Privacy Policy

Effective Date: April 1, 2026  ·  Last Updated: April 5, 2026

Your privacy is important to us. This Privacy Policy explains how Andrii Korshenko ("we," "us," or "our") collects, uses, discloses, and protects your personal information when you use the Splitmaster mobile application ("the App") and its associated services.

By using the App, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the App.

1. Who Can Use Splitmaster

Splitmaster is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

Users between 16 and 18 years of age (or the age of majority in their jurisdiction) may only use the App with the consent of a parent or legal guardian who agrees to be bound by these terms on the minor's behalf.

2. Information We Collect

Information we collect falls into two categories: information you provide to us and information collected automatically.

2.1 Information You Provide

When you create an account or use the App, you may provide:

  • Name
  • Email address
  • Profile photo (avatar)

When you sign in using Google or Apple, we receive your name, email address, and profile photo as provided by the authentication provider. We do not receive or store your Google or Apple account password.

When you use the App's features, you may provide:

  • Receipt images (photos of purchase receipts)
  • Expense descriptions, amounts, and currency
  • Group names and membership
  • Settlement notes
  • Contact information (when you choose to invite friends via the App)

2.2 Information Collected Automatically

When you use the App, we automatically collect:

  • Device information (device type, operating system, app version)
  • Anonymous device identifiers
  • IP address
  • Error and crash data (via our crash reporting service)
  • Push notification tokens (via our push notification service)

2.3 Device Permissions

The App may request access to the following device features:

  • Camera: To scan and photograph receipts
  • Storage, photos, and media: To select receipt images from your gallery
  • Notifications: To deliver push notifications about expense activity, settlements, and account updates

You can manage all permissions at any time through your device settings. Denying permissions may limit certain App features but will not prevent you from using the core expense-tracking functionality.

3. How We Use Your Information

We use the information we collect for the following purposes:

  • Providing core services: Creating and managing your account, processing receipt scans, tracking expenses, calculating balances, and facilitating settlements between users
  • Communication: Sending push notifications about expense activity, settlements, and account-related updates; sending one-time passwords (OTP) for authentication via email
  • Security and fraud prevention: Verifying your identity via app attestation and CAPTCHA verification, enforcing rate limits, detecting and preventing abuse
  • Service improvement: Analyzing crash reports and error data to improve App stability and performance
  • Compliance: Fulfilling legal obligations, responding to lawful requests, and enforcing our Terms of Service
  • Account administration: Managing your account lifecycle including registration, profile updates, and account deletion

We do not use your personal information for advertising, marketing, or profiling purposes.

4. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

4.1 With Other Users

When you participate in shared expenses or groups, other participants can see your name, profile photo, and expense-related information (amounts owed, items claimed, settlements). Shared expense records function as a mutual ledger — all participants in a shared expense can view the expense details. You control who you share expenses with by choosing participants. Other users may enter expenses that affect your displayed balance without requiring your prior approval.

4.2 With Third-Party Service Providers

We use third-party service providers to help us operate, maintain, and improve the App. These providers may process your personal information on our behalf for the following purposes:

  • Authentication and account management
  • Cloud hosting, database management, and data storage
  • Receipt image processing and text extraction (OCR)
  • Push notification delivery
  • Error and crash reporting
  • Security and fraud prevention (including CAPTCHA verification)
  • Transactional email delivery
  • Currency exchange rate data

These providers are contractually obligated to protect your information and may only use it to perform services on our behalf. Receipt images sent for processing are used solely for text extraction and validation — they are not used to train third-party AI models.

4.3 For Legal Reasons

We may disclose your information if required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.

4.4 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

5. Data Storage and International Transfers

Your personal information is stored and processed in:

  • Netherlands (EU) — Cloud hosting provider (application hosting, receipt processing), database provider
  • United States — Authentication provider, push notification and crash reporting services, security and CDN services, email delivery services

If you are located in the European Economic Area (EEA), United Kingdom, Switzerland, or another jurisdiction with data transfer restrictions, please note that your data may be transferred to and processed in countries that may not provide the same level of data protection. We rely on appropriate safeguards for international data transfers, including Standard Contractual Clauses and other mechanisms as applicable to each service provider. For transfers to the United States, we rely on Standard Contractual Clauses supplemented by appropriate technical and organizational measures — such as encryption in transit and at rest, access controls, and contractual restrictions on onward disclosure — in line with the guidance issued following the Schrems II ruling (CJEU, July 2020). For users in Switzerland, the same safeguards apply in accordance with the revised Swiss Federal Act on Data Protection (revFADP).

6. Data Retention

We retain your personal information only for as long as necessary to provide our services and fulfill the purposes described in this policy.

  • Account data (name, email, avatar): Retained for the duration your account exists
  • Receipt images: Retained while the associated receipt exists in your account
  • Temporary processing cache: Automatically deleted within 30 days
  • Internal event records: Automatically deleted within 90 days
  • Crash and error logs: Retained for up to 90 days, after which they are automatically purged

When you delete your account, we will delete all your personal data generally within 30 days under normal operating conditions (see Section 8 for details). In exceptional circumstances such as service outages, deletion may be slightly delayed but will be completed as soon as reasonably practicable.

We may retain certain information longer if required for legal compliance, fraud prevention, or dispute resolution.

7. Security

We implement commercially reasonable security measures to protect your personal information, including:

  • Encryption of data in transit (HTTPS/TLS)
  • Secure authentication tokens
  • App attestation to verify legitimate app instances
  • Rate limiting to prevent abuse
  • Secure database operations
  • Encrypted credential storage

No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account.

In the event of a personal data breach, we will comply with applicable breach notification requirements, including notifying the relevant supervisory authority and affected individuals as required by law.

8. Account Deletion

You may request deletion of your account at any time through the App (Settings > Delete Account). Upon requesting deletion:

  • Your account is immediately locked and you cannot access any services
  • You have a 30-day grace period during which you may cancel the deletion request
  • After 30 days, we permanently and irreversibly delete: your user account and profile data, all receipt images, your avatar, all associated account data and records
  • Deletion cannot be undone after the grace period

After deletion, anonymized records of shared expenses (amounts, dates, descriptions) may remain visible to other participants as part of their own expense history. Your name, email, and profile photo will be removed from those records.

You may also request account deletion by contacting us at support@splitmaster.co.

9. Communication Preferences

You can manage your notification preferences within the App. Push notifications can be enabled or disabled in the App's settings. You may also disable push notifications through your device's system settings.

Certain communications are required for the operation of your account and cannot be opted out of, including one-time passwords for authentication and critical account-related notices (e.g., account deletion confirmation).

10. Automated Processing

The App uses automated processing for receipt scanning (text extraction via OCR, performed by a third-party AI service) and balance calculations. These automated processes do not make decisions that produce legal effects or similarly significantly affect you within the meaning of Article 22 of the GDPR. All outputs of automated processing — including extracted receipt items, calculated shares, and suggested balances — are presented to you for review before any action is taken, and you may edit, correct, or delete any of them at any time. If you believe an automated result has materially affected you and wish to request human review, contact support@splitmaster.co.

11. Your Rights

11.1 All Users

Regardless of your location, you have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate or incomplete information
  • Request deletion of your account and personal data
  • Withdraw consent for optional data processing
  • Lodge a complaint with us or a relevant regulatory authority

11.2 European Economic Area (EEA) Residents — GDPR

If you are located in the EEA, you have additional rights under the General Data Protection Regulation (GDPR):

Data Controller: Andrii Korshenko is the Data Controller for your personal information. Contact: support@splitmaster.co.

Legal Bases for Processing:

  • Performance of a contract: Processing necessary to provide you with the App's services (account management, expense tracking, receipt scanning, settlements)
  • Legitimate interests: Security and fraud prevention, service improvement through crash analytics, enforcing our Terms of Service
  • Consent: Where you have given specific consent (e.g., enabling push notifications, granting device permissions)
  • Legal obligation: Where processing is required to comply with applicable law

Additional Rights:

  • Right to restrict processing of your personal information
  • Right to data portability (receive your data in a machine-readable format, where technically feasible and as required by applicable law)
  • Right to object to processing based on legitimate interests
  • Right to withdraw consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights — including the right to object to processing based on legitimate interests under Article 21 — contact us at support@splitmaster.co, stating the nature of your request and the category of processing concerned. We will respond within 30 days. This period may be extended by up to 60 additional days for complex or numerous requests, in which case we will inform you of the extension within the initial 30-day period.

If you terminate or delete your account, we will delete your personal information generally within 30 days. You also have the right to lodge a complaint with your local data protection authority. As the Data Controller is based in Belgium, the lead supervisory authority is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit): www.dataprotectionauthority.be.

11.3 United Kingdom Residents — UK GDPR

If you are located in the United Kingdom, you have rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller: Andrii Korshenko is the Data Controller for your personal information.

Your rights mirror those described in Section 11.2 above, including the right to restrict processing, data portability, objection, erasure, rectification, and access.

International Transfers: Where we transfer your data outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR (Article 45) and the Data Protection Act 2018, including Standard Contractual Clauses.

Data Breach Notification: In the event of a personal data breach, we will comply with applicable notification requirements, including reporting to the Information Commissioner's Office (ICO) and notifying affected individuals as required by law.

Complaints: You have the right to lodge a complaint with the ICO:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113
Website: www.ico.org.uk

We would appreciate the opportunity to address your concerns before you contact the ICO. Please reach out to us first at support@splitmaster.co.

11.4 United States Residents — State Privacy Laws

If you are a resident of California, Colorado, Delaware, Florida, Virginia, or Utah, you have additional rights under applicable state privacy laws.

California Notice of Collection (CCPA/CPRA):

In the past 12 months, we have collected the following categories of personal information:

  • Identifiers: name, email address, IP address, account identifiers
  • Internet or electronic network activity: device information, IP address, crash and error data, app interaction data
  • Visual data: receipt images (photos)

We collect and use these categories for the business purposes described in Section 3. We disclose these categories to the service providers described in Section 4.2. We do not sell or share your personal information for cross-context behavioral advertising.

Your Rights:

  • Right to know what personal information we collect, use, and disclose
  • Right to delete your personal information
  • Right to correct inaccurate personal information
  • Right to opt out of the sale or sharing of personal information (we do not sell or share your data)
  • Right to non-discrimination for exercising your privacy rights

Do Not Track: The App does not respond to "Do Not Track" or similar signals.

To exercise your rights, contact us at support@splitmaster.co.

12. Third-Party Links

The App may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing them with your information.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. For material changes, we will provide at least 30 days' advance notice via email, in-app notification, or by posting the updated policy in the App and updating the "Last Updated" date. Changes required by law or necessary to address an urgent security concern may take effect with shorter notice.

Your continued use of the App after changes take effect constitutes your acceptance of the revised policy.

14. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of Belgium. For details on jurisdiction and dispute resolution, see our Terms of Service.

15. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

Andrii Korshenko

Leuven, Belgium

Email: support@splitmaster.co