Privacy Policy
Last updated: July 2026
Reign is a household expense tracking app. This privacy policy explains how we collect, use, and protect your personal data when you use our service — and what we will never do with it: we will never sell your financial data.
Who's Behind Reign
Reign is a product of NullPointer d.o.o., a small Croatian company registered at Rudera Boskovica 2, 51500 Krk, Croatia. NullPointer d.o.o. is the legal entity responsible for your data — the data controller under GDPR Article 4. If you have a question about your data or want to exercise any of the rights described below, reach out to us at privacy@heyreign.com and we'll respond personally.
Data We Collect
We collect the following information to provide our service: email address, display name, receipt images (sent to Anthropic for text extraction), transaction data (amounts, merchants, dates, categories), OCR-extracted text from receipts, and wallet metadata (wallet names, currencies, balances). When you invite someone to a shared space, we share their email address with Resend to deliver the invitation. When the app encounters an error or slow response, we automatically send technical information to Sentry — our error tracking service — so we can diagnose crashes and improve reliability. This includes your IP address, browser or app version, the path within the app where the error occurred, and details about the error itself. Reign has infrastructure to send push notifications on the native iOS and Android apps but does not currently use it; if we enable push notifications in the future, we will ask for your permission and only use the device token your phone provides for that purpose.
How We Use Your Data
Your data is used solely for: personal expense tracking, receipt OCR processing to extract transaction details, shared household finance management within spaces you create or join, and subscription management.
Legal Basis for Processing
When we process your personal data we rely on one of the following legal bases, as required by GDPR. Contractual necessity: we need the data to provide the service you signed up for — for example, storing your transactions or scanning your receipts. Legitimate interests: we need the data to keep Reign secure, prevent fraud, and improve the product, in ways that don't override your rights. Legal obligations: some data we have to keep to comply with tax, accounting, or regulatory requirements. Consent: where we ask you to explicitly opt in, such as when connecting a third-party service, you can withdraw your consent at any time.
Third-Party Services
We use the following third-party services to operate Reign: Supabase for hosting, authentication, and data storage; Stripe for payment processing; RevenueCat for managing Plus subscriptions on iOS; Anthropic for receipt scanning and optional import assistance; Resend for sending invite emails; Sentry for error tracking and performance monitoring; Featurebase for in-app support conversations and feature feedback; and Plausible Analytics for privacy-respecting website analytics across our marketing site and web app. What each service receives, where it processes your data, and the safeguards on every transfer are described in the Where Your Data Lives section below. Your data is never sold to third parties.
Where Your Data Lives
We've reviewed every service that handles your data and documented the findings in a formal transfer impact assessment. Most of your data never leaves the European Union: your financial data lives in Frankfurt, support conversations stay in the EEA, and website analytics never leave Germany. Five services process some data in the United States: payments, subscription management, error tracking, receipt scanning, and invite emails. For each of these we rely on the European Commission's Standard Contractual Clauses and, where available, verified data-protection certifications, and we review every transfer at least once a year and whenever a service changes how it handles data.
Supabase: where your data is stored
Your financial data, receipts, and account information are stored with Supabase in the European Union (Frankfurt, Germany). Supabase is a US-based company, but your data stays on European servers and is protected by European data-protection agreements. We review this arrangement at least once a year.
Featurebase: support and feedback
When you message support or share feedback, the conversation is handled by Featurebase, a European company. Your name, email, plan tier, and the messages you choose to send are stored in the European Economic Area. Your financial data is never shared with Featurebase.
Plausible: website analytics
Our analytics run on Plausible, a European service hosted in Germany. It collects no personal information: no cookies, no cross-site tracking, and your IP address is used only to derive your country, then discarded. It records which pages are visited, the referring site, browser type, operating system, and country, with no way to identify you. Aggregated statistics are kept for two years. Nothing leaves the European Union.
Stripe: payment processing
When you subscribe to Reign Plus, we share the minimum needed with Stripe to process your payment: your email and a payment token, never your actual card number. Stripe processes payments in the United States, is certified under the EU-US Data Privacy Framework, and holds PCI DSS Level 1, the strictest payment-security certification. Your card details are handled entirely by Stripe and never touch our servers.
RevenueCat: Plus subscriptions on iOS
If you subscribe to Plus through the iOS app, RevenueCat manages your subscription. It receives purchase records tied to your app user ID, never your card details, which stay with Apple. RevenueCat processes this data in the United States under the European Commission's Standard Contractual Clauses and the EU-US Data Privacy Framework.
Anthropic: receipt reading
When you snap a receipt, the photo is sent to Anthropic's Claude AI to read and extract the details: merchant, amount, date, and items. The image is processed in the United States. Under Anthropic's contractual terms, your receipt data is not kept after processing and is never used to train AI models. We review this transfer regularly and are working to minimise the data each photo contains before it is sent.
Anthropic: import assistance (optional)
When you import a spreadsheet of past transactions, Reign can ask Anthropic's Claude AI to suggest a category for merchants your own history doesn't already cover, and icons for categories the import creates. Only those merchant names and your space's category names are sent, never amounts, dates, or the rest of your file, and suggestions from your own history are always tried first. This is off by default: Reign asks before the first suggestion, and you can turn it off at any time on the import screen itself (Settings > Import), with or without a file open. The processing happens in the United States under the same contractual terms as receipt reading: not kept after processing, never used to train AI models. We record when you turn this on or off.
Sentry: keeping Reign reliable
When the app hits an error, we automatically send technical details to Sentry so we can find and fix the problem: your IP address, the page you were on, and what went wrong. We scrub financial information before it leaves the app, and we've cut what we send to the minimum needed to diagnose issues. Sentry processes this data in the United States under European data-protection agreements.
Resend: space invite emails
When you invite someone to a shared space, Resend delivers the invitation email. The only information shared is the invitee's email address, your display name, and the space name. Resend processes this in the United States under the European Commission's Standard Contractual Clauses, and we're evaluating European alternatives to keep invite delivery closer to home.
The full transfer impact assessment behind this section is available on request. Write to us at privacy@heyreign.com.
Data Retention
Your data is retained for as long as your account is active. When you delete your account, your personal data is permanently purged within 30 days. In shared spaces, transactions you logged on other members' wallets and liabilities assigned to you are also deleted. Your identity is removed from any remaining shared records. Receipt images can be automatically deleted after OCR processing by enabling the option in your privacy settings. Deleted data cannot be recovered.
Your Rights
Under the GDPR and similar data protection laws, you have the right to access the data we hold about you (Art. 15), correct inaccurate data (Art. 16), request deletion or the right to be forgotten (Art. 17), restrict processing (Art. 18), receive your data in a machine-readable format and port it elsewhere (Art. 20), object to processing (Art. 21), request a human to review any decisions made solely by automated means that significantly affect you (Art. 22), and withdraw any consent you have given at any time. Inside Reign you can already exercise several of these rights directly: export all your data in JSON and CSV formats at any time, request complete account deletion, and manage your privacy preferences in Settings. You also have the right to lodge a complaint with a data-protection supervisory authority. NullPointer d.o.o. is registered in Croatia, so Croatia's national authority — AZOP (Agencija za zaštitu osobnih podataka, azop.hr) — is the lead supervisor for our processing; if you live elsewhere in the EEA, you can also contact your own country's data-protection authority. For any other rights request, contact us at privacy@heyreign.com.
What You Control
Beyond your legal rights, here's what you can manage directly in the Reign app today: delete your account and all associated data from Settings > Profile, choose whether receipt images are automatically deleted after OCR processing from Settings > Profile > Privacy, and choose whether Anthropic Claude suggests categories during spreadsheet imports, asked and controlled directly on the import screen (Settings > Import). These are the controls built into Reign right now. When we add more, we'll describe them here.
Security
All data is encrypted in transit using TLS 1.2 or higher, as enforced by our infrastructure providers, and encrypted at rest. You sign in through Supabase authentication; your session is stored on your device and sent to our servers only as a signed authorization token. We do not use advertising cookies or behavioural tracking cookies; the third-party services we rely on are listed in the Third-Party Services section above.
Cookies
Reign does not use advertising or behavioural tracking cookies. The web app keeps your sign-in session in your browser's local storage, not in cookies, and uses a small number of functional cookies, such as remembering your theme preference. Some of the third-party services we use (for example Stripe for payment processing) may set their own session-scoped cookies when their functionality is invoked; see the Third-Party Services section for the full list.
Children's Privacy
Reign is designed for adults managing household finances. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, contact us at privacy@heyreign.com and we'll promptly delete their data.
For users in the United States: Reign is not directed to children under 13. If you are under 13, please do not use this service. If we learn that we have inadvertently collected personal information from a child under 13, we will delete it promptly. For children aged 13 to 15, a parent or guardian must consent to their use of this service. Parents who believe their child has provided us with personal information can contact us at privacy@heyreign.com and we will promptly delete it.
GDPR & CCPA Compliance
Reign is designed to comply with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). You may exercise your data subject rights — including access, correction, deletion, and portability — through the Settings page or by contacting us.
Contact
For privacy inquiries or to exercise your data rights, contact us at privacy@heyreign.com.