Privacy

Last changed 19 September 2026. Pairstead was called Bond until that day — the web address still says bond, and nothing about what happens to your writing changed with the name.

Pairstead holds the ordinary machinery of two people's life together — the chores, the money, the calendar — and also the parts that are not ordinary at all: how each of you felt today, what you said to each other after an argument. That is a lot to hand to a computer, so this page says what happens to it, in the same plain words as the rest of the app and with nothing left out because it was awkward.

Nothing you write is sold or shown to advertisers. There are no trackers, no analytics and no cookies. Two things do leave, and only when you press for them: asking for a suggestion sends a short summary of your home to Google, and pressing Read it for me on a receipt sends that one photo to Google. Google are allowed to learn from both — Where the words go is the whole of it, in plain words. Never press either and nothing you write goes to anybody else. The one other place it goes is a backup: a copy of the whole database, kept on the computer of the person who runs Pairstead, so that a lost disk does not mean a lost home, with Repair, the sit-down and private notes scrambled inside it — Backups says exactly how. Pairstead is one person's project, run for free, and there is nothing here that makes money out of knowing about you.

A few things matter more than the rest, so they are said first rather than buried.

What is kept

Your account

An email address, the name you want to be called, and — if you add them — a picture and a phone number. Your password is never kept. What is kept is a bcrypt hash of it, which is a one-way scramble: it can check a password you type and it cannot be turned back into one.

If you signed in with Continue with Google, there is one more thing: Google's own identifier for your account, kept so that Pairstead recognises you the next time. There is no password on an account made that way — nothing to keep a scramble of — until you set one. You can, and then you have both ways in.

Your home

The name you give it, the six-character invite code that lets your partner join, the date you say you got together, your currency and your time zone.

What the two of you put in

• Chores and tasks — the title, any notes, who it is for, when it is due, who added it and whether it is done.
• Calendar events, with their titles, notes and times.
• Shopping lists and what is on them.
• Thank-yous — when one of you thanks the other for something, what it was for, the line you added if you added one, and when. They are written to be read, so they are shared like the chores they are usually about, and they are never sent to the AI. If your partner has turned notifications on, their phone is told that you thanked them — your name, and never what for.
• “Thinking of you” taps — who sent one and when, and nothing else. Only the last forty are kept. They reach your partner inside Pairstead, and — if they have turned notifications on — as a notification on their phone with your name in it. Pairstead does not email them.
• A pause in an argument — when one of you asks for twenty minutes: who asked and when, and nothing about what the argument was.
• Money — each expense with its description, amount, category, who paid and how it was split, and any budget you set per category. Bills you set to come back each month, with the day they fall due. Each time you settle up: who paid whom, how much and when. If you choose to split costs by income, what each of you takes home a month — which, like everything here, your partner can see, because it is how the split is worked out. Your savings goal too: what you are saving for, the amount you are aiming at, and each amount you put aside with the note you gave it.
• Receipt photos — if you add a photo of the receipt or bill behind an expense, the picture and which of you added it. Like the photos on Our story, each is redrawn on your own phone first (to at most 1600 pixels on its longest side), kept in a table of their own in the same database, not sealed — your partner sees them — and removed when the expense is. A home holds up to 300. A receipt often shows the last digits of a card, a shop's address or a name, so it is worth knowing that it is kept. It only goes to Google if you press Read it for me; see Where the words go. In a copy of Pairstead with no server behind it, they stay in that browser.
• Goals, milestones and anniversaries.
• Family members and pets: names, how they are related, birthdays, notes, and — if you add one — a photo of them. A photo you choose is redrawn small before it is kept, and it is kept in the same database as everything else and shown to your partner like everything else. It is never sent anywhere outside Pairstead.
• Photos on Our story — the picture, the day you say it belongs to, the line under it if you write one, and which of you added it. Each is redrawn on your own phone before it is sent, to at most 1280 pixels on its longest side, so the full-size original never leaves it. They are kept in a table of their own in the same database as everything else — not with the rest of your home, only because they are too big to travel with it — and they are not sealed: they are both of yours, your partner sees every one, and either of you can take one down, which removes it for both of you at once. A home holds up to 200. They are never sent to the AI or anywhere else outside Pairstead. In a copy of Pairstead with no server behind it, they stay in that browser and nowhere else.
• Your agreement — the promises, the goals and the lines you write down together.
• Daily check-ins: the mood you pick each day, and the line about that day if you write one.

About each of you

A current mood, a birthday, the traits, likes, dislikes and what makes you happy, a love language, and free-text notes. If you fill in the cycle tracker, that is health information. Since 5 September 2026 the tracker keeps a record of every period you enter — not one date but a list of them, each with the day it started and, if you say, how many days it lasted — because that is what lets Pairstead work out your average rather than take your word for it. The dates stay until you delete them. Alongside the list, the two figures you can set by hand: how many days your cycle usually runs and how many days the bleeding usually lasts. All of it is kept in the same database as everything else and shown to your partner like everything else. Leave the tracker switched off and nothing about it is stored.

Repair, and the Sunday sit-down

What each of you writes in these two: what you felt, what you think the other felt, what you want to happen now; what went well, what did not, what is ahead. These are kept in their own rows rather than with the rest, precisely so the withholding can be enforced by the server instead of by the screen.

The technical minimum

• A sign-in token in your browser's own storage, so you are not asked to sign in every time. It lasts thirty days. Logging out removes it. Changing your password — whether you remember the old one or use a reset link — ends every other session at once, so if you think somebody else has your password, changing it is the thing that puts them out.
• A copy of your home in your browser, so Pairstead can be opened and used without waiting for the server. It is cleared when you log out.
• A copy of Pairstead's own files — the page, its styling, its icon — so that Pairstead opens with no signal, and so it can be installed on a phone. It is the app, not your writing, and it comes from Pairstead's server and nowhere else. Removing the app, or clearing the site's storage in your browser, removes it.
• Your network address, counted rather than stored. The server keeps a running count per address for a minute at a time, so one visitor cannot guess at passwords quickly. It is held in memory, written to no file, and gone when the app restarts.
• No cookies at all. Pairstead does not set one, for any purpose.

Notifications on a phone

Only for a phone or browser where somebody pressed Turn on and the phone itself asked and was told yes. For each one, Pairstead keeps: the address the phone's push service gave it, the two keys the phone made so that a message can be sealed to it and to nothing else, the language the phone reads Pairstead in, and which of the three kinds it wants. That is all. It is forgotten when you turn notifications off, when you log out on that phone, when you delete your account, and when the push service says the phone has let go of it.

A notification is written on Pairstead's server from two things — which kind it is and your partner's display name — and then sealed to that one phone before it leaves, so the push service that carries it cannot open it. It never contains anything either of you wrote. Remember that a notification can appear on a locked screen, where whoever is holding the phone can read it; your phone's own settings can hide what notifications say until it is unlocked.

What your partner can see

This is the part people get wrong about an app like this, so it is spelled out.

Everything in your home is shown to both of you. Chores, money, calendar, shopping, goals, family, your agreement, your thank-yous, your check-ins and your moods — all of it is one shared home, drawn from one shared copy, and that is the point of the app.

Both profiles are shown to both of you too. When Pairstead loads, it hands each device the shared home and both people's profile pages. So your traits, your likes, your love language, your birthday and your whole record of period dates reach your partner's copy of Pairstead. There is nothing in a profile that is hidden from the other person.

The cycle switch decides what is drawn, not what travels. Turning the tracker off means no screen in Pairstead shows it — not to your partner and not to you — but any dates already recorded still sit in your profile and still reach their device with the rest of it, the same way the private notes below do. Delete the dates if you want them gone. And the shared calendar marks cycle days for your own tracker only: your partner's never appear on it, however the switch is set.

Seeing is not editing. Your partner's tab shows you their profile as they wrote it, and nothing on it can be changed from your side — not their name, not their mood, not their likes, not the Shared and Private switches that are theirs to set. Only you can change yours, and only they can change theirs.

That includes the notes on your own profile under Private notes about my partner. Those are yours alone, and they are sealed. They are kept under your account rather than in the home the two of you share, they are asked for only by you and handed back only to you, and there is no screen, no sync and no part of Pairstead that puts them in front of your partner.

That changed on 18 September 2026, and it is worth saying what it was before. Until then those notes lived in your profile, and your profile travels to your partner's device along with the rest of it — so a note no screen ever drew for them still arrived on their phone, where somebody who went looking in their browser could have found it. It was out of sight rather than sealed. This page said so at the time, as a known gap rather than a papered-over one, and it is now closed: the notes have their own rows, their own address, and the withholding is decided by the server. Anything written before that day was moved up the first time Pairstead signed in and is no longer in the shared copy.

Repair and the Sunday sit-down work the same way, and they are real ones. In those two, what you write is a draft that never leaves the server, and it stays that way until your partner has written theirs as well. Only then does each of you see the other's. That is enforced on the server, on its own rows, rather than by hiding it in the page — which is the difference between a promise and a mechanism.

Where the words go

Pairstead can write suggestions and answer questions about your home using an AI service. On the live site this is switched on, and the service is Google Gemini. It runs on Pairstead's own key, so it costs you nothing and there is nothing for you to set up.

Nothing is sent unless you ask. Pressing the button for a suggestion, or putting a question to Ask Pairstead, is what sends anything; the rest of the app sends nothing to Google and Pairstead never does it in the background. When you do ask, this is exactly what goes: both of your names, the titles of open chores and who they are for, the titles and times of upcoming events, the total you have spent this month, and the titles of active goals. If you have set Pairstead to a language other than English, the name of that language goes too, because that is how the answer comes back in it — the word “Georgian”, not anything you have written. Repair and the Sunday sit-down are not in that, and must never be. Check-in notes, cycle dates, profile notes and your email addresses are not in it either, and nor is what either of you takes home — if you ask Ask Pairstead who owes whom, the answer is worked out from the shares your split comes to, never from the pay figures themselves.

Reading a receipt. When you add a photo of a receipt, a Read it for me button fills in the amount, the shop, the day and the category for you. Pressing it sends that one photo to Google Gemini and nothing else — no names, nothing else from your home — and what comes back only fills in the form: you check it and save it yourself. It is on the same free tier as the rest, so what is printed on the receipt (often the last digits of a card, and the shop's address) may be kept by Google and read by a person there. Do not press it and the photo never leaves Pairstead. It always goes on Pairstead's key, even if you have added a key of your own.

The part worth knowing before you press it. Pairstead's key is on Google's free tier, and Google's terms for that tier let them keep what is sent, have a person read it, and use it to improve Google's own models. So the handful of things listed above stop being private to Pairstead the moment you ask for a suggestion. That is the price of the feature being free, and it is why it is a button rather than something that happens by itself — never press it and nothing you have written ever reaches Google. Everything else in Pairstead works exactly the same either way.

You can use a key of your own instead. There is a box for one in You, under AI Assistant, and Google, Anthropic and OpenAI all give one out. With a key there, the suggestion on Today and the budget tip are sent from your browser straight to that provider on your key, without passing through Pairstead's server at all — so the household snapshot above is not attached, only the sentence being asked. Ask Pairstead is the exception: it answers by reading your real chores and spending, which only the server can do, so it always uses Pairstead's key. Your own key is stored with your household data, which means your partner's device has it too.

The other services involved

• Railway runs the app and holds the database, and the daily backup copies beside it. They are the landlord: all of it lives on a disk of theirs.
• Google Gemini writes the suggestions, answers Ask Pairstead and reads a receipt when you press Read it for me — only ever when you ask. Where the words go, above, lists exactly what is sent and what Google's free tier allows them to do with it.
• Google Fonts. Pairstead's own page asks Google's font service for its two typefaces, which tells Google's servers that a browser at your network address opened Pairstead. Nothing you have written is involved. This page and the terms page do not do it — they use the fonts already on your device.
• Brevo delivers the two emails Pairstead sends, and nothing else ever goes through them. For a password reset: your email address, your display name and the reset link itself, at the moment somebody asks for one. For the nudge that says it is your turn: your email address and your partner's display name, at the moment they write their half. Nothing either of you has written is in either message — not a chore, not a line of a repair, not a figure. Their own privacy policy is at brevo.com.
• Your phone's push service, if you turn notifications on. Pairstead cannot reach a phone directly; it hands the message to the service that belongs to your browser — Google for Chrome and Android, Apple for Safari and the iPhone, Mozilla for Firefox, Microsoft for Edge — and they pass it on. The message is sealed so they cannot read it. What they can see is that a message went to that phone, when, and roughly how long it was. Pairstead sends to those four and to no other address.
• Google, if you press Continue with Google. Google asks for your password on Google's own page — Pairstead never sees it — and hands back three things: an identifier for your Google account, your email address with Google's word that it is confirmed, and the name on the account. Nothing else is asked for. Pairstead does not ask for and cannot reach your mail, your files, your contacts or your calendar. Nothing you write in Pairstead is ever sent to Google, and Google is told nothing about it. Pressing that button tells Google that you opened Pairstead, in the same way that visiting any site that offers it does; not pressing it tells them nothing.
• goQR.me draws the square code, if you press Show QR code on an invite. What reaches them is the invite link itself — Pairstead's address and your home's six-character code — and nothing else: no name, no email, nothing you have written. Not pressing it sends them nothing.

Pairstead's use of what Google hands over follows the Google API Services User Data Policy, including its Limited Use requirements. In plain words: that identifier, that address and that name are used to sign you in and to keep your account yours, and for nothing else. They are not sold, not passed on, not used for advertising, and not used to train any model. Getting rid of your Pairstead account gets rid of them, the same as everything else.

Pairstead also has the plumbing for Google Calendar, Stripe, Slack and text messages written into it, and none of those is connected: no keys are configured on the live site, so those parts do nothing and nothing is sent to any of them. Google Calendar is a different thing from the sign-in button above and is not switched on — signing in with Google gives Pairstead no access to your calendar and never asks for any. The reset email and the nudge described at the top of this page are the only two emails Pairstead sends, and the notifications above are the only other messages — and only to a phone that asked for them. If anything else is ever switched on, this page changes first.

What never happens

• Nothing you write is sold, or shared for money.
• There is no advertising, no analytics, no tracking pixel and no third-party script of any kind.
• Pairstead itself does not train any model on your writing, and sends nothing to one unless you ask for a suggestion — Where the words go says what happens when you do.
• Pairstead sends two kinds of email and no others: a password-reset link when somebody asks for one, and the nudge that says your partner has written their half. There is no newsletter, no announcement, no reminder and no marketing. Your partner cannot make Pairstead email you anything about you — the nudge is the one email either of you can cause, and all it can say is that it is the other one's turn.
• A notification never carries anybody's writing, never advertises, and never reminds you of anything. It only ever says that your partner did one of three things — tapped, thanked you, or is waiting for you — and only on a phone where you switched that on.

Taking it back, and getting rid of it

Deleting your account. It is in You, at the bottom of Account. It removes you, your profile and your side of anything sealed. If your partner is still using the home, the home itself and the shared history stay — because they are as much theirs as yours. If you were the last one in it, the home and everything in it goes with you. There is no bin to recover it from. Copies of it stay in the backups for a while — Backups says how long.

Removing your partner. It is on their tab in Us. It ends the shared home for your account: you come out of it into a new, empty one with a new invite code, and the anniversary, events, chores, shopping, money, agreement and the photos on Our story do not come with you. Your own profile does — your name, photo, lists and private notes are yours and stay with your account. Their copy is not touched, because it is as much theirs as yours: they keep the home as it stood and simply find themselves alone in it. Your own daily check-ins leave with you rather than staying on their screen. The invite code you had before stops working, so a link you already sent somebody no longer opens anything.

Joining your partner when you already have an account. Their code can be typed in from Today or from the partner tab in Us, and opening their invite link while signed in asks the same question. Saying yes moves your account into their home. Your own profile comes with you. Anything you had added to your own home while you were alone in it — chores, events, money and the rest — does not, and because nobody is left in that home it is deleted, the same as a home whose last person leaves. Your own daily check-ins go with that home.

Getting a copy first. Write to the address below and you will be sent a copy of what Pairstead holds for you. It is what you can already see in Pairstead and nothing more — your partner's private notes are never in it, and neither is any half of theirs they have not revealed yet.

How long things are kept. Everything stays until you delete it or ask for the account to go. There is no automatic clear-out. The one thing that outlasts a deletion for a while is the backup, below.

Backups

Pairstead keeps copies of its database, because the alternative is that one broken disk loses every home in it for good. There are two kinds, and neither is ever shared with anybody.

• One copy a day on the same server, at Railway, beside the database itself. The last seven are kept and older ones are deleted.
• A copy taken off the server from time to time, onto the personal computer of the one person who runs Pairstead, into a folder that is not synced to any cloud. The ten most recent are kept there and older ones are deleted.

A backup is the whole database, so it holds everything Pairstead holds — including Repair, the sit-down and private notes, which are in it scrambled, under a key that is kept apart from the backups and is not on that computer. (Copies made before 18 September 2026, when the scrambling was switched on, hold it plainly; the ones on the server are replaced within a week, and the ones on the computer are being deleted.) It is only ever opened to put Pairstead back after something has gone wrong, never to read. Passwords are in it only in the scrambled form described under Keeping it safe.

What this means for deleting. When you delete something, or your whole account, it is gone from Pairstead straight away, but a copy taken before then still has it until that copy is replaced: within a week on the server, and on the computer once ten newer copies have been taken. If Pairstead ever has to be put back from a backup, anything deleted after that copy was made would come back with it, and it will be deleted again if you ask. Where the button is, and what to do if you cannot sign in, is on its own page.

Keeping it safe

• The site is served over HTTPS, so what travels between your browser and the server is encrypted.
• Passwords are stored hashed with bcrypt and never in a readable form.
• A reset link is stored the same way — only a scramble of it is written down, so a copy of the database is not a way into anybody's account. Each one works once and stops working after an hour.
• Everything either of you types is escaped on its way into the page, so text your partner wrote cannot run as code on your device.
• Sealed writing is kept in its own tables with its own rules, rather than mixed in with the shared home.
• The words in Repair, the sit-down and private notes are also encrypted where they are stored (AES-256), with a key kept apart from the database — so a copy of the database, including Pairstead's own backups, cannot be read without it. The server holds that key, because it is what decides when your partner may see your half. This is not end-to-end encryption, and it is not described as one.
• The backup download is opened only by a long secret that is never written in any page, and a copy is made by the database itself rather than by copying a file that is being written to, so it opens whole.

None of that is a promise that nothing can go wrong. This is a small app run by one person, not a company with a security department. If something does go wrong and your writing is involved, you will be told plainly and quickly rather than quietly.

Who this is for

You need to be at least 16 to have an account here, or older where the law you live under sets a higher age for agreeing to something like this on your own. Pairstead is not built for children and does not knowingly keep anything belonging to one.

When this page changes

The date at the top is the last time it changed. If something changes that affects what happens to your writing — a service switched on, a new thing kept — it will be said in the app rather than quietly edited in here.

Asking about any of it

One person runs Pairstead and reads that address: hello@getpairstead.com. Questions about what is kept, requests to see it, and requests to delete all of it go to the same place.