Privacy policy
Applies to the Meridian Android app and this website. Last updated 19 August 2026.
Meridian works fully without an account, and in that mode nothing you enter ever leaves your phone. If you create an account, your figures are backed up to a server in Frankfurt so you can restore them on another phone. There is no bank connection, no advertising, no data broker, and nothing is ever sold.
Deleting your account removes everything from the server immediately — Profile → “Delete my account”.
Who is responsible
Meridian is built and operated by an independent developer. For any privacy question, or to exercise the rights below, write to support@meridianyield.app — the same address answers both support and data-protection requests.
Guest mode: no collection at all
Until you create an account, Meridian stores everything in a database file on your own device. Holdings, amounts, monthly logs, buckets, spending records and settings stay there. They are not transmitted, not synced and not visible to anyone but you. Uninstalling the app deletes them.
The one thing the app does fetch in guest mode is public reference data — the official inflation figures and exchange rates. That request tells the server only that some copy of Meridian asked for the latest EUR/USD/GBP numbers; it carries nothing about you.
With an account: what is stored
| What | Why |
|---|---|
| Email address, and a password stored only as a cryptographic hash | To identify your account and let you sign in on another device |
| If you sign in with Google: your Google account's email and display name | Same — supplied by Google, never a password |
| Your portfolios, holdings (the names you typed and the amounts), monthly logs, buckets, spending records, badges and streak | This is the backup. It is what gets restored on a new phone |
| Settings: reference currency, theme, notification choices | So the app looks the same on every device you use |
| Subscription status | To unlock Premium on your other devices |
| If you turn on release-day alerts: a push token for that device, the currencies you hold, and when the device was last seen | To send the alert to the right phones and prune dead tokens |
Meridian never asks for your name, address, date of birth, phone number, bank, broker, card, or any government identifier, and there is nowhere in the app to enter them.
Where it is stored
On Supabase infrastructure in Frankfurt, Germany (EU). Each account can read and write only its own rows; that isolation is enforced by the database itself, not by application code.
Who else is involved
| Service | What it handles | Where |
|---|---|---|
| Supabase | Database, sign-in, backup | EU (Frankfurt) |
| Resend | Sends the confirmation and password-reset emails | Receives your email address only |
| Google Play Billing / RevenueCat | Subscription purchase and status | Meridian never sees your card |
| Expo push / Firebase Cloud Messaging | Delivers notifications, if you turn them on | Receives a device token, no figures |
| Sentry | Crash reports | Stripped of identity and amounts — see below |
| PostHog | Anonymous usage counts, if you leave them on | EU region |
Nobody in that list receives your financial figures, and none of them is an advertiser.
Crash reports
When the app crashes it can send a report so the fault can be fixed. The report contains the technical stack trace, the app version and the device model. Your identity, your email and every monetary amount are removed before it is sent, because a financial app leaking a balance into a bug tracker would be indefensible.
Usage analytics
Meridian counts anonymous events — which screens are opened, whether onboarding is completed, whether a month gets logged — to see which parts of the app work and which do not. These counts carry no email address, no holding names and no amounts, and are processed in the EU. You can switch them off in Profile → Settings → “Anonymous usage data”, and switching them off stops collection immediately.
Why we are allowed to hold it (GDPR)
- To perform the contract — your account, backup and sync exist because you asked for them.
- Legitimate interest — crash reports and basic abuse protection, so the app keeps working.
- Consent — notifications and usage analytics. Both are optional and both can be withdrawn in the app.
How long
Your data is kept while your account exists. Delete the account and it is removed from the server at once — not queued, not soft-deleted. Encrypted infrastructure backups may retain a copy for up to 7 days before they roll over. Guest data lives only on your device, for as long as the app is installed.
Your rights
If you are in the EU or UK you may ask for a copy of your data, correct it, delete it, receive it in a portable format, restrict or object to processing, and withdraw consent at any time. Write to support@meridianyield.app and you will get an answer within 30 days. You also have the right to complain to your national data-protection authority.
Deletion needs no request: Profile → “Delete my account” does it instantly, and these instructions cover the case where you no longer have the app installed.
Children
Meridian is not directed at children and is not intended for anyone under 16. No age is collected; if you believe a child has created an account, write in and it will be removed.
This website
meridianyield.app sets no cookies, runs no analytics and loads nothing from
a third party — the fonts and images are served from this domain. The
/confirmed page briefly receives a sign-in token in the part of
the URL after the #, which browsers never transmit to any
server; it is read on your device and removed from the address bar
immediately.
Changes
If this policy changes materially you will be told in the app before the change takes effect. The date at the top always reflects the current version.
Meridian · support@meridianyield.app