — photographing a receipt on a trip — can involve a server in the EU, a database in Ohio, an image store in western North America, and an API call to the United States. If you are in the EU or UK, that means your personal data is transferred to and stored in the United States.
This is not only a question of where things are stored. Because the server handling your requests runs in the Netherlands, sending a receipt to Anthropic to be scanned is itself a transfer of personal data out of the EU — the image leaves the EU at the moment it is sent, independently of where any of it is later stored.
Where personal data is transferred from the EU, UK, or Switzerland to the United States, the transfer is covered by Standard Contractual Clauses (Module 2, controller-to-processor) incorporated in Neon’s and Anthropic’s Data Processing Addenda, and by Cloudflare’s certification under the EU-U.S. Data Privacy Framework, its UK Extension, and the Swiss-U.S. Data Privacy Framework, with Standard Contractual Clauses as the fallback. UK transfers are additionally covered by the UK International Data Transfer Addendum where it applies.
When you scan a receipt, the photograph is sent to Anthropic’s API to read the line items, so you do not have to type them. Both the receipt image and the text extracted from it are sent to and processed by Anthropic in order to return that result.
Receipt images and the text extracted from them are sent to Anthropic’s API for scanning. Anthropic retains these inputs and outputs for up to 30 days for safety and security purposes, then deletes them. Rinn’s account is under Anthropic’s Commercial Terms of Service, and this data is not used to train Anthropic’s models.
Receipts are only sent for scanning when you choose to scan one. Photographing a receipt and attaching it without scanning does not send it to Anthropic.
On your phone, a receipt you scanned but did not save stays on the device for up to 7 days so you can pick it up again from the Scan tab; it is deleted when you save or discard the expense, or after 7 days, whichever comes first. It never leaves the phone during that time.
Receipt images are deleted automatically on a schedule. The rest of your data is kept until you delete it.
| What | Kept for |
|---|---|
| A receipt whose expense or trip was deleted | 90 days after deletion, then the image is permanently removed |
| A receipt you removed from an expense | 90 days after removal, then the image is permanently removed |
| A receipt on a settled trip nobody has touched | 365 days of inactivity, then the image is permanently removed |
| A receipt scanned on your phone but not yet saved | On the device only, 7 days, or until you save or discard it |
| Trips, expenses, balances, names | Until deleted — see below |
Removing a receipt hides it immediately: it stops being shown or offered for viewing straight away, and the stored image is deleted on the schedule above.
When a receipt image is removed, a record that a receipt once existed remains, so the expense does not silently look as though it never had one.
The profile screen has two actions.
“Delete all my data” removes the trips and bills only you were in, along with their expenses and receipts. Anything you share with other people stays: those expenses and balances are their records too, and removing them would change what they owe each other. Trips someone else created are never touched.
“Delete my account” does that, and then erases you. Your name, email address, profile photo and payment handles are removed, and your sign-in credentials are deleted from Clerk. No email to us is needed; it happens in the app.
What it cannot do is remove you from other people’s records, and it is worth being exact about why. In trips you shared, your expenses, the shares other people hold in them, and any settlement payments stay — the amounts those people owe each other depend on them. What remains is a row with no name, no contact details and nobody behind it, labelled “Deleted user”. Nothing identifying you is left, but your effect on their numbers is, because that was never solely yours to remove.
Deleting your account does not settle or cancel money owed.
The steps, on the phone and on the web, are also on Delete your Rinn account.
There is currently no way to do this yourself, and it would be dishonest to imply otherwise. You cannot sign in to a record that has no account attached to it.
Two things can happen instead:
Please include the name as it would have been typed and, if you know it, who added you — there is no other way to find the right record, since there is no account to look up.
What removal actually means here, precisely: your name and any contact details are erased from the record, but the record itself is not deleted. It stays as an unnamed placeholder because the amounts other people split with you hang off it — deleting it outright would silently change what those people owe each other. After removal there is nothing left identifying you: no name, no email, no payment handles.
Traffic is encrypted in transit. Receipt images are not publicly addressable: viewing one requires a signed link that expires after five minutes and is only issued to members of the trip it belongs to. Passwords are handled entirely by Clerk and never reach Rinn.
Rinn is a small project run by one person. It is built carefully, but it is not backed by a security team, and this policy will not pretend otherwise.
Rinn is not directed at children under 13 and should not be used by them.
If this policy changes materially, the date at the top will change. There is no mailing list to notify.
Questions, corrections, and deletion requests: rinnappsupport@gmail.com.