BorroYour ledger lives on your device. Who owes what, to whom, and for what — that stays on your phone unless you turn on cloud backup.
There is no advertising in Borro, no ad SDKs, and we never sell or rent your data or use it to profile you.
Borro records other people. When you add someone to your ledger you may store their name and contact details. Section 3 explains what that means for you and for them — please read it.
Who we are
Borro is made by AroraLabs, based in Australia. We are the data controller for the information described here. This policy covers the Borro app and borro.aroralabs.org.
What stays on your device
Your ledger — entries, amounts, dates, notes, receipts and photos — is held on your device. Without cloud backup it stays there and we never receive it.
With backup or sync on, that data is also stored in the cloud against your account so it reaches your other devices. We do not read it, profile it or sell it.
People you add
Because Borro tracks money between people, adding someone to your ledger may mean recording their name and, if you choose, a phone number, email address or photo. If you back up or share that entry, their details are stored in the cloud alongside your own — and for a shared or settled entry, sent to that person so they can confirm it.
Inviting someone. If you add an email and tap Invite, we send that address one email saying you added them on Borro, with your name — at most once a week. Entries you log with them stay on your phone; when they join Borro with that email, the app offers to send them your open entries, and nothing goes to them until you tap Send.
If someone has added you to their Borro ledger and you want your details removed, email contact@aroralabs.org. We will act on reasonable requests wherever we can identify the data — though for anything held only on that person's own device, you will need to ask them.
What we collect, and why
| What | Why | Legal basis (UK/EU) |
|---|---|---|
| Email address and name Only if you sign in | To create your account and let you sign back in | Performance of a contract |
| Your ledger Only with backup or sync on | To back it up and reach your other devices | Performance of a contract |
| Shared and settled entries | To deliver them to the person involved so they can confirm | Performance of a contract |
| Device and app details A per-install identifier, your device model and device name, whether it is a real device or a test simulator, OS and app version, language and timezone, plus a notification token | To send the notifications you enabled, keep the free plan to one device, and diagnose faults | Legitimate interests |
| Your country Worked out from your IP address | To show the right prices and content, and to limit abuse | Legitimate interests |
| A device-integrity check | To confirm requests come from a genuine, unmodified app | Legitimate interests |
| Product analytics and crash reports Tied to an opaque account id, never your ledger contents | To see where people get stuck, and to fix crashes | Legitimate interests |
| Purchase records | To unlock what you paid for, and to keep tax records | Contract, and legal obligation |
| Emails you send us | To reply to you | Legitimate interests |
We do not sell or rent your data, we show no advertising, we do not profile you or train machine-learning models on your data, and we do not make automated decisions that have a legal effect on you. Analytics events carry product metadata such as a screen name — never the contents of your ledger.
In-app announcements are chosen on your phone. When one is meant for particular people, it lists them only by a scrambled one-way code made from their account id — never the id, a name or an email.
There is currently no in-app switch for analytics and crash reporting. If you would rather we excluded your diagnostics, email us and we will honour reasonable requests.
One device on the free plan. We record which device is currently signed in, so a free account stays on one device at a time. Signing in elsewhere signs the first one out. Pro lifts that limit.
Who we share it with
We never sell your data. Apart from delivering a shared or settled entry to the person it concerns — which only ever happens because you asked — we use a small number of providers who process data only on our instructions:
- A cloud infrastructure and sign-in provider — to run accounts, backup, sync and notifications.
- An analytics and crash-reporting provider — for the diagnostics above.
- Apple and Google Play — the stores. They take every payment; we never see your card details.
- An email provider — to send sign-in codes, the invitations you choose to send, and to answer support.
- A website host and content-delivery network — to serve this site.
We may also disclose data where the law requires it, or to protect our rights or someone's safety.
Where it is stored
We are in Australia and our providers are largely in the United States and the European Union, so data may be transferred outside your own country. Where it leaves the UK or the EEA we rely on the UK and EU Standard Contractual Clauses, or on an adequacy decision where one applies.
How long we keep it
| Data | Kept for |
|---|---|
| Your ledger on the device | Until you delete it or remove the app. We hold no copy |
| Account and cloud ledger | Until you delete your account |
| Receipts and photos you backed up | Until you delete them or delete your account |
| Sign-in codes | Minutes — removed once used or expired |
| Analytics and crash reports | Retained by the provider on a rolling window, then deleted |
| Purchase records | Up to 7 years, as Australian tax law requires |
| Support emails | Up to 3 years after the matter is closed |
| A note that your account was deleted — your name, email, plan, and the reason you gave for leaving | Name and email erased 12 months after deletion; the rest is kept without anything that identifies you |
After your account is deleted we may still keep a limited amount of information for a while — the records above that we are required to hold, and anything we genuinely need to deal with a dispute, a chargeback, a suspected fraud or abuse, or a legal claim. Copies also persist in routine backups and server logs for a short period before they cycle out. We keep no more than we need, and none of it is used to market to you.
An entry you shared with someone stays in their copy of the ledger even after you delete yours — the same way a message you sent stays in the recipient's inbox.
You can delete your account at any time — see the delete account page.
Your rights
Wherever you live, you can ask us for a copy of your data, ask us to correct or delete it, or ask us to stop using it. Email us and we will respond within 30 days. We will never treat you worse for asking.
UK and EEA. You also have the right to restrict or object to processing — including our diagnostics — the right to data portability, the right to withdraw consent at any time, and the right to complain to your data-protection authority: the Information Commissioner's Office in the UK, or your national authority in the EEA.
California. You may request the categories and specific pieces of personal information we hold and ask us to delete them. We do not sell or share personal information as the CCPA defines those terms.
Australia. You may access and correct your personal information, and complain to the Office of the Australian Information Commissioner if you are not satisfied with how we handled it.
Security
Everything travels over HTTPS. Cloud data is protected by server-side rules that only ever let your own account read or write your ledger, and access to our systems is limited and protected by multi-factor authentication. No system is perfectly secure, but if a breach affects you we will tell you and the relevant regulator as the law requires.
Children
Borro is not intended for children under 13, and we do not knowingly collect their personal information. If you believe a child has given us any, email us and we will delete it.
Changes & contact
If we change this policy we will update the date at the top of this page, and tell you in the app before any change that materially reduces your privacy takes effect.