SPLITSAMAAbout this policy
SplitSama has no ads, and your expenses are end-to-end encrypted: only the people you share them with can read them, not us. This policy explains what the SplitSama app for Android (app ID com.cadence.splitsama) collects, why, and the choices you have.
SplitSama is made by SplitSama, an independent developer ("we", "us"). Questions about privacy: splitsama@gmail.com.
By using SplitSama you agree to this policy and to our Terms of Service.
Information the app handles
Your expenses are stored on your phone. When you share a group or expense, it is encrypted on your phone before it leaves.
| Information | Examples | Where it is kept | Who can read it |
|---|---|---|---|
| Google sign-in | Your Google email address, name and profile photo | Your phone. Your name and photo are used as your profile. | You; your name and photo are shown to people you share with |
| Your profile | Your name, photo, and payment handles you add (such as UPI, PayPal, Venmo, Revolut or Cash App) | Your phone; encrypted copies on the sync relay and in your backup | You and the people you share groups or expenses with |
| Friends you add | A friend's name, and an optional email or phone number, typed or picked from your contacts | Your phone; encrypted copies on the sync relay and in your backup | You and the members of groups you share with them |
| Expenses and groups | Descriptions, amounts, currencies, categories, dates, notes, splits, items, settlements, budgets, trip dates, comments and change history | Your phone; encrypted copies on the sync relay and in your backup | Members of the group or the people in the expense |
| Personal (self) expenses | Bills you track only for yourself | Your phone; encrypted copies for your own other phones and in your backup | Only you |
| Device keys | A signing key, the keys for each group, and a list of your signed-in phones | Your phone (secure storage); encrypted in your backup | Only you |
| Backup | An encrypted copy of your keys and data | Your own Google Drive, in a hidden app folder; or a backup file you save yourself | Only you (see "Backups") |
| Subscription status | Whether SplitSama Pro is active, renewal dates, a purchase reference, and a random customer ID | Google Play and RevenueCat | Us and RevenueCat, to unlock Pro |
| Crash reports | Error messages, app version, device model and operating system | Sentry | Us, to fix bugs |
| Device push token | A token that lets your phone get a "something changed" ping | The sync relay and Expo's push service, until you turn notifications off or the token stops working | Us and Expo, to deliver pings; it contains no expense data |
| IP address | Your device's internet address when it connects | Processed by the sync relay when your phone connects; not stored with your data | Us, to deliver data and limit abuse |
We do not use advertising or tracking tools, we do not collect your location, and we do not sell or share your information for advertising.
How sync works
- End-to-end encrypted. Changes are encrypted on your phone before they are sent. Our relay, which runs on Cloudflare, stores only encrypted data. It cannot see names, amounts, groups or who wrote what.
- What the relay processes. As expected for a relay, it processes your device's IP address and device push token. The IP address is used to deliver data and for short, per-minute limits that stop floods of requests; the relay does not keep request logs or store IP addresses with your data. The push token is kept with the encrypted mailboxes you belong to so the relay can ping your phone, and is removed when you turn notifications off or the token stops working.
- Invite links and QR codes. In an open group, anyone with the link or QR code can join. With "Approve new members" on, people can only ask to join until a member approves them. Invite links open a page on our website, splitsama.app. The invite itself, which includes your name and the group's name, is in the part of the link that browsers do not send to any server, so the website never receives it.
- Personal inboxes. Messages between people, such as non-group expenses, reminders and invitations, go to an encrypted inbox only the recipient can read. Inbox messages are deleted after 90 days.
- Notifications. When something changes, the relay sends your phone a ping with no content, through Expo and Google's push services. Your phone writes the notification text itself.
- Exchange rates and settings. The app downloads daily currency rates through our relay and app settings from Google Firebase. These requests send nothing about you or your expenses.
- Network data. Like any internet service, Cloudflare, Google, Expo, RevenueCat and Sentry see your device's IP address when it connects. They handle it under their own privacy policies.
Backups
- Google Drive. When you sign in with Google, SplitSama backs up an encrypted copy of your data to a hidden app folder in your own Google Drive every day. It only asks for access to that folder, not to your other Drive files.
- How it is protected. The backup key is created by our relay from your verified Google sign-in, and nothing about it is stored per user. Google holds the encrypted backup but not the key, and our relay can make the key but never receives the backup, so neither can read it alone.
- Backup file. You can also save a backup file protected by a passphrase you choose. Nobody, including us, can recover a lost passphrase.
Permissions and features on your phone
- Camera. Used to scan invite QR codes and receipts. The microphone is not used.
- Photos. Used only when you pick a receipt image from your library.
- Receipts. A receipt is scanned and read on your phone (using Google's on-device document scanner and ML Kit); its amounts go into the expense and the photo is deleted. Receipt photos are never uploaded or stored.
- Contacts. Used only when you tap "Choose from contacts", to read the one contact you pick. We never upload your contact list.
- Messages you paste. When you paste a bank, card or UPI message to make an expense, it is read on your phone and not uploaded.
- Notifications. Used for group changes, comments, reminders and budget alerts. You can turn them off in the app or in your phone's settings.
- Import and export. Splitwise files you import are read on your phone. CSV, Excel and PDF exports are made on your phone and go only where you share them.
Service providers
| Service | What it receives | Purpose |
|---|---|---|
| Google (Sign-In, Drive, Firebase) | Your sign-in; your encrypted backup; requests for app settings | Sign-in, backups and feature settings |
| Cloudflare | Encrypted sync data, backup-key requests, IP addresses and device push tokens | Running the sync relay |
| Expo and Google push services | Push token and content-free pings | Notifications |
| RevenueCat and Google Play | Random customer ID, purchase and subscription status | SplitSama Pro purchases |
| Sentry (stored in the EU) | Crash and error reports, cleaned on your phone first | Fixing bugs |
Crash reports never include your name, email, people, expense text, screenshots or screen recordings. You can turn crash reports off in Account.
We may disclose information if required by law, to protect users' safety, or as part of a sale or transfer of the app, in which case this policy continues to apply.
Payments
Settle-up buttons open your payment app (for example UPI or PayPal) with the details filled in. Payments happen in that app; SplitSama never sees or stores card or bank details. SplitSama Pro is paid through Google Play, which handles your payment details.
Keeping and deleting your data
- Delete your account. In Account, tap Delete my account. You leave every group (others see "Deleted user", and their balances stay correct), groups you own lose their owner so every remaining member can edit them, your Google Drive backup is deleted, SplitSama's access to your Google account is revoked, and the data and keys on this phone are erased. If you use other phones, sign them out first from Your devices. This cannot be undone.
- Log out or sign out a phone. Logging out erases SplitSama's data on that phone, and your backup stays in Drive. From Devices, you can sign out another of your phones; it erases its data the next time it connects.
- On friends' phones. Expenses you shared stay on the phones of the people you shared them with, as in any shared ledger. You can delete expenses and comments you are part of. Deleting a group removes it for everyone in it.
- On the relay. Encrypted group data stays on the relay so members, including new ones, can sync. If nobody uses a group for 12 months, its data is removed from the relay; members' phones still have it and send it again if the group is used later. Inbox messages expire after 90 days. We cannot read relay data or tell whose it is.
- Subscription. Deleting your account does not cancel SplitSama Pro. Cancel it in Google Play; billing records are kept by Google as the law requires.
Step-by-step instructions are on our account deletion page. If you can no longer open the app, email splitsama@gmail.com and we will help. You can also remove SplitSama's backup from Google Drive in Drive settings under Manage apps, and remove its access in your Google account settings.
Depending on where you live, you may have the right to see, correct or delete your information, or to complain to a data protection authority. Contact us to use these rights.
Security, children and changes
Security. Shared data and backups are encrypted with XChaCha20-Poly1305, and every change is signed by its author's device key. No method is perfectly secure, so keep your phone locked and your invite links private.
Children. SplitSama is for people aged 18 or over. It is not meant for children, and we do not knowingly collect information from them.
Where information is processed. Our service providers may process information in countries other than yours, under their own safeguards.
Changes. We may update this policy. We will change the date at the top and, for important changes, tell you in the app.
Contact. SplitSama, splitsama@gmail.com.