Privacy policy
Last updated 12 October 2026. In plain words
Family Pot is an app for keeping a household's money and provisions in order. It is provided by Maya Finance and built and run for Maya Finance by Diggy Solutions. This policy says what the app keeps, where, who can read it, and how to delete it. Every statement here describes the app as it is built; if the app changes what it does, this policy changes first.
The short version
- Your own (private) records are sealed on your phone with a key only you hold, before anything leaves the phone. Nobody else can read them: not other members of your household, not Maya Finance, not Diggy Solutions.
- Your household's shared records are kept on Family Pot's server so every member's phone has them. They are encrypted on the way and on the server's disks, and they can be read by your household's members and by the people who run the server.
- The app sends anonymous usage figures and crash reports, never amounts, names, notes or categories, and never tied to who you are.
- There are no adverts, no tracking across other apps, and nothing is sold or shared with anyone for their own use.
- You can delete your account from inside the app at any time.
What Family Pot keeps, and where
On your phone
Everything you record is kept on your phone first, in encrypted databases. The household's shared records are in one; each member's private records are in their own, opened only with that member's PIN. Receipt photos you attach stay on the phone and are never sent anywhere; a photo on one of your own entries is sealed with your key.
When you paste or share a payment message, or add a receipt photo, the app reads it on the phone, with the phone's own text recognition, to fill in the entry for you to check. The message and the photo's text are not sent anywhere and are not kept beyond what you save. If you choose someone from your contacts for money lent or borrowed, the phone's own contact picker gives the app that one name, and nothing else is read. If you turn on Free to spend on the home screen, that figure shows there without your PIN, for anyone who picks up the phone.
Your PIN never leaves the phone in any form. If you turn on unlocking with your fingerprint, the phone reads the finger itself and tells Family Pot only that it matched; Family Pot never receives or keeps a fingerprint. Anyone whose fingerprint opens the phone can then open your records, so on a shared phone you may prefer your PIN.
On Family Pot's server
The server is a dedicated machine run by Diggy Solutions for Maya Finance, in a data centre in London, United Kingdom. All traffic to it is encrypted (HTTPS). It keeps:
| What | Why | Who can read it |
|---|---|---|
| Your display name and your household's name | So members see who recorded what | Your household's members; the server's operators |
| Your role in the household (lead, contributor, shopper) | To decide what each member may see and change | Your household's members; the server's operators |
| A public key for your phone, and a generic device name ("Android phone") | To sign you in without a password | The server's operators |
| The household's shared records: accounts, entries, budgets, bills, goals, market lists and prices | So every member's phone has the same record | Your household's members, as their role allows; the server's operators. Free-text notes on shared records are also encrypted with a key held by the server |
| Your private records, sealed | So they come back on a new phone with your recovery code | Nobody can read them. The server sees only that a private record exists, whose it is and when it changed |
| Your recovery bundle | To restore your private records on a new phone | Nobody can open it without your recovery code. It is found by a one-way fingerprint of the code, never the code itself |
| The Central Bank of Liberia's published exchange rates | To compare your conversions with the Bank's rate | Anyone; they are public figures |
Usage figures and crash reports
To learn whether the app is fast and reliable on the phones people really use, the app sends:
- Usage figures: that the app was opened or unlocked and how long it took; that something was saved, and of which kind (an expense, a transfer, a market list item and so on); which tab was opened; how long a sync took and how much data it used.
- Crash reports: the kind of error and the lines of Family Pot's own code where it happened.
Each comes with the app's version, the Android version, and a random number made when the app is installed, which is not linked to your name, your account or your household. They never contain amounts, names, notes, categories, account names or anything you typed, and the server refuses any report that tries to carry them. They are kept for 180 days and then deleted. During the first stage of the pilot they are always on; from the second stage the app will ask at setup.
A copy you make
In You, Save a copy makes a spreadsheet file (CSV) of every entry you can see, on the phone, and hands it to the phone's share sheet. Family Pot does not send it anywhere; where it goes is your choice. The file has no PIN, so anyone who gets it can read it. No copy is left in the app afterwards.
Notes you send
In Help and guides, Tell us lets you write a short note to the people who make Family Pot. It goes with the next sync, with the same random install number and the part of the app you last used (such as Plan), and nothing else: not your name, your household or your records. What you type is sent as you typed it, so leave out amounts and names you would not want read. Notes are kept for 180 days and then deleted.
Registering interest on the website
If you register your interest in the pilot at familypot.mayafin.com, Family Pot keeps the name, phone or WhatsApp number and area you give, to contact you about the pilot, and nothing else. They are kept on Family Pot's server, read only by the pilot team, and deleted when the pilot ends, or sooner if you ask at info@mayafin.com.
The website
The website uses no cookies, no analytics, and no fonts or scripts from other services. Like the server, it notes only each request's path, result and timing, never your address on the internet.
What the server's logs hold
The server notes each request's method, path, result and timing, to keep the service running. It does not log your address on the internet, your phone's details, or anything you sent.
What Family Pot does not do
- It does not show adverts or use advertising identifiers.
- It does not use third-party analytics, crash or tracking services. Usage figures and crash reports go only to Family Pot's own server.
- It does not read your messages, notifications, contacts list, location or files on its own. It sees a message, a photo or a contact's name only when you hand it one, and then only on the phone. The only permissions it asks for are the internet, notifications for reminders you set (which also need to be restored when the phone restarts), and the use of the phone's fingerprint sensor when you turn on fingerprint unlock; taking a photo and choosing a contact go through the phone's own camera and contact picker, which need no permission.
- It does not sell, rent or share your information with anyone for their own purposes.
- It does not give financial advice.
Who can see what inside a household
- Private records are yours alone, even on a phone you share: each member opens the app with their own PIN.
- Shared records are seen by the household's lead and contributors. A shopper sees only the market list and cash given to them.
- When you choose to share one of your own accounts or goals with the household, the app tells you first that it becomes readable on the server and that copies may already be on other members' phones.
Keeping it safe
Data is encrypted between your phone and the server, and on the server's disks. The server is backed up every night; each backup is encrypted with a key that is not kept on the server, and backups are kept for 14 days. Access to the server is limited to the people at Diggy Solutions who run it, by key, not password.
Your recovery code
At setup you are given a recovery code. It is the only way to restore your private records on a new or reset phone. Maya Finance and Diggy Solutions cannot recover your private records without it, because they never hold the key. If you still have your phone and PIN, you can make a new code at any time.
Deleting your account
From inside the app: You, then Delete my account. This deletes, on the server and at once: your private records, your recovery bundle, your devices and sign-ins, your place in the household, and your name. Records you added to the household's shared book stay with the household, because the other members rely on them. Your name is deleted from the server; phones of other members that already show it beside what you gave keep it there. A household lead who is not alone in the household must first hand the lead to another member. If you are the only member, the household's records are deleted with your account.
Deleted data leaves the nightly backups within 14 days, as older backups are removed.
If you cannot open the app, write to the contact below from the email address you want the answer sent to, with your name and your household's name, and we will delete your account within 30 days.
Children
Family Pot is for adults keeping a household's money. It is not directed at children, and children do not have accounts in it.
Changes to this policy
If this policy changes, the new version is published here, with its date, before the app changes what it does.
Contact
Maya Finance, Monrovia, Liberia. Email: info@mayafin.com.