The details, clearly
Privacy Policy
Your records belong with you. Here is how Shared Step handles information in the app and on this website.
Effective October 23, 2026
Who we are
Shared Step is provided by CTF Designs, LLC. This policy covers the Shared Step app and sharedstep.app. Contact us at roman@ctfdesigns.com with privacy questions.
Records in the app
Names you enter, children’s details, expenses, expense splits, reimbursement statuses, and receipt attachments are stored locally on your device. We do not operate a Shared Step account system or a cloud database for these records. You do not need an account to log expenses.
Sharing and backups
When you export a report or an encrypted backup, you choose its destination through your device’s sharing tools. A recipient, email provider, or cloud storage service you select may receive that file and handle it under its own policies. Reports can contain sensitive family and financial information; check their contents and recipients before sharing. Device-level backups may also include app data, depending on your operating-system settings. We do not hold your backup passphrase and cannot recover it.
Permissions and purchases
Camera and photo access let you attach receipts. Optional notifications provide reminders. Biometric authentication uses your device’s authentication system; Shared Step does not receive your fingerprint or face data. You can manage permissions in device settings. Apple processes your App Store purchase and any re-downloads associated with your Apple account. We do not receive your payment-card details.
App services
App Store downloads and purchases communicate with Apple. If app update checking is enabled in a release, it can communicate with the update provider using technical information needed to deliver updates. These service requests are separate from your locally stored expense records. Shared Step does not include advertising or behavioral analytics in the app.
Visiting this website
This website is hosted by Cloudflare. To deliver and protect it, Cloudflare processes technical request information such as IP addresses, browser details, requested pages, and request times. We do not add advertising pixels, analytics scripts, or marketing cookies. Fonts and images are hosted with the site. See our Cookie Policy and Cloudflare’s Privacy Policy for more information.
When you contact us
If you email us, we receive your address and whatever information you include. We use it to answer your request and maintain necessary support records. Please avoid sending children’s names, receipts, or private case documents unless they are necessary for your request. Our email provider processes these messages to deliver and store them.
Use, sharing, and retention
We use information we receive to provide support, operate and protect the website, and meet legal obligations. We do not sell personal information or share it for targeted advertising. Service providers may process information for hosting and email; information may also be disclosed when legally required or needed to protect rights and safety. Support messages are kept only as long as reasonably needed to resolve requests, maintain related records, or satisfy legal obligations. Technical information handled by hosting providers is subject to their retention practices.
Your choices and rights
You control the expense records on your device and the copies you export. Delete records in the app or remove the app to remove its local data; separately manage exported files and device backups. We cannot retrieve or delete a copy someone else has received. Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing of personal information we hold. You may also have a right to portability or to complain to a privacy regulator. Email roman@ctfdesigns.com to make a request. We may need to verify it; we cannot access expense records that exist only on your device.
Children and international processing
Shared Step is intended for adults managing family expenses, not for children to use. Information about children that a parent enters stays with the locally stored records unless the parent chooses to export or share it. Hosting and email providers may process website and support information outside your country, subject to their applicable safeguards.
Changes
We will update this page and its effective date when our practices change. Material changes will be described here and, where required, communicated through an appropriate notice.