PrivacyPrivacy

What CommitteeKeeper stores about you, who can see it, and why. It only keeps a record. It never holds or moves money.

What is stored

If you organise a committee

• Your email address and a password (the password is kept only as a one-way scramble, never in readable form).
• Each committee you create: its name, amount, number of months, start date, due day, grace days, how turns are decided, and what members may see.
• Each member’s name, and an email and phone number only if you choose to add them, and a private link for each member.
• Every payment (month, date paid, method, an optional note), up to two receipt images per payment, every payout, and the history of everything that happened.

If you are a member

• Your name, and an email and phone number only if your organiser added them. Your organiser chose these, not you.
• Your turn or turns, your payments and your receipts.
• If you sign in to keep your committees together: your email address and password, and which of your links you attached.

What is not stored

No bank or card details, no ID card numbers, no location and no advertising or tracking cookies. The only cookies are the ones that keep you signed in.

How the app measures its own use

CommitteeKeeper counts three things with PulseMetrics, a small analytics tool built to know nothing about people: that a member’s page was opened, that a payment was saved, and that a committee was started. Only the name of the event and a random id that stays in the browser are sent. Never the page address (so never a private link), a name, a phone number, an email, an amount or an IP address. A browser with Do Not Track switched on is not counted at all.

Who can see it

• The organiser can see everything in their own committees, including member phone numbers and emails. Nobody else can see an organiser’s committees.
• A member always sees their own turn, the months left, the committee’s status, their own payments and their own receipts. They see other members’ payment status, the order of turns and history entries about themselves only if the organiser switched those on. They never see anyone’s email, phone number or private link, or anyone else’s receipts.
• A private link shows only the member it belongs to. A wrong, unknown or switched-off link gives the same empty answer, so nobody can tell whether a link exists.
• The person who runs this service can technically reach the database as its administrator. Nothing is sold or shared with anyone else.

Why the history is permanent

A kameti runs on trust, and the history is how that trust is kept. Every entry is written once and can never be edited or deleted, by the organiser or by anyone else: the database refuses it. A mistake is fixed by adding a correction that points to the original, and both stay visible. Each entry also carries a fingerprint of the one before it, so a quiet change anywhere would show up.

What this means for deleting things

• A member’s name stays in the history entries about them. That is the price of a record nobody can quietly change.
• An organiser can remove a member’s email and phone number at any time by editing their details, and can switch a member’s link off or replace it. Those stop being shown; the history entries stay.
• Receipt images can be removed. The file is deleted, and the history keeps only a fingerprint that shows a receipt existed.
• There is no automatic deletion yet. If you want something removed that the organiser cannot remove, ask the organiser of your committee first.