Privacy
Privacy at Sumlet
Sumlet is designed to keep each Household Ledger private to its authorized members while giving you clear control over optional AI-assisted transaction entry.
Effective September 28, 2026
Operator and privacy contact
Sumlet is independently operated. The operator’s legal identity and a verified privacy-request contact have not yet been published in this Site. Because no legitimate contact is configured, Sumlet does not display a placeholder address or pretend that an in-app form submits a legal request. The Site owner must provide and publish this information before requests can be directed outside the app.
Information collected
Sumlet processes account identity information provided after Sign in with ChatGPT authorization, profile preferences, Household membership and roles, transactions, income, savings, recurring records and their history, budgets and categories, goals, Household activity, AI-permission settings, and other records you choose to add. Optional voice entry processes the text produced by your device’s dictation feature.
Purposes
This information is used to authenticate access, operate the Household Ledger, calculate budgets and reports, maintain history, support collaboration, prevent abuse, provide exports, and—only when permitted—prepare editable AI-assisted transaction drafts. Sumlet does not require bank credentials, process payments, or move money.
Household sharing
Household records are shared with signed-in people who have an active membership in that Household, according to their role. Owners and co-owners can manage shared settings and invitations; owner-only role changes remain restricted to the owner. Removed members lose server-side Household access. Leaving a Household ends the departing person’s access but does not delete the shared Household or its financial history.
Private copies and separation
An authorized member may create an independent private copy of financial history before leaving a shared Household. The copy receives new record IDs and does not alter or remove records from the original Household. Other members’ names, email addresses, account identifiers, membership records, invitations, and activity logs are not copied. Identity attribution on copied historical entries is removed, and copied recurring templates begin inactive to reduce duplicate future entries.
Profile deletion and de-identification
Deleting a Sumlet profile removes the person’s Sumlet membership identity, personal preferences, and direct identity linkage from active Sumlet records. It does not delete the person’s ChatGPT/OpenAI account. If other members rely on shared Household history, financial facts needed for their legitimate shared records—such as amounts, dates, categories, totals, and reports—remain while direct “Added by” and account linkage is de-identified. This is de-identification, not a promise of anonymity: in a small Household, another member may still infer who performed historical activity from context.
Household deletion
Deleting an entire shared Household is separate from deleting one person’s profile. The Owner may open a deletion request, every active member must explicitly agree and make an export choice, and silence is not consent. The request expires after five days. After all members agree, the Owner must type a final confirmation before Sumlet removes the Household’s active financial records. A denial or expired request leaves the Household intact.
AI and voice entry
New Households begin with every AI data group disabled. AI-assisted entry uses only the Household data groups an owner or co-owner explicitly permits, and manual entry remains available when all groups are off. Dictated text is reviewed like typed text. AI-assisted entry does not post a transaction until you confirm the draft.
Sign in with ChatGPT
Sumlet uses Sign in with ChatGPT for authentication. After you authorize sign-in, OpenAI may provide account identity information needed to identify your Sumlet user and Household memberships. OpenAI does not operate Sumlet, and Sumlet does not store your ChatGPT password or browser-accessible authentication token.
Receipts
Private receipt-storage infrastructure and an authenticated receipt API exist for preserved or direct-API records, but the current app does not provide a receipt-upload control. Receipt metadata is associated with a Household transaction; files are stored separately in private object storage. Receipt files and filenames are not provided to AI and are not included in transaction CSV or yearly print/PDF exports. Preserved receipt records remain subject to the retention approach below.
Service providers and international processing
Sumlet relies on hosting, database, private object-storage, authentication, and—when enabled—AI service providers to operate the product. Those providers may process information in locations outside your state or country. Sumlet does not make unsupported guarantees about where every service-provider operation occurs.
Retention
Sumlet is designed for long-term reference but does not promise that records will exist forever. Retention is determined by whether a profile and Household remain active, the need to operate history and reporting, security and abuse-prevention needs, technical backup and recovery constraints, applicable legal obligations, and valid deletion requests. Signing out ends the current session; it does not delete Household records. Deleted personal data and deleted Households are removed from active Sumlet systems. Residual copies in protected backups are removed according to the hosting and backup-retention process and are not available for normal product use; Sumlet does not promise instantaneous erasure from immutable backups.
Cookies, device storage, and analytics
Authentication may use cookies managed through the sign-in and hosting flow. Sumlet uses local or session storage for interface preferences and dismissal state, such as the sidebar, testing and setup notices, educational explanations, and Home Screen installation guidance. The current app does not implement a separate product-analytics service.
Your choices and rights
Data & History provides the available transaction CSV and individual yearly print/PDF exports, including a partial report for the current year. Exporting is not deletion. Account & Data Controls separates downloading, leaving a Household, deleting a Sumlet profile, and deleting an entire Household so each action has the appropriate authorization and confirmation. Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, or portability. The in-app Privacy & data requests page explains available self-service tools and transparently notes that the Site owner must publish a verified contact before other requests can be directed outside the app.
Protect sensitive information
Do not enter payment-card numbers, bank credentials or passwords, government identifiers, protected health information, authentication secrets, or other highly sensitive information in transaction notes, voice text, or AI-assisted entry.