Privacy Policy

This policy explains what Toot (“we”, operated by Code Mates for AI Applications and Services Co. L.L.C, AlSaqr Business Tower, Office 1310, DIFC, Dubai, United Arab Emirates) collects when you use the Toot website and mobile app, why we collect it, who it is shared with, and the choices you have.

What we collect

• Account details: your name, email address, and sign-in method (email and password, Google, or Apple).
• Financial information you enter: accounts and balances, transactions, budgets, savings goals, debts, credit cards, and trips and layovers.
• Preferences: language, primary currency, risk tolerance, employment status, monthly income, and your profession, which we use to set up your starting budget and to offer features for your line of work (for example, layover tracking for cabin crew).
• Receipts: photos you attach to transactions, stored privately and visible only to you.
• Subscription status: your plan and billing status. Card details are collected and stored by Stripe, never by us.
• Usage data: which pages of the app you open and when, linked to a random account ID (not your name or email), so we can see whether the app is useful and fix what is not. We do not record what you type, the amounts you enter, or your screen.
• Cabin crew questionnaire: if you answer the questionnaire, we keep your answers and, only if you choose to give them, your name and your email or WhatsApp number. Each response gets a private share code. If you arrived through a colleague’s link, we record that link’s code so your colleague can be rewarded. See “The cabin crew questionnaire” below.
• Technical data: basic logs (such as IP address and device type) kept by our hosting providers for security and reliability.

How we use it

• To provide the app: showing your finances, calculating budgets, goals, debt payoff, and trips.
• To power Ask Toot (the AI assistant) and receipt scanning (see below).
• To process payments and manage your subscription.
• To keep the service secure, prevent abuse, and fix problems.

We do not sell your personal data, and we do not use it for advertising.

The cabin crew questionnaire

The questionnaire at /crew-survey is open to anyone with the link and needs no account. We use the answers to decide what to build. We use the contact you leave only to message you about Toot opening and about the early-access and free-month offer. In our results your contact is listed separately from your answers. We do not sell it or share it with anyone except the providers below. You can ask us to delete your answers and contact at any time by email, and we will do so. Anyone who shares their personal link can see only how many colleagues have answered through it, never their names or contacts.

AI features

When you use Ask Toot, the AI assistant, the question you type and a summary of your financial data (balances, recent transactions, debts, goals, and budget) are sent to Anthropic, which provides the AI model, to generate a reply. When you scan a receipt, the photo is sent to Anthropic to read it. Under Anthropic’s commercial terms, data sent through its API is not used to train its models. AI replies are generated automatically and may contain errors; they are general information, not professional advice.

Nothing is sent to Anthropic until you allow it: the first time you open Ask Toot or scan a receipt, Toot asks for your permission. You can turn it off again at any time in Settings → AI features, and the rest of the app keeps working.

Who we share data with

We use these service providers (“processors”) to run Toot, and share only what each needs:

• Supabase — database, sign-in, and file storage.
• Vercel — website and API hosting.
• Stripe — payments and subscription billing.
• Anthropic — Ask Toot (AI assistant) and receipt reading.
• PostHog — usage statistics (pages opened). For people who are signed in they are linked to a random account ID; for visitors who are not, to a random ID stored in the browser.
• Google and Apple — if you choose to sign in with them.

We may also disclose information if required by law or to protect the rights and safety of our users.

Where data is processed

Our providers run their servers in several countries, including outside the UAE. By using Toot you understand that your data is transferred to and processed by them, under the safeguards their terms and our agreements with them provide.

Retention and deletion

We keep your data while your account is open. You can delete your account at any time from Settings → Delete account; this permanently removes your profile, financial data, receipts, and connected-email access, and cancels any active subscription. Stripe may retain billing records as required by tax and financial regulations.

Your rights

You can access and correct most of your information inside the app. You may also ask us to export or delete your data, or object to certain processing, by emailing support@codemates.ae. We handle personal data in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where it applies to you, similar laws elsewhere.

Security

Data is encrypted in transit, access to each person’s data is restricted to that person by database-level rules, and sensitive credentials are kept on our servers only. No system is perfectly secure, so please use a strong, unique password.

Children

Toot is not intended for anyone under 18, and we do not knowingly collect their data.

Changes and contact

If we change this policy in a meaningful way we will update the date above and, where appropriate, tell you in the app. Questions: support@codemates.ae.