Privacy Policy

The short version

• We collect what we need to run Budgetsplit: your email address, your name, and what you and your groups enter. • A personal space is visible only to you. What you add to a group is visible to every member of that group. • Your data is stored in the European Union, in Frankfurt, Germany. • We do not sell your data, we show no advertising, and we use no analytics or tracking. • You can download all of your data and delete your account yourself, in Settings, at any time. • If you turn on notifications in the phone app, a short line about your group passes through Expo and Google or Apple to reach your phone.

The rest of this page explains each point in detail.

Who we are

[your full legal name], [postal address where you can be served], decides why and how your personal data is used in Budgetsplit (the "controller" under the EU General Data Protection Regulation, GDPR).

This policy covers the Budgetsplit website at budgetsplit.app, the web app at manage.budgetsplit.app and the Budgetsplit apps for phones. It does not cover other websites or services that we link to or that you use alongside Budgetsplit, such as Google or an app store.

Contact for anything about your data: contact@budgetsplit.app. We have not appointed a data protection officer, because the law does not require one for a service of our size. Privacy questions go to the address above and are read by the person who runs Budgetsplit.

What we collect: your account

• Your email address, and the name you choose to show to other people. • How you sign in: password, or Google. If you use a password, our sign-in provider keeps only a one-way scrambled version of it. We never see it and cannot read it back. If you use Google, Google tells us your email address, your name and the address of your Google profile photo, and nothing else. We do not get access to your Google account, contacts, files or calendar. Your sign-in provider keeps these details with your account. We show your profile photo only to you, in your own account menu and settings. It is loaded straight from Google's servers, and we do not copy it, store it anywhere else or show it to the other members of your groups. • When your account was created, and when you last signed in. • The versions of the terms and privacy policy you accepted, your confirmation that you are 18 or older, and when you gave them. We record a yes and a date, never a date of birth. • If you turn on two-step sign-in, the key your authenticator app uses to make codes, kept by our sign-in provider so it can check them. • Your plan (Free or Plus), from and until when, and how you got it, for example free in early access. • Whether you have finished the first-run setup.

What we collect: what you enter

• Transactions: amount, currency, date, category, note, who paid, and who shares an expense and by how much. • Payments between members, recorded to settle up. • Budgets, and the names of your groups and custom categories. • Which groups you belong to, and your role in each (owner, admin or member). • The names of people you add to a group who do not have an account, such as children. We store only the name you type. They cannot sign in. • Invite codes you create for your groups. • Check-ins: how often your group has one (weekly, monthly or off), when you marked a week or month as reviewed, and any note you add to one. The other members of the group see who has reviewed it and the notes. • Requests to join a group. When you type an invite code, we record a request with the date. It does not add you to the group: the owner or an admin decides. While it waits, they see your name and email address, so they can tell who is asking. We keep a request until it is approved, withdrawn or has been unanswered for 14 days, and a declined or unanswered one for up to 90 days in all. • Invitations by email. When an owner or admin invites someone by email, we store that email address, the group and who sent the invitation, and send that address one email through Mailjet naming who invited them and to which group. Only a person signed in with that address, confirmed, can see and accept it. We delete an invitation when it is accepted, declined or cancelled, and after 14 days at the latest. If you received one and do not want it, ignore it or decline it. • Early-access requests. When you ask for early access on our website, we store your email address, the language you asked in, the date, and which versions of these terms and this policy you agreed to. When we grant your request we store the date and send that address one email through Mailjet with a link to create your account; if the address already has an account, we send one email saying so instead. Only we can see the requests. A request is deleted a year after it was made, or as soon as its account is deleted.

Whatever you type into a note or a name is stored exactly as you typed it. Please do not enter anything you would not want the members of that group to read, and never enter bank card numbers, passwords or health information.

What we collect: money details you choose to add

• Accounts, such as a bank account, a card, cash or a joint account: the name you give it, its kind, its currency and whose it is. We never ask for account or card numbers. • Tags, and trips or events: their names, dates and budgets. • Entries in another currency: the original amount, its currency and the exchange rate. To suggest a rate, our API asks the Frankfurter service for the European Central Bank's published rate between the two currencies on that date. Nothing about you is sent. • Linked entries: if you add your share of an entry in one group to another of your groups, the members of that group see your share, its date, the category and note you choose, and the name of the group it came from. If the original is deleted, or your share in it goes, the linked entry goes too. If the group it came from is deleted, or you leave either group, it stays as an ordinary entry. • Payment details, only if you add them: a PayPal.me name, a UPI ID, or an IBAN with the account holder's name. You choose the groups that see them. Their members can see them, and whoever owes you money sees buttons that open PayPal or a UPI app with the amount filled in, or the bank details to copy. Adding, changing or removing them needs a recent sign-in. We never ask for card numbers or banking passwords, and no payment passes through Budgetsplit.

What we collect: security and technical records

• Short records of actions in a group (for example "member removed", "invite code created"), with the date and who did it, but no amounts and no notes. We keep them to investigate abuse and mistakes. • Attempts to join a group with an invite code, so that guessing codes can be slowed down and stopped. • When you add entries, payments or groups, a note of who did it and when, kept for one hour, so that nobody can flood a group or the service by adding things in a loop. • Request counts. To stop floods of requests and password guessing, our API counts the requests from each IP address for one minute, and failed password attempts for each email address, kept only in scrambled form, for 15 minutes. The counts are held in memory, shared through Upstash, and then expire. • Each attempt to enter a two-step sign-in code, with the time, kept for 15 minutes, so that a code cannot be guessed. • Early-access emails. When we send an email because somebody asked for early access on our website, we keep a scrambled copy of that address with the time for one day, so that the form cannot be used to send anyone more than one email a day. • Remembered devices. If you tick "Don't ask again on this device for 30 days" when you enter a code, that browser or phone keeps a random key, and we store a scrambled copy of it with the date it was added and last used. It is deleted after 30 days, after 7 days without a sign-in on that device, when you sign out everywhere, change your password or remove your authenticator app, and with your account. • Technical details that our hosting and sign-in providers record whenever you use the service: your IP address, the type of browser or device, the pages or functions requested, and the time. These are needed to deliver the service, find faults and defend against attacks. • Emails we send you (for example to confirm your address) and the fact that they were sent. If you write to us, we keep your message and our reply.

Notifications on your phone

Notifications are optional. If you allow them in the phone app, we store:

• a push address for the app on that phone (an identifier your phone and Expo create), whether the phone runs Android or iOS, the app's language, and when it was registered and last used; • a record of each notification for you: what happened (for example who added an expense and how much, a payment between members, a request to join, or a category going over its budget), the group, and when it was created, sent and read.

To reach your phone, the notification's text, such as the group's name and "Sam added €12.50", and the push address are passed to Expo, which hands them to Google (Firebase Cloud Messaging) for Android phones or to Apple (Apple Push Notification service) for iPhones. Apart from that text, a notification carries only identifiers that tell the app which group and entry to open. Notes are never included.

You choose which kinds you get in Account settings, under Notifications, and you can turn them all off in your phone's settings. Signing out on a phone removes its push address, and so does uninstalling the app once your phone reports that it is gone.

The same records make up the list of notifications you see in the website and the app. A notification counts as read once you open it or mark all as read.

Feedback you send us

Sending feedback is optional. If you use "Send feedback" in the website or the app, we store what you wrote, the kind you picked (a problem, an idea or something else), whether you sent it from the website, an Android phone or an iPhone, the app's version, when you sent it, and your account, so that we can understand what happened and follow up with you.

Only the people who run Budgetsplit can read it. Other users, including the members of your groups, never see it. It is included when you download your data.

What we do not collect

We do not collect your location, contacts, the photos on your device, camera or microphone data, or advertising identifiers. We have no analytics, no advertising tools and no third-party trackers in the website or the apps. We do not track you across other websites or apps.

If you use the phone app's fingerprint or face lock, your phone handles that. Budgetsplit never receives your fingerprint or face data, only the phone's answer of yes or no.

Where your data comes from

Almost all of it comes from you: what you type, and the choices you make in the app. Some comes from other people: the members of a group can add entries that involve you (for example an expense that you share, or a payment to you), and a group owner can remove you from the group. If you sign in with Google, your email address, name and the address of your profile photo come from Google. Technical records are created automatically when you use the service.

Why we use it, and our legal basis

We use your data only to run Budgetsplit for you and to keep it safe. Under the GDPR we need a legal basis for each use:

• To create your account, sign you in, show your groups and work out who owes whom. This is needed to provide the service you asked for (Article 6(1)(b), performance of a contract). • To protect the service and its users: limiting repeated attempts, keeping action records, finding and fixing faults, defending against attacks and abuse. This is our legitimate interest in running a secure service (Article 6(1)(f)). You can object to it; see "Your rights". • To keep a record that you accepted the terms and confirmed your age, to answer legal claims, and to meet our legal duties (Article 6(1)(c) and (f)). • To answer you when you write to us and to send the emails that the service needs, such as confirming your address or a password reset (Article 6(1)(b) and (f)). • To send the notifications you allowed, about the groups you belong to. This is part of the service you asked for (Article 6(1)(b)), and you can switch it off at any time. • To read and act on feedback you send us, so we can fix problems and improve Budgetsplit. This is our legitimate interest in improving the service (Article 6(1)(f)).

We do not sell your data. We do not use it for advertising, and we do not build profiles of you. We do not make decisions about you by automatic means that have legal or similarly significant effect. We do not use what you enter to train artificial intelligence models.

Other people's data in your groups

A group is shared. Your name, and everything you add to a group, is visible to every member of that group for as long as it stays there. The owner and the admins of a group can also see who its members are and can remove members.

When you enter information about other people, for example a friend's name in a note, you are responsible for having the right to do so. Do not enter more about anyone than you need to.

If you add a child, or another person without an account, you are entering that person's name, and what you record about their spending, on their behalf. Only do this for a child you are the parent or legal guardian of, or for someone who has agreed. We hold nothing else about them and we do not contact them. The owner and the admins of a group can add and remove people without accounts. Removing one replaces their name with "Former member" straight away, and what they paid for or shared stays in the group so its totals stay correct.

Group members are not part of Budgetsplit and are responsible for what they do with information they see in a group. We cannot control what a member does with it, for example if they copy it or take a screenshot.

Who sees it

• You. • The members of any group you belong to, for what is entered in that group, including your name. • The people who run Budgetsplit, only when needed to operate, secure and support the service. We do not read your entries as a matter of routine. • The service providers listed below, who handle data on our behalf and only to run Budgetsplit. They are bound by data processing agreements and may not use your data for their own purposes. • Courts, authorities and others, where the law requires us to share data, or where it is needed to establish, exercise or defend legal claims. • A buyer or successor, if Budgetsplit is ever transferred to another operator. We would tell you first, and this policy would keep applying unless you agreed to a change.

The app stores (Google Play, and later the Apple App Store) tell us about downloads under their own policies. Budgetsplit does not receive your store account details.

Our service providers

• Supabase: our database and sign-in service. It stores your account and everything you enter. Region: European Union (Frankfurt, Germany). • Vercel: hosts the website and our API. Everything the website and the phone app send or receive passes through the API on its way to and from our database, so Vercel processes it in transit, together with technical details such as your IP address. The API itself stores nothing you enter. Its request logs record which address was called, when, and your IP address, and Vercel deletes them after a few days at most. Both run in Frankfurt, Germany, but a request may pass through Vercel's wider network on the way. • Mailjet (Mailjet SAS, France): sends the confirmation and password-reset emails, so it processes your email address and the message. We do not track whether you open an email or click its links. Region: European Union. • Sentry (Functional Software, Inc., United States): receives a technical report when something in Budgetsplit breaks, so we can fix it. A report holds the error and where in our code it happened. We leave out your name, email address, entries, amounts, notes, IP address and sign-in details. Region: European Union (Frankfurt, Germany). Reports are deleted after 90 days at the latest. • Google: if you choose Google sign-in, Google identifies you and passes your email address, name and profile photo address to us. Google acts under its own privacy policy, and it may learn that you use Budgetsplit, including when your device loads your profile photo from Google's servers to show it to you. Choosing Google is optional; you can sign in with a password instead. • Google Play (and later the Apple App Store): where you download the phone app. • Expo (650 Industries, Inc., United States): delivers notifications to the phone app. It receives a notification's text and your phone's push address, and passes them on to Google or Apple. • Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service): deliver notifications to Android phones and iPhones. • Upstash (Upstash, Inc., United States): holds the short-lived request and password-attempt counts described above. Region: European Union (Frankfurt, Germany). They expire after one minute and 15 minutes. • Cloudflare (Cloudflare, Inc., United States): runs the name service for our domain and forwards email sent to our addresses, including messages you send us, to our mailbox, where our email provider keeps them.

If we add a provider that handles your personal data, we will name it here before it starts.

Where it is kept, and transfers abroad

Your data is stored in the European Union, in Frankfurt, Germany, in our Supabase database.

Some of our providers are companies based outside the European Union, for example in the United States, and their staff or systems may be able to reach data. Where that happens we rely on safeguards the law recognises, such as the European Commission's Standard Contractual Clauses or the provider's certification under the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards that apply at contact@budgetsplit.app.

If you use Budgetsplit from outside the European Union, your data is still handled in the European Union under this policy.

How we protect it

Your data is encrypted in transit (HTTPS) and encrypted at rest in our EU database. Every request is checked by the database itself, so only the members of a group can read what is in it. The database allows no direct access to group or money tables, and each function checks who is asking and validates every value. People who are not signed in get nothing.

Amounts are hidden until you choose to show them. The website signs you out after a period of inactivity. The phone app locks the moment you leave it, and screenshots are blocked in release builds. The website uses a strict Content-Security-Policy.

Budgetsplit does not currently use end-to-end encryption, which means our systems can read the information you enter in order to run the service.

No system is perfectly secure. If a security breach puts your rights at risk, we will tell the data protection authority and you as the law requires, as soon as we can. If you find a weakness, please tell us at contact@budgetsplit.app.

Cookies and similar storage

Budgetsplit uses only what it needs to work. Because of that there is no cookie banner to accept.

• Sign-in cookies (website): keep you signed in. They are set only when you sign in, they are not used for tracking, and they are removed when you sign out. • Device storage (website): your theme and whether amounts start hidden are saved in your browser's local storage under the name "budgetsplit.prefs". Nothing sensitive is stored there. • Secure storage (phone app): your sign-in session is kept in the phone's secure storage (Keychain on iOS, Keystore on Android), and your preferences on the device.

We use no advertising cookies, no analytics and no trackers. You can clear this storage at any time in your browser or phone settings; you will then have to sign in again.

How long we keep it

We keep your data until you delete your account. When you do:

• your account, name, email, consent records and any personal space are deleted; • entries you added to a group you shared with other people stay in that group, so the group's totals stay correct. They are shown as "Former member", and nothing links them back to you; • if you were the owner of a shared group, ownership passes to its longest-standing admin, or if it has none to the longest-standing member who has an account; if nobody with an account is left, the group is deleted; • if an owner deletes a group, the group and everything in it (transactions, payments, budgets, categories and members) is deleted for every member straight away; • the link between you and the short action records is removed straight away, and those records are deleted after 180 days; • invite-attempt records and the scrambled copies of addresses we sent an early-access email to are deleted after one day, the notes of how often you added things after one hour, and two-step code attempts after 15 minutes; • request counts expire after one minute, and failed password-attempt counts after 15 minutes; • payment details are deleted as soon as you remove them, and with your account; • a notification is deleted 30 days after you read it, and after 90 days at most if you never do; a phone's push address is kept until you sign out on it, delete your account, or the phone reports the app is gone; • feedback you sent us is deleted with your account, and after two years at most; • the record that you reviewed a check-in, and notes you added to one, are deleted after about 13 months, or when you leave the group; • our providers keep backups and logs on a rolling schedule, so a copy can remain in a backup for up to 7 days after deletion, and is then overwritten.

If you leave a group without deleting your account, what you added stays in that group, attributed to you. Ask the group owner or write to us if you want it removed. Messages you send us are kept for as long as needed to deal with your request, and for up to three years after it is settled where the law lets us keep them to defend legal claims. Records that the law obliges us to keep are kept for as long as the law requires.

Your rights

You have the right to:

• see the personal data we hold about you, and get a copy (Article 15). Settings, Download my data gives you one straight away; • have wrong data corrected (Article 16). You can change your name in Settings; • have your data erased (Article 17). Settings, Delete account does this; • restrict or object to how we use your data: ask us to pause using it while a problem is looked into (Article 18), or object to uses based on our legitimate interests (Article 21). If you object, we stop unless we can show a compelling reason that outweighs your interests, or we need the data for legal claims; • receive your data in a form you can move to another service (Article 20). The download is a structured file, and a group's transactions can also be exported as CSV; • withdraw any consent you gave, at any time, without affecting what happened before.

To use a right, use the buttons in Settings or write to contact@budgetsplit.app. We may need to check it is really you. We will reply within one month, and tell you if we need longer for a complicated request. It is free of charge unless a request is clearly unfounded or excessive.

You can complain to a data protection authority: the one where you live or work, the one where an alleged breach happened, or the one responsible for us in Germany. You are welcome to contact us first, and we will try to put things right.

Do you have to give us this data?

Your email address and name are needed to create an account. Without them we cannot offer Budgetsplit. Everything else you enter is your choice; a group only shows what you and its members decide to put in it. Confirming your age and accepting the terms are needed to use the service. Google sign-in is optional.

If you are in India

Under India's Digital Personal Data Protection Act you can ask to see, correct, complete and erase your personal data, to have complaints dealt with, and to nominate someone to act for you if you die or cannot act yourself.

Our grievance officer is [full name of the grievance officer for India], at contact@budgetsplit.app. Write to them to use any of these rights, or with any complaint about how we handle your data or about Budgetsplit. We confirm a complaint within 24 hours and decide on it within 15 days. If you disagree with our decision, you can appeal to the Grievance Appellate Committee, and you can complain to the Data Protection Board of India.

Children

Budgetsplit is for people who are 18 or older. We ask everyone to confirm their age when they sign up, and we do not knowingly collect data from anyone younger. If we learn that an account belongs to someone younger, we will delete it. If you think that has happened, write to contact@budgetsplit.app.

Changes to this policy

If we change this policy in a way that matters, we will tell you in the app or by email before it takes effect, and where the law requires it we will ask you to accept it again. Smaller corrections, such as fixing a typing mistake, may be made without notice. The date at the top shows when it was last updated.

Contact

[your full legal name] [postal address where you can be served] contact@budgetsplit.app