Privacy Policy

Effective Date: April 1, 2026  ·  Last Updated: March 17, 2026

Your privacy is important to us. This Privacy Policy explains how Andrii Korshenko ("we," "us," or "our") collects, uses, discloses, and protects your personal information when you use the Splitmaster mobile application ("the App") and its associated services.

By using the App, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the App.

1. Who Can Use Splitmaster

Splitmaster is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

Users between 16 and 18 years of age (or the age of majority in their jurisdiction) may only use the App with the consent of a parent or legal guardian who agrees to be bound by these terms on the minor's behalf.

2. Information We Collect

Information we collect falls into two categories: information you provide to us and information collected automatically.

2.1 Information You Provide

When you create an account or use the App, you may provide:

  • Name
  • Email address
  • Profile photo (avatar)

When you sign in using Google or Apple, we receive your name, email address, and profile photo as provided by the authentication provider. We do not receive or store your Google or Apple account password.

When you use the App's features, you may provide:

  • Receipt images (photos of purchase receipts)
  • Expense descriptions, amounts, and currency
  • Group names and membership
  • Settlement notes
  • Contact information (when you choose to invite friends via the App)

2.2 Information Collected Automatically

When you use the App, we automatically collect:

  • Device information (device type, operating system, app version)
  • Device identifiers (e.g., Firebase installation IDs)
  • IP address
  • Error and crash data (via Firebase Crashlytics)
  • Push notification tokens (via Firebase Cloud Messaging)
  • Subscription and purchase transaction data (processed via Apple App Store or Google Play Store through RevenueCat)

2.3 Device Permissions

The App may request access to the following device features:

  • Camera: To scan and photograph receipts
  • Storage, photos, and media: To select receipt images from your gallery
  • Notifications: To deliver push notifications about expense activity, settlements, and account updates

You can manage all permissions at any time through your device settings. Denying permissions may limit certain App features but will not prevent you from using the core expense-tracking functionality.

3. How We Use Your Information

We use the information we collect for the following purposes:

  • Providing core services: Creating and managing your account, processing receipt scans, tracking expenses, calculating balances, and facilitating settlements between users
  • Communication: Sending push notifications about expense activity, settlements, and account-related updates; sending one-time passwords (OTP) for authentication via email
  • Security and fraud prevention: Verifying your identity via App Check and Turnstile CAPTCHA, enforcing rate limits, detecting and preventing abuse
  • Service improvement: Analyzing crash reports and error data to improve App stability and performance
  • Subscription management: Processing and managing your subscription status and scan credit balance through RevenueCat
  • Compliance: Fulfilling legal obligations, responding to lawful requests, and enforcing our Terms of Service
  • Account administration: Managing your account lifecycle including registration, profile updates, and account deletion

We do not use your personal information for advertising, marketing, or profiling purposes.

4. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

4.1 With Other Users

When you participate in shared expenses or groups, other participants can see your name, profile photo, and expense-related information (amounts owed, items claimed, settlements). Shared expense records function as a mutual ledger — all participants in a shared expense can view the expense details. You control who you share expenses with by choosing participants. Other users may enter expenses that affect your displayed balance without requiring your prior approval.

4.2 With Third-Party Service Providers

We use third-party service providers to help us operate, maintain, and improve the App. These providers may process your personal information on our behalf for the following purposes:

  • Authentication and account management
  • Cloud hosting, database management, and data storage
  • Receipt image processing and text extraction (OCR)
  • Subscription and payment management (via the Apple App Store and Google Play Store)
  • Push notification delivery
  • Error and crash reporting
  • Security and fraud prevention (including CAPTCHA verification)
  • Transactional email delivery
  • Currency exchange rate data

These providers are contractually obligated to protect your information and may only use it to perform services on our behalf. Receipt images sent for processing are used solely for text extraction and validation — they are not used to train third-party AI models.

4.3 For Legal Reasons

We may disclose your information if required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.

4.4 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

5. Data Storage and International Transfers

Your personal information is stored and processed in:

  • Netherlands (EU) — Microsoft Azure West Europe (application hosting, receipt processing), Neo4j Aura (graph database)
  • United States — Supabase, Firebase, RevenueCat, Cloudflare, Brevo

If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with data transfer restrictions, please note that your data may be transferred to and processed in countries that may not provide the same level of data protection. We rely on appropriate safeguards for international data transfers, including Standard Contractual Clauses and other mechanisms as applicable to each service provider.

6. Data Retention

We retain your personal information only for as long as necessary to provide our services and fulfill the purposes described in this policy.

  • Account data (name, email, avatar): Retained for the duration your account exists
  • Receipt images: Retained while the associated receipt exists in your account
  • Extraction and metadata cache: Automatically deleted after 30 days
  • Webhook event records: Automatically deleted after 90 days
  • Crash and error logs: Retained per Firebase Crashlytics default retention periods

When you delete your account, we will delete all your personal data generally within 30 days under normal operating conditions (see Section 8 for details). In exceptional circumstances such as service outages, deletion may be slightly delayed but will be completed as soon as reasonably practicable.

We may retain certain information longer if required for legal compliance, fraud prevention, or dispute resolution.

7. Security

We implement commercially reasonable security measures to protect your personal information, including:

  • Encryption of data in transit (HTTPS/TLS)
  • Authentication via secure JWT tokens
  • Firebase App Check attestation to verify legitimate app instances
  • Rate limiting to prevent abuse
  • Atomic database operations to prevent race conditions
  • Secure credential storage via Azure Key Vault

No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account.

In the event of a personal data breach, we will comply with applicable breach notification requirements, including notifying the relevant supervisory authority and affected individuals as required by law.

8. Account Deletion

You may request deletion of your account at any time through the App (Settings > Delete Account). Upon requesting deletion:

  • Your account is immediately locked and you cannot access any services
  • You have a 30-day grace period during which you may cancel the deletion request
  • After 30 days, we permanently and irreversibly delete: your user account and profile data, all receipt images, your avatar, all associated database records (receipts, items, claims, groups, settlements, activities, connections, device tokens), and webhook event records
  • Deletion cannot be undone after the grace period

After deletion, anonymized records of shared expenses (amounts, dates, descriptions) may remain visible to other participants as part of their own expense history. Your name, email, and profile photo will be removed from those records.

You may also request account deletion by contacting us at privacy@splitmaster.co.

9. Communication Preferences

You can manage your notification preferences within the App. Push notifications can be enabled or disabled in the App's settings. You may also disable push notifications through your device's system settings.

Certain communications are required for the operation of your account and cannot be opted out of, including one-time passwords for authentication and critical account-related notices (e.g., account deletion confirmation).

10. Automated Processing

The App uses automated processing for receipt scanning (text extraction via OCR) and balance calculations. These automated processes do not make decisions that produce legal effects or similarly significantly affect you. All expense data generated by automated processing can be reviewed, edited, and deleted by you at any time.

11. Your Rights

11.1 All Users

Regardless of your location, you have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate or incomplete information
  • Request deletion of your account and personal data
  • Withdraw consent for optional data processing
  • Lodge a complaint with us or a relevant regulatory authority

11.2 European Economic Area (EEA) Residents — GDPR

If you are located in the EEA, you have additional rights under the General Data Protection Regulation (GDPR):

Data Controller: Andrii Korshenko is the Data Controller for your personal information. Contact: privacy@splitmaster.co.

Legal Bases for Processing:

  • Performance of a contract: Processing necessary to provide you with the App's services (account management, expense tracking, receipt scanning, settlements)
  • Legitimate interests: Security and fraud prevention, service improvement through crash analytics, enforcing our Terms of Service
  • Consent: Where you have given specific consent (e.g., enabling push notifications, granting device permissions)
  • Legal obligation: Where processing is required to comply with applicable law

Additional Rights:

  • Right to restrict processing of your personal information
  • Right to data portability (receive your data in a machine-readable format, where technically feasible and as required by applicable law)
  • Right to object to processing based on legitimate interests
  • Right to withdraw consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at privacy@splitmaster.co. We will respond within 30 days. This period may be extended by up to 60 additional days for complex or numerous requests, in which case we will inform you of the extension within the initial 30-day period.

If you terminate or delete your account, we will delete your personal information generally within 30 days. You also have the right to lodge a complaint with your local data protection authority.

11.3 United Kingdom Residents — UK GDPR

If you are located in the United Kingdom, you have rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller: Andrii Korshenko is the Data Controller for your personal information.

Your rights mirror those described in Section 11.2 above, including the right to restrict processing, data portability, objection, erasure, rectification, and access.

International Transfers: Where we transfer your data outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR (Article 45) and the Data Protection Act 2018, including Standard Contractual Clauses.

Data Breach Notification: In the event of a personal data breach, we will comply with applicable notification requirements, including reporting to the Information Commissioner's Office (ICO) and notifying affected individuals as required by law.

Complaints: You have the right to lodge a complaint with the ICO:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113
Website: www.ico.org.uk

We would appreciate the opportunity to address your concerns before you contact the ICO. Please reach out to us first at privacy@splitmaster.co.

11.4 United States Residents — State Privacy Laws

If you are a resident of California, Colorado, Delaware, Florida, Virginia, or Utah, you have additional rights under applicable state privacy laws.

California Notice of Collection (CCPA/CPRA):

In the past 12 months, we have collected the following categories of personal information:

  • Identifiers: name, email address, IP address, account identifiers
  • Commercial information: subscription and purchase history
  • Visual data: receipt images (photos)

We collect and use these categories for the business purposes described in Section 3. We do not sell or share your personal information for cross-context behavioral advertising.

Your Rights:

  • Right to know what personal information we collect, use, and disclose
  • Right to delete your personal information
  • Right to correct inaccurate personal information
  • Right to opt out of the sale or sharing of personal information (we do not sell or share your data)
  • Right to non-discrimination for exercising your privacy rights

Do Not Track: The App does not respond to "Do Not Track" or similar signals.

To exercise your rights, contact us at privacy@splitmaster.co.

12. Third-Party Links

The App may contain links to third-party websites or services (e.g., Apple App Store, Google Play Store). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing them with your information.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. For material changes, we will provide at least 30 days' advance notice via email, in-app notification, or by posting the updated policy in the App and updating the "Last Updated" date.

Your continued use of the App after changes take effect constitutes your acceptance of the revised policy.

14. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of Belgium. For details on jurisdiction and dispute resolution, see our Terms of Service.

15. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

Andrii Korshenko

Leuven, Belgium

Email: privacy@splitmaster.co