Privacy Policy

What we collect

• Account details: your name, email address, phone number and, if you add one, a profile photo. Also your password, which is stored in hashed form; we never see it.
• What you record: groups, expenses, how they are split, payments, notes, categories, dates and any receipt images you upload, together with the history of edits and deletions.
• People you add: the name, email address or phone number you enter for someone who isn't on Splitly yet, and the name you have saved them under.
• Preferences: your default currency, language, time zone, theme and notification settings.
• Technical data: sign-in session cookies, and the basic request logs our hosting providers keep to run and secure the service.

We don't collect your location or contacts, and we don't use advertising or third-party tracking.

How we use it

• To run Splitly: calculating balances, showing your groups and history, and saving what you record.
• To let people who already know your email address or phone number find you and add you. Lookups only match a full, exact address or number, and how many you can make is limited.
• To send you email: account emails (confirmation, password reset, security notices) and activity notifications, which are grouped together so you aren't flooded. You can turn notification emails off by category in Account → Notifications. Account and security emails can't be turned off.
• To verify your phone number. We send a one-time code by SMS or WhatsApp, and that is the only message we ever send to your phone.
• To keep Splitly safe and correct: rate limits, blocking, preventing abuse, and checking that balances add up.

We don't sell your personal information, and we don't use it for advertising.

Who can see it

• People you share with. Members of a group see its expenses, payments, receipts, history and balances. In a 1:1 balance, the other person sees what you record together. They see your name and photo.
• People who know your contact details. Someone who searches your exact email address, or the exact phone number you verified, sees your name and photo. A number nobody has verified shows nothing.
• Our support team. They can look at an account only for a recorded reason, such as fixing a problem you reported, and every look is logged.
• Service providers who run parts of Splitly for us and may use your data only to do that: database, file storage and sign-in (Supabase); hosting (Vercel); email delivery (Resend); and SMS or WhatsApp delivery of verification codes.
• When the law requires it, or when we need to protect someone's safety or our users' rights.

When you change your email or phone

The new address or number must be verified. We also tell the old email address that it was changed, so you will know if someone else made the change.

How long we keep it

• We keep your account information for as long as you have an account.
• Expenses and payments are shared records. Deleting one marks it as deleted in history but doesn't erase it, so the people involved can still see what happened.
• When you delete your account, we remove your name, email, phone number, photo and the receipts you uploaded, and we delete your sign-in. The expenses and payments you were part of stay, shown as “Deleted user”, because they belong to the other people in them too.
• We keep technical and security records only as long as we need them to run and protect Splitly.

Your choices and rights

• Edit your name, photo, email and phone number in Account → Edit profile.
• Export your expenses and payments as a CSV file in Account → Export data.
• Choose which notification emails you get in Account → Notifications.
• Block anyone, so they can no longer add you to anything new.
• Delete your account in Account, once your balances are settled.

Depending on where you live, you may also have the right to access, correct or erase your data, or to object to how it is used. We will honour an erasure request even while a balance is outstanding, in the same way as an account deletion.

Security

Your data travels over encrypted connections. Receipts and photos are stored privately and are only shown through Splitly itself: a receipt to the people who can see its expense, a profile photo to people signed in to Splitly. A very large data export is emailed to you as a download link that expires after 24 hours. Access to your account is limited to the people you share with. No system is perfectly secure, so please use a strong, unique password.

Changes to this policy

If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect. The date at the top shows when it was last updated.