Nolla · last updated 2026-10-24
Nolla is made and operated by Eetu Valkamo, at Helsinki, Finland, contactable at nolla.support@gmail.com. Under the GDPR that person is the data controller for everything described here.
If you do not sign in, nothing about your household leaves your phone. Your household, every shop you log, who paid, how you split it, your shopping lists and your balance are stored on the device and are not sent anywhere. Signing in is optional and Nolla never requires it.
If you do sign in, your household's data is copied to Nolla's server so that a second phone can eventually see it. That includes your amounts, the names you gave people, your notes, your categories and your shopping lists. It is not encrypted in a way that hides it from Nolla — see What Nolla can see below, which is the part most policies leave out.
Signing in also sends two technical identifiers, tied to your account: the identifier Nolla creates for this phone, which marks each change you make so the other phones can tell whose it was, and this phone's push token, which lets Nolla deliver notifications to it. Both are deleted with your account.
A notification carries a few words of what happened, if the other person has switched that kind on: your name, and for a list the list's name and what you added or picked up, and for a shop its category and your note. Never an amount, and a note with a number in it is left out. It travels through Google's Firebase Cloud Messaging and Apple's notification service to reach their phone, and shows on its lock screen unless they have hidden previews.
Separately, and whether you sign in or not, Nolla sends crash reports and counts of what gets used, both handled by Google's Firebase. Those two never include your amounts, names, notes or categories.
All of this is stored on your device and is deleted when you delete the app. If you have not signed in, "on your device" is the whole story — this list is also the list of things that exist nowhere else. If you have signed in, the same items are additionally on the server, described in the next section:
Nolla can give you a copy of it: Settings → Keep a copy exports your ledger as a spreadsheet or as a file. That copy is yours and goes wherever you send it.
Crash reports, through Firebase Crashlytics. If Nolla crashes, it sends a stack trace along with your device model, operating system version, app version, available memory and storage, and whether the device is jailbroken, plus randomly generated identifiers for the installation and the session. This is how a crash gets found and fixed. It contains none of your household's data.
Counts of what gets used, through Google Analytics for Firebase. Nolla reports that certain things happened — finishing setup, logging a shop, recording a settlement — as bare event names with no accompanying detail. Firebase adds its own automatic events, such as first launch and session starts, and general properties including device model, operating system version, app version, and approximate location at country level, tied to a randomly generated app-instance identifier.
Nolla does not collect an advertising identifier (IDFA) and does not use Firebase's advertising-capable components. Nothing here is used to profile you or target advertising, and nothing is sold or shared with anyone beyond the processor named below.
The purchase, if you subscribe, through RevenueCat. Nolla uses RevenueCat to check that a subscription is real and still running. What it receives is the purchase itself — which product, when it was bought, and whether it is still active — along with your locale and currency. Nolla never tells RevenueCat who you are. It does not pass a name, an email address or your Apple account, and it does not set an identifier of its own, so the id RevenueCat holds is one it generated and links to nothing else described here — not to your household, and not to your sign-in if you have one.
No payment details reach Nolla, and none reach RevenueCat. Apple takes the payment and Nolla is never shown a card. Nothing about your household — no shop, amount, name, note or list — is any part of this.
Signing in with Apple creates an account and, from that point, Nolla copies your household's data to its own server (a Postgres database hosted by Supabase in the EU) so that it can reach a second phone. What is copied is the same list as above: your household and the names you gave the people in it, every shop with its amount, payer, category, note, date and split, every settlement, and your shopping lists and their items. It also keeps a record of which entries you deleted, so that a deletion made on one phone does not come back from another.
This is not end-to-end encrypted. It is protected in transit and at rest by the usual means, and rules on the database stop other people's accounts from reading your household — but those rules do not bind the operator.
This is a separate feature, off by default, under Settings → Coming home alerts. Nothing in this section happens unless you turn it on, and it needs you to be signed in, on the same basis as everything else in this section.
"Share my arrival" checks your phone's location in the background against two boundaries around a point you place on a map — a wide ring and your home itself — and sends only two small facts, never your coordinates or your route: that you have crossed into the wide ring, sent once to your household as a "nearly home" message; and whether you are currently inside the narrow one, kept on Nolla's server as a single "home" or "away" answer against your account, overwritten on the next crossing rather than kept as a history of where you have been.
"Notify me when someone else is arriving" tells you when a household member crosses into their own wide ring — but only while your own "home" or "away" answer above says you are home, which is why it does nothing unless "Share my arrival" is also on: the household can only know you are home because your own phone said so.
Turning either toggle off stops the checks it drives. Nolla keeps no history of your comings and goings — only the single most recent "home" or "away" answer, which the next crossing (or simply opening the app) replaces.
Eetu Valkamo, as the operator of the database, can read the contents of your household — your amounts, names and notes — and this section exists because a policy that quietly omitted it would be the dishonest kind. It is what "not end-to-end encrypted" means in practice, it is true of most hosted apps, and it is stated here rather than left to be inferred. Access is not routine: there is no dashboard for browsing your ledger and no reason to look at it, but the technical ability exists and no promise in this document should be read as removing it.
What this buys you is that a lost phone is not a lost ledger, and that two people can share one. If that trade is not one you want, do not sign in — the app is fully functional without it, which is the point of making it optional.
This section is about the crash reports and usage counts above, and only about them. No amount, balance, name, note, category, measure, ratio, shopping-list item or invite link ever leaves your phone as part of any report. This is enforced in the app's code rather than promised in this document: telemetry events carry no parameters at all. It is a separate promise from the previous two sections and it does not weaken them: if you sign in, your ledger reaches Nolla's server, and it does so without ever passing through Firebase.
Google (Google Ireland Limited / Google LLC) acts as processor for both Crashlytics and Analytics. Firebase processes data across Google's data-centre locations, which includes locations outside the European Economic Area; Google relies on the mechanisms it publishes for such transfers. Firebase's own privacy documentation is at firebase.google.com/support/privacy.
Supabase acts as processor for the household data described under What leaves your phone when you sign in. The database is hosted in the EU (eu-north-1, Stockholm). Supabase's privacy documentation is at supabase.com/privacy.
RevenueCat (RevenueCat, Inc.) acts as processor for the purchase data described under What leaves your phone, and only if you subscribe. It validates the receipt Apple issues and answers one question for Nolla: whether this subscription is current. It is told nothing about your household. RevenueCat's privacy documentation is at revenuecat.com/privacy.
Apple is involved in two places, not one. At sign-in, Sign in with Apple tells Nolla an account identifier and, if you allow it, an email address; Nolla does not receive your Apple ID password and does not ask Apple for anything else. At purchase, Apple is the seller rather than a processor for Nolla: Apple Distribution International is the merchant of record, takes the payment and handles refunds — which is what Nolla's Terms of Use say too. Your payment details are Apple's, and Nolla never sees them.
Crash reports: 90 days. Firebase Crashlytics keeps crash traces and their associated identifiers for 90 days before beginning removal from live and backup systems.
Analytics: [RETENTION SETTING — see the note below].
Purchases: for as long as Nolla uses RevenueCat. A subscription has to be checkable every time the app asks whether it is still running, so this record is not something that expires on a timer the way a crash report does. No fixed period is given here because RevenueCat does not publish one, and this document does not put a number on something nobody has told us — the same rule the Analytics line above is waiting on.
Your own data, if you have not signed in: as long as you keep the app. Deleting Nolla deletes it, and there is no copy anywhere else.
Your own data, if you have signed in: until you ask for it to be removed. This is the part that changes when you sign in and it is easy to miss, so it is stated bluntly: deleting the app does not delete the copy on Nolla's server. Settings → Delete everything erases this phone and signs you out; it does not reach the server, and that is deliberate — it is what lets you sign in on a new phone and find your household still there. Removing the server copy is a separate action — Settings → Erase the server copy — described under Your rights, because clearing a phone and closing an account are different decisions.
If your subscription ends: twelve months, and then it is deleted. The shared copy on Nolla's server is kept for a year after a subscription lapses, so that coming back later finds your household where you left it, and is then removed. We tell you before that happens. The ledger on your own phone is not affected by any of this and is not deleted — it stays where it is, in full.
And you can fetch that copy back without subscribing again. Sign in during those twelve months and your household is restored to your device, whether or not you are paying. That matters most if you have changed phones or reinstalled the app, because then the copy on our server is the only one left, and your right to your own data is not something a subscription buys.
The two things Nolla collects rest on different legal bases, because they are not the same kind of processing.
Crash reports — legitimate interests (GDPR Art. 6(1)(f)). Nolla is a small app that has to be reliable with people's money records, and a crash it never hears about is one it cannot fix. The data is minimal and pseudonymous: a crash trace and a random per-installation identifier, never your shops, names or amounts. Fixing crashes serves you as directly as it serves us, which is what makes the balance come out this way rather than requiring your permission first.
Analytics — your consent (GDPR Art. 6(1)(a)). Counts of what gets used are not necessary to make the app work, so they are not collected until you have accepted. Nolla asks on the welcome screen, which names this policy and the Terms of Use; continuing past that screen is the acceptance, and nothing analytics-related is collected before it. What is sent and what is never sent is set out in the app under Settings → What leaves this phone. Three events are recorded — setup finished, a shop logged, a settlement recorded — and they carry no details of any kind.
Withdrawing that consent. The only way to stop analytics collection is to delete the app, which also deletes everything it holds. There is no switch in Settings.
That is stated plainly because it is what Nolla does, and it is worth being direct about the shape of it: the three events carry no parameters at all — no amounts, names, notes, categories or ratios — so what is collected is counts rather than anything about you or your household. If you would rather Nolla counted nothing, deleting the app is the way, and the export in Settings gives you a copy of everything first.
You can ask for access to, correction of, or deletion of personal data held about you, and you can object to processing or ask for it to be restricted. In practice, for the data described here:
You also have the right to complain to a supervisory authority — in Finland, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).
Nolla is not directed at children and does not knowingly collect their data.
If what Nolla collects changes, this page changes with it, and the in-app wording changes in the same release. The two are meant to agree; if you find them disagreeing, the app is the one telling the truth about what the code does, and that is a bug in this page.