Privacy Policy

Splitoon ("we", "us", or "our") provides a mobile app and related services that help people track shared expenses. This Privacy Policy explains what information we collect, why we collect it, and the choices you have. By using Splitoon you agree to this policy.

Contact: [email protected]

1. Who we are

Splitoon is operated as a consumer expense-splitting product. The service includes the Splitoon iOS and Android apps, the API at api.splitoon.app, and this website at splitoon.app.

2. Information we collect

Account and profile

• Email address and display name
• Password (stored only as a secure hash)
• Optional country and preferred currency

Expense and group data

• Groups you create or join, invites, expenses, settlement records, participant shares, and related activity
• Receipt photos you attach and your profile photo, stored with our cloud storage provider and shown only to people you share a group or expense with

Device and notifications

• Push notification tokens (for example Firebase Cloud Messaging) so we can send expense and invite alerts
• Basic device platform information needed to deliver push

Diagnostics

• Crash and performance diagnostics (for example Firebase Crashlytics) to keep the app stable. These reports may include device model, OS version, and stack traces. They are not used for advertising.

Website

• Standard server logs (IP address, user agent, pages requested) when you visit splitoon.app, used for security and reliability
• Website analytics through Google Analytics: pages viewed, how you arrived (for example a search engine or link), approximate location (country or city), device and browser type, and a random identifier stored in a cookie so repeat visits can be counted. We do not send your name, email, or any expense data to Google Analytics

Website cookies and your choice

Google Analytics sets first-party cookies on splitoon.app, usually _ga and _ga_<ID>, which expire after up to two years. If you visit from the European Economic Area, the United Kingdom, or Switzerland, these cookies are not set unless you choose “Accept” in the cookie banner. If you choose “Reject”, or make no choice, no analytics cookies or identifiers are stored on your device; Google may still receive basic, cookieless signals (such as that a page was loaded) which it uses only to estimate aggregate visit statistics. We save your choice in your browser's local storage so we don't ask again on every visit. You can change it at any time with the “Cookie settings” link in the website footer, or by clearing your browser data.

The mobile app does not use Google Analytics or advertising cookies.

We do not sell your personal data. We do not use third-party advertising trackers in the app or on the website, and website analytics are not used for advertising.

3. How we use information

• Provide and sync your groups, balances, and activity
• Authenticate you and protect your account
• Send transactional email (verification, password reset, invites)
• Send push and in-app notifications you enable
• Improve reliability and fix bugs
• Understand how visitors find and use the website, in aggregate, so we can improve it
• Comply with law and respond to support requests

4. Legal bases (EEA / UK)

Where applicable, we process data under:

• Contract — to provide the Splitoon service you signed up for
• Legitimate interests — security, abuse prevention, and product improvement that does not override your rights
• Consent — where required (for example certain notification permissions on your device, and website analytics cookies for visitors in the EEA, UK, and Switzerland). You can withdraw consent at any time without affecting processing that happened before
• Legal obligation — when the law requires us to retain or disclose information

5. Sharing

We share data only as needed to run Splitoon:

• Other group members — name, expenses, and balances visible inside shared groups
• People with a group's web link — any member can turn on a read-only web link for a group. Anyone who has that link can see the group's name, members' first names and last initials, balances, and each expense's description, amount, category and date. Emails, profile photos and receipts are never shown. Links stop working 7 days after they are created, and any member can see how often the link was opened and turn it off, which stops it working immediately. Opening the page is not tracked by website analytics
• Service providers — hosting, file storage (Cloudflare R2), email delivery (Resend), and push/crash infrastructure (Firebase / Google), under agreements that limit use to providing their service
• Google Analytics (Google Ireland Limited / Google LLC) — website usage statistics, as described above. Google processes this data on our behalf under its data processing terms. You can read how Google uses data at policies.google.com/technologies/partner-sites, and you can also opt out in any browser with the Google Analytics opt-out add-on
• Legal — if required by law or to protect rights and safety

Splitoon records who paid whom for shared expenses. It does not process card payments or move money between bank accounts.

6. Retention

We keep your account and expense data while your account is active. If you delete your account, we remove or anonymize personal data associated with you, subject to short technical backups and any legal retention needs. Shared group history may be retained for other members in a form that no longer identifies you where possible.

Website analytics data linked to a cookie identifier is kept in Google Analytics for no longer than 14 months and then deleted automatically. Aggregate reports that do not identify anyone may be kept longer.

7. Security

We use HTTPS, hashed passwords, short-lived access tokens with rotating refresh tokens, and secure storage on device for session credentials. No method of transmission or storage is 100% secure; please use a strong unique password.

8. Your rights and choices

• Access or update profile preferences (country, currency) in the app
• Delete your account in the app (You → Delete account) or via the web deletion form
• Turn off push notifications in system settings
• Accept or reject website analytics cookies, and change your choice at any time, with “Cookie settings” in the website footer
• Email [email protected] for privacy requests (access, correction, deletion, objection) — we will respond within a reasonable time

If you are in the EEA/UK, you may also contact your local data protection authority.

9. Children

Splitoon is not directed at children under 13 (or the minimum age required in your country). We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

10. International transfers

Our servers and subprocessors may be located outside your country. Where required, we use appropriate safeguards for transfers — for example, website analytics data may be processed by Google in the United States under the EU–US Data Privacy Framework (and its UK and Swiss extensions) or the European Commission's standard contractual clauses.

11. Changes

We may update this policy. We will post the new version on this page and update the "Last updated" date. Material changes may also be communicated in the app or by email.

12. Contact

Privacy questions: [email protected]
Also see our Terms of Service.