Everything checkable, nothing blurred

When a room collects, each payment is processed by a payment partner — a licensed provider whose job is moving money. The room states the destination and timing before you confirm, tracks the partner’s reported state of every payment, and writes each step into the record. Rooms itself never holds a balance for you, and a payment is only ever called settled after the partner confirms it.

SandboxToday, plainly: this is a sandbox. Every payment runs against a simulated partner, and no real money moves here — the full flow is real, the euros are not. Real payment partners arrive in a later stage, behind the same rules.

What we store about how you sign in is deliberately minimal. Your password is never stored — only a scrypt hash of it, which cannot be reversed into the password. Sign-in tokens live in an HttpOnly cookie in your browser; our database keeps only their hashes, so a copy of the database alone can’t impersonate you.

Sessions expire on their own — after 14 days of inactivity, and 90 days no matter what — and you can see every device signed into your account and revoke any of them from settings, instantly. Resetting your password signs out every other session as a matter of course.

Room invitations are single-purpose links: each token is generated once, stored only as a hash, expires after 14 days, and can be revoked by the organizer at any time. Accepting one twice is harmless. Before you sign in, an invitation shows you only what you need to decide — the room’s name, its purpose, who’s organizing, your expected share, and the deadline. Never the group’s full money detail.

A room’s history is append-only. Every meaningful change — a commitment, a payment state, an edited target, a member joining — is written as an event with who, what, and when. Events are never edited and never deleted; corrections are new entries that say what they correct. “Wait, who changed that?” is a question the record answers, not a fight.

We store what the product needs to work and show you: your account (name, email, password hash), your preferences, the rooms you’re in with their event history, and a security audit log of actions on your account. Room history is shared with the people in the room — that’s the point — and with no one else.

There are no third-party trackers on these pages and nothing is sold to anyone. Payment credentials are the payment partner’s business, not ours: card and bank details never touch our database. The full draft policy says all of this with dates and specifics — see the privacy draft.

Failed payments tell the truth. When a bank declines, the room says exactly that — “nothing moved” — shows the broken state distinctly, and offers the retry. A failed payment is never blended into progress, and nothing is ever labeled paid while a partner still reports it processing.

Refunds are entries, not erasures. When money goes back — a cancelled trip, an over-collection, a departing roommate — the refund is its own recorded entry with its own math. History never rewrites; it accumulates.

Disputes start from facts. Because every change is in the record, a disagreement is about what to do next, not about what happened. Most “disputes” in group money are memory problems; the record deletes those before they start.