SplitSimple — Privacy Policy
Contents
1. What data we collect
We collect the minimum data needed to provide bill-splitting. The data falls into these categories:
Account data (required to sign in)
- Email address — used to sign you in and to send transactional notifications (settlement alerts, monthly summaries, Pro waitlist confirmations).
- Display name and profile photo — pulled from your Google account via Firebase Authentication's Google Sign-In provider. Shown to other members of groups you join.
- Google account ID — internal user identifier; never exposed to other users.
Group & expense data (the core product)
- Group names, member lists, group types (Trip / Home / Office / Event / Other).
- Expenses: amount, description, date, category, payer, split breakdown, notes, receipt item assignments.
- Settlements: who paid whom, when, for how much, and which expense (if linked).
- Optional fields you may enter: UPI payment IDs (VPA, e.g.
name@upi) for one-tap UPI settlement deep-links, profile photos of custom group members you add manually, recurring expense schedules.
Receipt data (only if you scan a receipt)
- Uploaded photo stored in Firebase Storage, encrypted in transit and at rest.
- OCR text extracted from the receipt (vendor, date, line items, tax, tip, total).
- OCR processing uses the MiniMax vision API; the image is sent to MiniMax for the duration of the scan and is not retained by MiniMax per their data processing terms.
Notifications
- Firebase Cloud Messaging (FCM) device token — required to send push notifications to your device. You can disable notifications in your device settings or in SplitSimple Settings.
Usage analytics & crash reports
- Firebase Analytics — anonymized event data (which features you use, not what you typed). Helps us understand which features are valuable and which need fixing. You can opt out via the in-app Settings toggle.
- Firebase Crashlytics (Android) — crash logs including stack traces, device model, OS version, and an anonymized user identifier. Helps us fix bugs. Crash reports never include expense descriptions or financial amounts.
- Web error reporter (browser) — uncaught JavaScript errors with anonymized session context, written to Firestore
crashReports/for our own debugging.
Cookies & local storage (web only)
- Authentication cookies — required to keep you signed in. Set by Firebase Auth.
- Local storage — your theme preference (dark/light), onboarding completion flag, draft expenses, offline expense queue, user UPI ID for convenience, sound & notification preferences. None of this leaves your device unless you sign in and sync.
2. Why we collect it
- To run the core product: store your groups, expenses, and balances.
- To let group members see who paid for what, and to settle up.
- To send you notifications you have opted into (settlement alerts, monthly summaries, push for new expenses in groups you belong to).
- To fix bugs and improve the product (analytics & crash reports).
- To comply with legal obligations and respond to lawful requests.
3. Where it is stored and who can see it
All data is stored in Google Firebase (project
splitit-f0b83). Firebase is operated by Google LLC and
stores data in their regional data centers. By default, our project uses
Google's multi-region storage (typically nam5 in the United States
for Firestore and Storage).
Who can see your data:
- Other members of groups you join see your display name, profile photo, expenses you add, and your running balance. They do not see your email address.
- People with a public group link (
/g/<groupId>) see the group name, member list with display names, and simplified balances — but not expense details unless they sign in. - SplitSimple (us) — we (the development team) have administrative access to the Firebase project for the purpose of operating the service, fixing bugs, and responding to abuse reports.
- Sub-processors: Google (Firebase), MiniMax (receipt OCR only — image is sent for processing, not stored).
4. When we share data with third parties
We do not sell your data. We do not share your data with advertisers, data brokers, or marketing networks. The only third parties that receive your data are the sub-processors listed above, for the specific purposes of authentication, storage, OCR, notifications, and analytics. A full list of sub-processors is available on request.
5. How long we keep your data
- Account data & group data — kept until you delete your account or the relevant group.
- Receipt photos — kept as long as the parent expense exists.
- Analytics events — Firebase Analytics retains data for 14 months by default, after which it is automatically deleted or anonymized.
- Crash reports — retained for 90 days for active debugging, then deleted.
- FCM device tokens — deleted when you uninstall the app or sign out from the device.
6. Your rights (access, correction, deletion)
You can at any time:
- Export your data — from Group Settings → Export to CSV. A full account export (all groups, expenses, settlements) is available on request.
- Delete an expense, group, or your entire account — from the in-app Settings (Settings → Delete account), or by request at www.splitsimpleapp.com/delete-account.html. Deleting your account immediately removes your profile and settings, your sign-in, and every group where you are the only member. In groups you share with others, the expenses and settlements you were part of are kept so the other members' balances stay correct, but your name, email and photo are removed and you appear as "Deleted user".
- Opt out of analytics & crash reporting — from in-app Settings.
- Opt out of push notifications — from in-app Settings or your device settings.
- Request a data subject access request (DSAR) — email support@splitsimpleapp.com. We respond within 30 days.
7. Legal basis & India DPDP Act compliance
SplitSimple is built and operated from India. For users in India, we comply with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Draft Digital Personal Data Protection Rules, 2025.
- Consent (Section 6, DPDP Act): We obtain free, specific, informed, and unconditional consent before collecting personal data. Consent is requested in a standalone notice (not bundled with Terms of Service) and is withdrawable at any time from Settings.
- Data minimization (Section 5): We collect only the data needed to provide the service.
- Storage limitation (Section 8(5)): Data is retained only as long as necessary for the purpose it was collected, or as required by law.
- Breach notification (Section 8(6)): In the event of a personal data breach affecting your data, we will notify the Data Protection Board of India and affected users within 72 hours of becoming aware of the breach.
- Cross-border transfer (Section 16): If you sign up from outside India, your data is stored in Google Firebase's global infrastructure. The Government of India has not yet notified any country as a restricted destination under Section 16; the default under the Act is that data may be transferred to any country not so notified.
- Rights of Data Principals (Sections 11–14): Right to access, correction, erasure, and grievance redressal are all available in-app or by contacting support@splitsimpleapp.com.
- Grievance Officer: For any data-protection concerns, contact our Grievance Officer at support@splitsimpleapp.com. We acknowledge within 48 hours and resolve within 30 days.
For users in the European Economic Area, UK, or California
We extend the same rights (access, correction, deletion, portability, restriction of processing, objection) to all users regardless of location. If you are in the EEA/UK, our lawful basis under GDPR Article 6 is your consent for analytics and crash reporting, and performance of a contract (our Terms of Service) for the core service.
8. Children's privacy
SplitSimple is not directed at children under 13 (or under 16 in the EEA/UK). We do not knowingly collect personal data from children. If you believe a child has signed up, contact support@splitsimpleapp.com and we will delete the account within 7 days.
9. Security
- All data is encrypted in transit (TLS 1.2+).
- Firestore data is encrypted at rest by Google.
- Firebase Security Rules restrict reads and writes so users can only access groups they are members of.
- We never store your password — Firebase Auth hashes it.
- UPI IDs and sensitive identifiers are stored as plain strings inside Firestore, gated by the same Security Rules as the rest of your data.
No system is 100% secure. If you discover a security issue, please email support@splitsimpleapp.com (we do not run a public bug bounty at this time, but we acknowledge good-faith reports within 72 hours).
10. Changes to this policy
We may update this policy as the product evolves. Material changes will be announced in-app and (where required) by email at least 14 days before they take effect. The "Last updated" date at the top reflects the current version.
11. Contact us
- General privacy questions: support@splitsimpleapp.com
- Grievance Officer (DPDP): support@splitsimpleapp.com
- Security disclosures: support@splitsimpleapp.com
- Data deletion requests: support@splitsimpleapp.com