Privacy Policy
Last updated 30 October 2026
Atsuma is a private group-coordination app. It holds messages, events, photos and shared expenses for small groups of people who know each other. That is personal data, and this page explains what is collected, why, who else handles it, and how long it stays.
Who is responsible
Atsuma is operated by Ahmed Abushaban, who is the data controller for the Atsuma app and the atsuma.app website. Contact: support@atsuma.app. A postal address for the controller is available on request to that address.
What is collected, and why
| Data | Why | Lawful basis (UK/EU) |
|---|---|---|
| Email address, username, display name, date of birth | To create and secure your account, and to confirm you are at least 16 | Performance of a contract |
| Profile photo, bio, home currency | So other members of your groups recognise you, and so amounts display correctly | Performance of a contract |
| Messages, events, itineraries, polls, checklists, photos and videos you post | This is the content of the service. It is shown to the other people in your group | Performance of a contract |
| Expense entries, splits and settlements | To calculate who owes what within a group | Performance of a contract |
| Live location, when you choose to share it | To show your position to a group for a limited period. Off by default and always started by you | Consent |
| Event and itinerary locations | So people know where a gathering is | Performance of a contract |
| Push notification token | To send notifications to your device. Only if you allow notifications | Consent |
| Busy and free times, if you connect a calendar | To show your group when you are free. Only start and end times are used, never event titles or details | Consent |
| App version, last-seen time, which app you last used (iPhone, Android or web) and its build number, performance measurements | To keep the service working and to investigate faults | Legitimate interests |
| Friendships, blocks, reports, read receipts, story views and mutes | To run the social features and keep people safe | Performance of a contract; legitimate interests |
| Your IP address (briefly, in counters) | To limit repeated sign-in, sign-up, password-reset and reply attempts. Counters last from 10 minutes to a day and hold no profile. Email addresses typed into these forms are counted in scrambled form | Legitimate interests |
| A record of each email we send (address, name, language, kind, status and the details used to build the message, such as an event title, host name or balance) | To avoid sending the same email twice and to investigate delivery problems | Legitimate interests |
Atsuma does not show advertising, does not sell personal data, and does not use your content to profile you or to train machine-learning models.
Emails we send
Atsuma sends email so people who are not in the app at the time still hear about their plans. Every kind is listed here, with who receives it and why.
| Who receives it | Why | |
|---|---|---|
| Sign-up code, password reset link | The person signing up or resetting | To verify the address and let you choose a new password |
| Security notices: password changed, email changed | The account's own address (the old address for an email change) | So you know if someone changed your sign-in details |
| Reply confirmation and confirmation link | A guest who replied to an event with an email address | To confirm the reply and the address, and give a link back to the event |
| Reply accepted | A guest whose reply the host approved | So the guest knows they are in |
| Event changed, event cancelled | Guests and people with accounts who said going or maybe (not the host or co-hosts) | When the time or place changes, or the event is cancelled (the notice includes any balance owed) |
| Reminder the day before; add photos; round-up after the event | Reminder and add-photos: guests with an email address. Round-up: guests and people with accounts | To remind people of the plan, invite photos to the album, and share the album and what is owed |
| Joined a group's shared expenses; balance reminder | A person who joined, or was added to, an expense group through a link and gave an email address; a balance reminder goes to such a person when the group has been quiet for a while | To give a link back to the group and its balance |
| Account deletion request received | The address typed on the deletion form | To confirm the request. A copy goes to us so we can verify ownership before deleting |
Most of these emails end with a Stop sending me these link: the event emails (for guests and for people with accounts) and the balance reminders. The note about joining a group's shared expenses, security notices and the removal-request confirmation have no such link. The link stops all of Atsuma's email to that address except security notices and the confirmation of an account removal request; write to support@atsuma.app if you want the shared-expenses note to stop. Sign-up codes and password-reset links are sent by our sign-in provider, Supabase, and are not affected; the rest are sent by Resend. The notification switches in Settings control alerts and push notifications in the app, not email.
Location, in detail
Location is handled three different ways, and the differences matter.
Live location sharing
When you start sharing live location with a group, your coordinates are stored with an expiry time and are deleted within a minute of that time. Nothing is archived and no history is kept.
Location in a chat
Sharing live location in a group or a direct chat posts a message that only records that a share started: it holds a reference, not coordinates. Your coordinates are held in the live-location record described above and are deleted within a minute of the share ending.
Event and itinerary locations
A venue on an event, or a stop on an itinerary, is content the organiser entered. It stays with the event and is deleted when the event is deleted.
Who else processes your data
| Provider | What it handles | Where |
|---|---|---|
| Supabase | The main database and account sign-in | Tokyo, Japan |
| Cloudflare (R2, Images, Workers) | Photos, videos and other media; the atsuma.app website | Media in Asia-Pacific; the website on Cloudflare's global network |
| Resend | Delivers Atsuma's emails: receives the recipient's address (and name where known), the subject and the message, and reports back whether it was delivered, bounced or marked as spam | Global |
| Google Firebase Cloud Messaging | Delivers push notifications. Receives your device token and the text of the notification | Global |
| Firebase Performance Monitoring | Measures how fast the iPhone and Android apps start, open screens and make network requests, with device model, OS and app version. Never the content of your messages, names or locations | Global |
| Google Maps Platform | The map in the phone app is drawn by Google's Maps SDK, which loads map tiles from Google and receives your IP address and technical data such as a device identifier, an app user identifier, interaction and performance data. Place search, place details, time zone lookups and map previews are asked of our own server, which asks Google; Google sees our server and the search text, not your device. App builds before 1.0.0 (42) and the web app before that update asked Google directly | Global |
| Exchange-rate service (open.er-api.com) | Currency exchange rates for expenses. Our server fetches them at most once an hour and hands them to the apps; the service receives nothing about you. Builds before 1.0.0 (42) asked it directly | Global |
| RevenueCat | Subscription status. Nothing is for sale yet, but the iPhone app registers your account's ID with it | Global |
| Apple and Google | App distribution and push delivery on their platforms | Global |
Cookies and browser storage
Atsuma uses only what it needs to work. There are no advertising, tracking or analytics cookies, and nothing on the site follows you across other sites.
| Name | Purpose | Lasts |
|---|---|---|
| au1 (cookie) | Keeps you signed in on the website and the web app | 30 days, renewed each time you use it |
| as_… (cookie, one per event) | Remembers a guest's reply session on an invite link | 90 days |
| ag_… (cookie, one per expense group) | Remembers a guest's session on an expense-group link | 90 days |
| av1 (cookie) | Remembers, in a scrambled form, which email addresses this browser has already confirmed, so a returning guest is not asked again | 1 year |
| al1 (cookie) | Remembers the language you chose | 1 year |
| Web app settings (browser storage) | Your chosen language and light or dark theme, a note that your email preferences were saved, a day's cache of exchange rates, and a few display choices such as collapsed panels. Your sign-in is not kept in browser storage | Until you clear your browser data; exchange rates refresh daily |
The sign-in and guest cookies are only sent to atsuma.app, are not readable by scripts on the page, and are used only to run the service.
On your phone the app keeps a local copy of recent chats and lists so it opens quickly; it is removed when you sign out. Opening the Android sign-up form from our home page uses Google Forms, and the iPhone beta is distributed through Apple's TestFlight. Replies to hello@atsuma.app are forwarded to the operator through Cloudflare Email Routing.
International transfers
The database is in Japan. If you are in the UK or EU, your data is transferred outside that region. Japan has an adequacy decision from the European Commission, meaning transfers to Japan are permitted without additional safeguards. The other providers above operate globally and rely on standard contractual clauses.
People who are invited but do not have an account
Someone can be invited to an event through a link without creating an account. If they reply, Atsuma stores the first name they typed, their reply, the language and time zone of their browser, and an email address if they chose to give one. Before they reply they see only the event title, date, rough area and a headcount. Once the organiser admits them they can see the rest of the event, its photos, the shared expenses and what they owe, in a browser.
Access through an invite link does not lapse with time. It ends when the event is deleted. If the organiser turns the link off, people who have not yet replied can no longer use it, but guests already admitted keep their access. An address typed by a guest is confirmed by an emailed link before the reply counts, and a browser that has already confirmed it is remembered (the av1 cookie above). Guests can also join a group's shared expenses through a link: we store the first name they chose and what they owe, and their email address if they gave one for the emails above. Deleting an event deletes the replies, but an expense group that holds entries is kept (detached from the event), so the names and balances in it stay.
A guest can ask for their reply to be removed by emailing support@atsuma.app, or by asking the organiser to delete the event. Stopping the emails does not remove the reply.
How long data is kept
- Live location: deleted within a minute of expiring.
- Your content (messages, photos, events, expenses): kept until you or your group deletes it. Deleting your account removes most of it immediately, but not shared expense entries; see Deleting your account.
- Your account: deletion is immediate and cannot be undone. See below for what stays. Your upload-link records, rate-limit counters and subscription record are deleted with it.
- Guest replies: kept with the event, until the event is deleted. The emailed links we gave a guest (session, reply confirmation, stop link) are deleted 30 days after they expire, or 120 days after they expire if a browser used one to confirm an address.
- In-app notifications: deleted automatically after 90 days, or with your account.
- The lists that stop mail to an address (an unsubscribe, a bounce or complaint) are kept so the address is not mailed again.
- Deleted messages: when you delete a message, its text, mentions, link, location and the references to its photo or video are erased from our database at that moment, and the file itself is deleted from storage within minutes. A placeholder stays so the conversation still reads correctly: who sent it, when, and its type. Reactions, poll votes and pins on it are removed too. A photo sent in an event chat is also shown in the event's album and stays there until it is deleted from the album. Messages that were deleted before 28 October 2026 were cleared in the same way on that date. A message other people already read, copied or received as a notification on their phone cannot be recalled.
- Upload and download link records (which account asked for a signed link to which file, and when): 30 days.
- Push and maintenance logs: push send counts 3 days; job logs 90 days; large-upload sessions 3 days; a notice of a cancelled event (title, date, host name, invite links and who was going) 90 days.
- Email records (address, name, kind, status and the details used to build the message): kept with no automatic deletion date, and not removed when an event is deleted. Ask us to remove yours.
- Backups: the database is backed up daily and each backup is kept for 7 days, so deleted data can remain in a backup for up to 7 days after it is deleted.
- Provider logs: our hosting providers keep their own operational logs (for example web request logs) for the periods they set.
Deleting your account
You can delete your account from inside the app, under Settings → Delete account, or, if you no longer have it installed, from the account deletion page, which files a request that we verify before deleting. In the app, deletion happens immediately and cannot be undone.
What is deleted
Your account and sign-in; your profile photo, bio and username; your posts, stories, reactions, comments and notifications; events you created, along with their albums and invitations; and every photo you uploaded to any album, including albums belonging to other people. Those photos are removed for everyone who could see them. The app tells you how many before you confirm.
What is kept, and what happens to your name
- On shared expenses, your real name is kept. Expense entries, splits, settlements and expense-group membership keep the name you used, because other members' balances are calculated from them. The link to your account is removed.
- Everywhere else, your name becomes “Deleted User”. Messages you sent stay in their conversations, shown that way.
- A placeholder profile record remains. It holds an internal ID (which the messages you sent point to), the name “Deleted User”, a username like deleted_ab12cd34, and the date the account was created. Your date of birth, currency, calendar identifiers, push token, last-seen times and app version are erased with the account, and your notification settings and subscription fields are reset to their defaults.
- Records that point at the placeholder stay: your chat memberships and direct-message threads (the messages show “Deleted User”), your busy and free times until they expire, and things you added to shared events, checklists and groups. A guest's reply and email address stay with the event until it is deleted.
- Our email records are made anonymous. Mail queued or sent to your address loses your address, your name and its content; we keep only that it happened (type, time, delivery status) so we do not send duplicates. The list that stops mail to an address, and reports you filed, stay. Media in messages that remain and receipts attached to kept expense entries stay with them.
If you want your name removed from shared expenses as well, email support@atsuma.app; each request is judged on its own facts, and the other members of that group will see the change.
Your rights
Depending on where you live you may have the right to access your data, correct it, delete it, object to processing, withdraw consent, or receive a copy in a portable format. In the app, Settings → Request my data asks us to compile your personal data; we reply within 30 days. You can also email support@atsuma.app from the address on your account. You can delete your account as described above.
If you are in the UK or EU and are unhappy with how a request was handled, you can complain to your national data protection authority. In Japan, the Personal Information Protection Commission handles the equivalent role.
Children
Atsuma is not intended for anyone under 16, and in some regions the minimum age is higher. Sign-up asks for a date of birth and refuses anyone under 16. If you believe a child has created an account, email support@atsuma.app and the account will be reviewed and removed if confirmed.
Security
Data is encrypted in transit. Access to group content is enforced at the database level, so a person who is not in a group cannot read its data even if they know it exists. Access for invited guests is limited to a narrow, defined set of information. Atsuma does not currently offer end-to-end encryption for messages, which means message content is readable on the server. This page will be updated if that changes.
Changes to this policy
If this policy changes in a way that materially affects you, you will be notified in the app. The date at the top always reflects the current version.