What is kept, and where.
Last changed 22 October 2026.
The app
You sign in to HamJoli with your email: the server sends a six-digit code to it, and the code signs that device in. There is no password. The app keeps your email, your display name and that device's sign-in token, and each trip as a log of changes (who added which item, who ticked, who paid what), in your Application Support folder. Deleting the app deletes that copy.
The app contains no analytics, no crash reporting and no third-party SDK. It makes no network request except to the sync server of your trips.
The sync server
Trips sync through a server so that everyone on the trip sees the same list. Unless you choose another, that is the default server at sync.hamjoli.com, which Sameer Kumar, the maker of HamJoli, runs on a rented virtual server. A trip whose invite link names a different server syncs there instead, and whoever runs that server holds the same things listed below.
The server stores:
- the change log of every trip it carries, which holds what was typed into the trip: items, the names of people on it, expenses and their amounts;
- your account: your email, your display name, whether you have been let in, and the note and trip link you sent when you asked to be let in;
- each device signed in to your account: the name it gives itself (for example "iPhone"), when it was last seen, and a hash of its sign-in token, never the token itself;
- which trips your account belongs to, which person in each trip is you, and which account sent each change;
- each trip's invite key, so that only people with the invite link can join.
Sign-in codes and the emails that tell the maker about a new request are sent through Resend, an email delivery service, which sees the address and the message. The server stores no phone number, location, contacts or payment details. It never interprets a trip; every rule about items, splits and balances runs on the devices. Its log records each request's time and path, which includes the trip's id, not its contents. The connection is encrypted, but the trips are not encrypted on the server, so the person who runs it can read them. Nothing on the server is sold, shared or used for advertising.
Deletion. Settings in the app has Delete my account, once every trip you are in is settled. It erases your email, your name and your devices from the server. The trips you were in keep their history, so your name stays on the changes you made there, greyed out; to have a whole trip removed, ask Sameer Kumar at sameerkumar.dev.
The App Store
Downloading HamJoli from the App Store is subject to Apple's terms and privacy policy. Apple shows the maker download counts, and crash reports and usage data only from people who chose to share them with developers in their device settings. The app's App Privacy label on the App Store lists the same data as above: user content, an email address, a name and a device identifier, used only to make the app work, none of it used to track you.
TestFlight
Installing a beta through TestFlight is subject to Apple's terms. Apple may show the maker crash logs and basic usage counts for TestFlight builds, as it does for every TestFlight app, and the public link collects no device ids.
This website
The site is static files served by Netlify. It sets no cookies and loads nothing from a third party; the fonts are served from here. Netlify keeps ordinary server logs for a short time, which is their privacy policy, not ours.
If you join the waitlist, the email you type is stored by Netlify Forms and used once, to send you the TestFlight link. Write to the maker to have it deleted. The "describe your trip" planner runs entirely in your browser; what you type is not sent anywhere.
An invite link opened on this site keeps the trip id, the server and the key in the part of the address after #, which the browser does not send to the server. Nothing about your trip reaches this site.
Questions
Ask Sameer Kumar at sameerkumar.dev.