This policy explains what personal data we collect, why, and what you can do about it. It covers mortgagemeadow.app and the Mortgage Meadow tracker.

Who controls your data

The data controller is Charnette Ltd, registered at 20 Wenlock Road, London, N1 7GU, United Kingdom, company number 17167712. For any privacy question or request, email hello@mortgagemeadow.app.

Charnette Ltd is registered with the Information Commissioner’s Office as a data controller under registration number ZC206607. You can check that entry yourself on the ICO’s public register at ico.org.uk/register.

Reading the site

You can read every article on mortgagemeadow.app without an account and without giving us any personal details. Our host records standard server logs, including IP address and browser type, to serve pages and protect against abuse.

Your figures are encrypted with a key we don’t hold

Everything you enter into Mortgage Meadow — mortgage balances, payments, owners and rates, your household budget and the spending you log against it, and the inventory of what you each bring to the home — is held on your own device and, if you turn on backup, in an encrypted copy on our servers.

We cannot read that copy. Your passphrase never leaves your device. It is used on your phone or in your browser to unlock a key that encrypts everything before it is sent, so what we store is a block of ciphertext. We do not hold your passphrase, your recovery code, or any key that would open it. Nobody at Charnette Ltd can see a balance, an amount you spent, a shop you spent it in, or who paid for what — not for support, not for analytics, not on request.

The direct consequence, which we would rather say than have you discover: if you forget your passphrase and lose your recovery code, we cannot get your backup back for you. There is no reset link and no override, because a way in for us would be a way in for anyone who compromised us. Your data stays on your own device either way, so this affects the backup rather than what you can see day to day.

That is why we show your recovery code once, at setup, and ask you to confirm you have saved it before going any further — and why we suggest turning on the free encrypted backup, so your figures live in more than one place. If you have Pro, an occasional export of your own figures is a second copy that opens in a spreadsheet and does not depend on one device or on us. Both are suggestions, not conditions: looking after the encrypted copy we hold is still our job.

There is no bank connection anywhere in Mortgage Meadow. We do not ask for your banking details, we are not an Open Banking provider, and nothing is imported from your accounts. You type in what you want to track.

Reminders are set on your own device. If you switch them on in the phone app, the alerts are worked out from the dates you have already entered and scheduled by the phone itself. There is no push service, no notification token and no server involved, so what a reminder says never leaves the device — and on Android the text stays hidden while the screen is locked. On the website the equivalent is a calendar file you download and add to your own calendar; it is written in your browser and sent nowhere.

The encrypted backup is stored in the United Kingdom, on infrastructure provided by Supabase acting as our processor. Because it is encrypted before it reaches them, they cannot read it either. You can delete the backup at any time from inside the app, and deleting your account removes it permanently.

If you buy Mortgage Meadow Pro

Buying Pro means we process a small amount of data about you:

Your email address, to sign you in with a one-time code and to identify your subscription.
Your subscription record — which plan you hold, its status, and the renewal date.
Payment details are handled by our payment provider, not by us. We never see or store your card number.

If you invite a partner

You can share a mortgage with the person you own it with. Doing so means we hold two things we would not otherwise have:

The email address you invite, so we can send the invitation and so the right account can accept it. We can read this one — an email cannot be delivered to an address we can’t see. It is deleted when the invitation is accepted, withdrawn or expires, which is never more than seven days.
The shared key, sealed. What we store is ciphertext. The key that opens it travels in the invitationlink, not in our database — so what sits on our servers cannot be opened with anything we hold.
If you send the invitation by email, that email contains the link, and therefore the key. It passes through our mail provider and sits in the recipient’s mailbox. We don’t log it or keep it, but we won’t pretend it never touched us. Sending the link yourself — by message, however you like — keeps it away from us entirely, and the app offers both.

Sharing does not change what we can see of your figures. Both of you unlock the same backup with your own passphrase, neither of you learns the other’s, and the contents stay encrypted on your devices exactly as described above.

If you invite someone who is not already a user, that address is personal data belonging to them and we rely on your invitation as the reason for holding it. They can ask us to delete it at any time, and ignoring the invitation deletes it on its own.

Who processes it

Supabase — account and sign-in, the subscription record, and the landing-page counts described under site analytics.
Stripe — payment processing and billing records for website purchases. Stripe is a controller in its own right for payment data.
Postmark — transactional email only: your sign-in codes, renewal reminders, the invitation email when you share a mortgage, and our own operational alerts when a payment or billing step fails (those name an account id, never an email address). We do not send marketing email.
Vercel — hosting, server logs and the cookieless site analytics described below.
Apple / Google — if you buy in the mobile app the purchase is processed by the app store under its own privacy policy, and we receive only the subscription status.

Some of these providers operate outside the UK. Where data is transferred internationally it is made under an appropriate safeguard — the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it. You can ask us for a copy of the safeguard relied on for any particular transfer by emailing hello@mortgagemeadow.app, and we will provide it or tell you where it is published.

Why we are allowed to hold it

To perform our contract with you — signing you in, providing the Pro features you paid for, and emailing you about your subscription.
Our legitimate interests — keeping the service secure and working.
Legal obligation — keeping records of sales for tax and accounting.

How long we keep it

Your account, subscription record and encrypted backup are kept while your account is active. You can delete your account from inside the app or the website at any time, without asking us — it removes your encrypted backup immediately. If you would rather we did it, ask and we will do so within 30 days.

Records of a sale — what was bought, when, and for how much — are kept for six years from the end of the accounting period, because we are required to keep them for tax and company law purposes. That is a small set of billing data, not the contents of your account, and it is kept only for that purpose. This retention is a legal obligation, so it continues after you delete your account.

Your Mortgage Meadow figures are not part of that. The only copy we ever hold is the encrypted one, we cannot read it, and it is deleted with your account.

If you are unhappy with how we handle your data

Tell us first and we will look into it. Email hello@mortgagemeadow.app with “Data protection” in the subject. We will acknowledge it within 30 days, investigate, and tell you the outcome.

If you are not satisfied with our answer you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, or on 0303 123 1113. You can go to the ICO without coming to us first — we would just rather have the chance to put it right.

Do you have to give us anything?

No, and you can read the entire site without it. If you choose to buy Pro, your email address is necessary for us to perform that contract — we cannot sign you in or give you what you paid for without it. Everything else is optional.

We do not make decisions about you by automated means, and we do not profile you.

Cookies

We use only what is necessary to make the site work — principally a cookie that keeps you signed in after you enter your one-time code. These are exempt from the consent requirement because without them the service you asked for cannot function.

We do not run advertising or tracking cookies. The site analytics below set nothing on your device. If that ever changes, this policy will be updated and you will be asked for consent first.

Site analytics

The website uses Vercel Web Analytics to count visits. It is cookieless: nothing is stored on your device. For each page view it records the page, the referring site, the country, and the kind of device and browser, against a hashed visitor id that is rotated every day and cannot be tied back to you. It does not record your name, your email address, anything you type, or anything you enter in the app beyond the steps listed below, and it does not follow you to other sites. Vercel holds these counts under its own terms. Nothing about your mortgage passes through it.

It also counts a few steps by name, so we can see where people stop between arriving and subscribing:

Sign-in code sent — an email code was requested;
Signed in — with whether it was by code or by password;
Mortgage set up — with whether it has one owner or two;
Calculator used — with which calculator;
Checkout started — with which plan;
Purchase completed — with which plan;
Google Play clicked — with where on the site the link was;
Start free clicked — with which kind of page it was on (the home page, a calculator, a guide, pricing or another page);
Backup enabled — that encrypted backup was turned on, and nothing else.

That is everything that goes with them. No balance, rate, payment or other figure, no email address and nothing you type is ever attached to a step, and like the visit counts they store nothing on your device.

Separately, when you arrive on the website we record, in our own database, the page you arrived on and where the visit came from: a short label naming the search engine or AI assistant, or “direct”, the name of the referring website (its address without any page or search terms) and any campaign tag in the link. We also count visits from search engines’ and AI assistants’ automated crawlers by the crawler’s name. None of this includes your IP address, a cookie, an identifier for you or your device, or anything from the tracker, so it cannot be linked to you.

Your rights

Under UK data protection law you can ask us for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable form. Where we rely on your consent for anything, you can withdraw it at any time, and doing so does not affect anything done before you withdrew. Email hello@mortgagemeadow.app and we will respond within one month. There is no charge.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to put it right first, but you do not have to come to us before going to them.

Changes to this policy

We may update this policy. Material changes affecting subscribers will be notified by email.

What changed on 25 September 2026: the site analytics section now describes the landing-page and crawler counts kept in our own database.

What changed on 14 September 2026: the site analytics section now lists the steps it counts by name, and what is recorded with each.

What changed on 2 September 2026: the site analytics section was added, describing the cookieless visit counting the site has run since August; the Postmark entry now lists invitation emails and our own operational alerts; and the safeguard we suggest is the free encrypted backup, with export for Pro.

Last updated: 25 September 2026

Privacy policy.