Privacy
What is stored, what cannot be read, and how long anything is kept.
Chilavu encrypts what you write on your own device before it leaves. The key is derived from a twelve-word phrase that is generated on your device and never sent anywhere. The server stores what it cannot open, and this page says exactly what that leaves it able to see, because a promise nobody can check is not worth making.
What the server can see
| What | Why it has to |
|---|---|
| Your account number and your public keys | so other people can find you and verify it is you |
| Your devices: an identifier, a public key, and a name encrypted to your own key | so a session can be checked and a device revoked. The name it cannot read |
| Which accounts share which book, with roles | so it can route what you write to the people entitled to it |
| For each thing you write: which book, which device, a clock, a sequence number, an approximate size, and when it arrived | so your other devices can ask for everything after a point, in order |
| For each attachment: which book, its size, a hash of the ciphertext, and when it was uploaded | so it can store and serve a file it cannot open, and sweep it when released |
| Notification subscriptions, if you turn them on | so a device can be woken when a shared book changes |
| Request counts per address and per account | so a public service can throttle abuse without reading anything |
So the server knows who shares a book with whom, how often they write to it, and roughly how much. That is the boundary, stated plainly.
What the server cannot see
Amounts. Merchants. Categories. Notes. The names you give anything, including yourself and the people you share with. The dates of your expenses. Who owes whom. Receipt images. None of these exist on the server in a form anybody there can read, including whoever runs it and anybody who takes a copy of the database.
Web server logs
The web server keeps an access log: the address the request came from, the time, the path and the response code. The header carrying your session token is removed before the line is written. Logs are rotated and nothing older than thirty days is kept. They exist to count visits and to see what is breaking.
What is not here at all
No analytics. No third-party scripts of any kind. No advertising, no trackers, no crash reporters, no cookies — a session travels in a header, not a cookie, so there is nothing for a browser to attach to a request you did not make. Nothing about you is sold or shared, because there is no arrangement under which that could happen and almost nothing legible to sell.
Backups
The database is backed up nightly so the service can be restored after a failure. A backup contains the same ciphertext the live database holds and is no more readable. A backup you make yourself from inside the app is a separate thing: it is sealed under a passphrase you choose, it never touches the server, and nobody but you can open it.
Keeping and deleting
What you write is kept until you delete it. Deleting your account is immediate and takes your books with it — see deleting your account for exactly what goes and what stays.
Children
The service is not aimed at children and asks for no age. It also collects no personal details at all: no name, no email, no telephone number.
Asking
Questions, or anything on this page that turns out not to be true, to admin@chilavubook.com.