Privacy policy
SplitPe is a free app for splitting expenses with friends, on Android, iOS and the web at web.splitpe.app. This policy explains what personal data we collect, why, who processes it for us, how long we keep it, and the rights you have. It is written to meet India's Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the rules under them. By creating an account you consent to what is described here. Our Terms of service also apply.
Who we are
SplitPe is a free app run from India. For the DPDP Act, SplitPe is the data fiduciary for the data described below. Contact: privacy@splitpe.app.
What we collect
- Account details: your email address, and your name as you enter it or as Google or Apple share it when you sign in with them. If you use Sign in with Apple and hide your email, we get Apple's relay address instead.
- Sign-in provider details: if you sign in with Google or Apple, the identifier they give us for you, your email, your name and, for Google, the URL of your profile photo. We store the photo's web address, not a copy of the image.
- Profile details you choose to add: a phone number (optional, never verified or used to contact you) and a UPI ID (optional). Members of a group you are in can see your name, phone number, profile photo and UPI ID, so they can recognise you and pay you.
- What you put in the app: groups, members, expenses and their descriptions, how they are split, settlements, and the activity history of your groups. This is visible to the other members of the same group or 1:1 ledger.
- People you add who are not on SplitPe yet: the name, and optionally the phone number, you enter for them, so they can be included in splits and can later claim their place with an invite link. Only add people who are fine with this (see the Terms).
- Device details for notifications: a push token and the platform (Android or iOS) for each device you sign in on, and whether you have turned notifications on. Notification text (group name, member names, expense description and amount) passes through Google's and Apple's push services.
- Technical data: our hosting, database and email providers keep standard logs (such as IP address, time, and browser or device type) for security and troubleshooting.
- On the web app: your sign-in session is kept in your browser's local storage so you stay signed in. We do not use cookies for tracking.
What we don't collect
- Your address book: when you add a member from your contacts, your phone's own contact picker opens and only the one contact you pick comes into SplitPe. SplitPe does not ask for the contacts permission on Android or iOS: the picker hands over only that contact, SplitPe keeps only its name and the one phone number you choose, and we never read or upload the rest of your address book.
- Payments: UPI payments happen in your UPI app. SplitPe only opens a payment link; we never see your bank details, UPI PIN or payment status.
- No advertising, no ad tracking, no analytics SDKs, and we don't sell or rent your data.
Why we use it, and on what basis
- Run the app (sign you in, show your groups and balances, let group members see shared expenses): account details, profile, content. Basis: your consent when you sign up and use the features, and data you voluntarily provide for that purpose.
- Send sign-in codes and notifications about activity in your groups: email, push token. Basis: your consent. You can turn notifications off in the app or in your device settings at any time.
- Keep the service secure and fix problems: technical data. Basis: your consent, and data you voluntarily provide for that purpose.
- Comply with the law and respond to lawful requests from authorities. Basis: legal obligation, including keeping the logs the law requires.
You can withdraw your consent at any time by deleting your account (see below). Withdrawing stops further processing but does not affect what was done before.
Who can see your data
Other members of a group can see that group's expenses, splits, settlements and activity, and each other's name, phone number (if added), profile photo and UPI ID. Nothing is public and nothing is searchable by other users. Anyone you give a group's invite link to can see the group's name and the names of members who haven't joined yet, and can join the group.
Who processes it for us
- Supabase: database, sign-in and server functions. Your data is stored in Supabase's Mumbai, India region.
- Google Firebase Cloud Messaging and Apple Push Notification service: deliver push notifications.
- Resend: sends sign-in code emails.
- Cloudflare: hosts splitpe.app and the web app, and serves them through its global network.
- Google and Apple: if you choose to sign in with them. The web app also loads its rendering engine and some fonts from Google's servers, which see your IP address.
Some of these providers may process data outside India. We share data with them only to provide the service, and with authorities only when the law requires it. We do not sell personal data.
How long we keep it
We keep your data while your account exists. In the app you first need to settle up all your balances before deleting your account. If you can't settle up, email us and we will erase your account anyway; the balance then stays in the group under your old display name. When your account is deleted, we delete your sign-in, profile, phone number, UPI ID, profile photo link, devices and notifications. Expenses and settlements you were part of stay in your groups so other members' balances remain correct. They keep the display name you had in each group (your name, or the start of your email address if you never set a name) but are no longer linked to your account.
Names and phone numbers you entered for people who aren't on SplitPe belong to the group, so they stay in it after you delete your account. The person concerned can ask us to remove theirs by emailing us.
We don't keep separate logs of our own. Our providers keep standard logs for the periods they set, and some sign-in records may remain with them after you delete your account. We do not currently keep separate backups; if that changes, deleted data will age out of backups within a reasonable period and we will update this policy.
Your rights
Under the DPDP Act you can:
- ask for a summary of the personal data we hold about you and who we share it with;
- correct or update it (you can edit your name, phone number and UPI ID in the app at any time);
- have it erased (Account → Delete account, or see how to delete your account);
- withdraw your consent;
- nominate another person to exercise these rights if you die or become incapacitated;
- get your grievance resolved.
To use any of these, email privacy@splitpe.app from the address you signed up with. We reply within the time the law requires. If you are not satisfied with our response, you can complain to the Data Protection Board of India. We offer the same rights to everyone, wherever you live.
Grievance officer
Adit Luhadia · privacy@splitpe.app. We acknowledge and resolve complaints within the time the law requires.
Security
Data is encrypted in transit (HTTPS). Access to data is limited by database rules so that you only see groups you belong to, and splits and balances are validated on the server. No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board as the law requires.
Children
SplitPe is for people aged 18 and over. Indian data protection law requires verifiable consent from a parent or lawful guardian before we can process the personal data of anyone under 18. We don't offer a way to collect that consent, so under-18s can't use SplitPe. We don't knowingly collect their data. If we learn that a user is under 18, we will delete their account. If you think this has happened, please tell us.
Changes
If we change this policy, we'll update this page and its dates. For material changes we'll also tell you in the app or by email.