What your roommate should never see

Here is a question someone asked PocketMoney during testing. "Can Sam afford to cover my half this month?" It is a fair thing to wonder. It is also exactly the kind of question PocketMoney will never answer.

Everyone has their own private chat with PocketMoney. Groups, which we call Circles, are where shared costs live. Between the two sits what we call the privacy wall, a set of rules about what can move from your private chat into a group. This post walks through those rules and one leak we caught before it shipped.

What never leaves your chat

Some things stay with you, and nobody in a group can see them.

• Bank balances, and whether you connected a bank at all
• Income, paychecks, and when you get paid
• Your personal spending and budgets
• Any coaching PocketMoney gives you about your own money
• What you owe or are owed in your other groups

If someone asks about another person's private money, PocketMoney says no and explains why. It does this every time, however the question is phrased.

What can cross, with your okay

A group does need some facts to work.

• A specific expense you choose to split, with the amount and what it was for
• The agreed split and who owes whom as a result
• A shared goal everyone opted into, like saving $1,200 for a trip, and how close you are
• Your display name

Even these do not get passed along on their own. PocketMoney does not send anything to another person until the person sharing it confirms. That check lives in code, not only in the instructions we give the AI, because an instruction can be talked around and code cannot.

The leak hiding in a fair split

Here is where it gets more interesting. Say two roommates want to split rent by income, so the one who earns more pays more. PocketMoney can do that math using both incomes without ever showing either one.

But the answer can give the secret away. If you know your own income and you are told you pay 40 percent of the rent, you can work out that your roommate earns one and a half times what you do. The inputs stayed hidden and the output leaked them anyway.

We found this before income-based splits went out, and it changed how we think about the wall. Hiding the numbers that go in is not enough. We also have to ask what someone could work out from the number that comes out.

Trying to break it on purpose

Before we trusted the wall, we ran tests built to break it. Some asked politely. Others tried tricks, like pretending to be the other person or hiding instructions inside a message. The wall held each time. We will keep running these tests, since every new feature is a new place for something to slip through.

Accountability without surveillance is the phrase we use for all of this. The people you share money with should be able to count on you, without being able to look through your bank account.