Privacy Policy

This policy explains what information SplitEasy collects, why, who can see it and the choices you have. It applies to the SplitEasy apps for Android and iOS and to the website at spliteasy.net (together, "SplitEasy"). SplitEasy is made by Fishtail Games ("we", "us").

1. Information we collect
2. Phone permissions
3. How we use information
4. Who can see your information
5. Service providers
6. Legal bases
7. Keeping and deleting data
8. Your rights
9. Security
10. Children
11. International transfers
12. Changes and contact

1. Information we collect

Information you give us

• Account details: your name, email address, password (stored only as a secure hash), profile photo, preferred currency and, if one is added to your account, a phone number. If you sign in with Google, Google shares your name, email address and profile photo with us.
• What you put in SplitEasy: groups and their names, types and photos; expenses and payments, including amounts, currency, date, category, who paid and how they were split; recurring expenses; comments; group whiteboard notes; and receipt photos you attach.
• People you split with: when you add a friend by email, phone, friend code or from your contacts, we receive their name and the email address or phone number you give us, so we can link them to their SplitEasy account or hold a place for them until they join.
• Messages to us: if you contact support from the app, the email it prepares includes your account email, the app version and your device model and system version, so we can help. You can see and edit it before you send it.

Information collected automatically

• App usage (Firebase Analytics, apps only): which screens are opened, app version, device model, operating system, language, an app-instance identifier and an approximate location (country or city) that Google derives from your IP address. We use it in aggregate to understand which features are used. It is not used for advertising.
• Crash and performance reports (Sentry, apps only): when something goes wrong, details of the error, the device, operating system and app version, the steps in the app that led to it, and timing information. These reports help us fix bugs.
• Notification token (Firebase Cloud Messaging): an identifier for your device that lets us send you notifications, for example when a friend adds an expense. It is removed when you delete your account.
• Network information: your IP address reaches our servers and our network provider, Cloudflare. When you sign up, we use the country it indicates to pick a sensible default currency. Our servers keep short-lived technical logs for security and troubleshooting.
• Website cookies: the website uses only cookies it needs to work: one that keeps you signed in and one that protects forms against forgery. There are no advertising or analytics cookies on the website.

Information stored on your phone

The apps keep a copy of your groups and expenses on your phone so they work offline and sync when you are back online. Your sign-in tokens are kept in the phone's secure storage. Settings such as the app lock PIN and biometric unlock stay on your phone and are not sent to us. PDF and spreadsheet exports are created on your phone and go only where you choose to share them.

2. Phone permissions

The apps ask for these permissions only when you use the feature, and you can change them at any time in your phone's settings.

On iOS the app's settings also mention the music library and motion data. A third-party library requires those entries; SplitEasy does not use either.

3. How we use information

• To run SplitEasy: your account, syncing across your devices, working out balances, settling up and sending notifications.
• To keep accounts secure: verifying your email with a code, resetting passwords, and detecting and preventing abuse.
• To send service emails: verification codes, password resets and, if you invite someone who isn't on SplitEasy yet, an invitation to join that includes your name.
• To answer your questions and requests.
• To fix problems and improve SplitEasy, using crash reports and aggregate usage statistics.
• To meet legal obligations.

We do not sell or rent personal information, show ads, use your data to build advertising profiles, or track you across other companies' apps and websites.

4. Who can see your information

• People in your groups see your name and profile photo, and the expenses, payments, receipt photos, comments and notes in that group.
• Your friends see the balance between you and the expenses you share.
• Anyone you give your friend code or QR code to can see your name and profile photo before adding you.
• People you invite by email receive an invitation with your name.

We don't make your profile or expenses public.

5. Service providers

We use a small number of companies to run SplitEasy. They process information on our behalf, only for these purposes:

• Google Firebase: sign-in (including Google sign-in), app usage analytics and push notifications.
• Sentry: crash and performance reporting for the apps.
• Cloudflare: delivering the website and app traffic, and protecting it from attacks.
• Our hosting provider: the servers that store your account, groups, expenses and uploaded photos.
• Our email provider: sending verification codes, password resets and invitations.

We may also disclose information if the law requires it, for example in response to a valid court order, and to protect the rights and safety of our users or the public. If SplitEasy is ever sold or merged, your information may transfer to the new owner, who will remain bound by this policy.

6. Legal bases (EEA, UK and similar laws)

• Contract: to provide SplitEasy to you, including your account, groups, expenses and syncing.
• Legitimate interests: security and abuse prevention, crash reports and aggregate analytics to keep SplitEasy working and improve it, and sending invitations you ask for. You can object to these; see your rights.
• Consent: access to your contacts, camera, photos and notifications, which you give through your phone's permission prompts and can withdraw at any time in its settings.
• Legal obligation: where the law requires us to keep or disclose information.

7. Keeping and deleting data

We keep your information for as long as your account is open.

To delete your account, sign in at spliteasy.net with the same email or Google account you use in the app, then go to Account → Delete account. You can also email us from the address on your account and we'll delete it for you. You'll first need to settle any open balances, so nobody is left owed money they can't track. When your account is deleted, we immediately:

• close the account and sign you out on every device;
• unlink your email address and your Google sign-in, so the account can no longer be used;
• remove your notification token.

Expenses and payments you shared stay in your groups, because they are part of other people's records and balances, and may still show your name. We keep a short deletion record, with your original email address and any reason you gave, to prevent fraud and handle disputes. If you'd like your remaining personal information, such as your name and profile photo, erased or anonymised, email us and we will do so unless the law requires us to keep it. Copies in backups are removed as the backups are replaced.

Data stored on your phone is removed when you uninstall the app.

8. Your rights

Depending on where you live, you may have the right to:

• see the personal information we hold about you and get a copy of it;
• correct it (you can edit your profile in the app or on the website at any time);
• export your expenses (the apps export PDF and Excel files, and the website exports each group as CSV);
• delete your account and ask us to erase your information;
• object to or restrict how we use it, and withdraw consent you've given;
• complain to your local data protection authority.

To use any of these rights, email us at the address below. We'll reply within 30 days and may ask you to confirm the request comes from your account.

9. Security

All traffic between SplitEasy and our servers is encrypted with HTTPS. Passwords are stored only as secure hashes, and sign-in tokens on your phone are kept in its secure storage. Access to our systems is limited to the people who need it to run SplitEasy. No service can be perfectly secure, so please use a strong password and tell us straight away if you think someone else has accessed your account.

10. Children

SplitEasy is not meant for children under 13, or the older minimum age where you live. We don't knowingly collect information from them. If you think a child has given us information, contact us and we will delete it.

11. International transfers

Our service providers may process information in countries other than yours, including the United States. Where the law requires it, these transfers are covered by safeguards such as the European Commission's standard contractual clauses.

12. Changes and contact

If we change this policy, we'll post the new version here and update the date at the top. If a change is significant, we'll also tell you in the app or by email before it takes effect.