Privacy policy
Launch draft · November 6, 2026 · Contact: [email protected]
What we collect
SplitSnap stores your display name, optional email and hashed password, bill details you enter or confirm, participant selections, payment notes, saved groups, and support requests. We keep session tokens as hashes on the server. Activity timestamps, rate-limit counters and minimal error identifiers help operate and protect the service.
Receipt processing
Receipt images are uploaded over HTTPS for text extraction. The default scanner runs locally on the server; images are held only while processing and are not saved in a receipt-image library. Confirmed item data is stored with the bill. If a self-hosted AI scanner is enabled, the configured model server receives the images. Administrators do not have a receipt-viewing tool by default.
Sharing and visibility
An invitation link allows its recipient to join a bill and view its participant names, items and shares. Treat links as private and share only with your group. The organizer can replace a link. Private bill pages are excluded from search indexing, but anyone in the group can copy or screenshot the information they see.
Analytics and subscriptions
Optional sharing and referral event collection is off until you enable it in your account. We do not sell personal information or show advertising. When mobile purchases are enabled, Apple or Google and RevenueCat process subscription data; SplitSnap stores entitlement status and does not receive full card details.
Optional notifications
When enabled and you opt in on a device, Expo and Apple or Google deliver generic bill-ready notifications. We store a device push token and short-lived delivery records. Notifications do not include receipt items, amounts or participant names. You can disable delivery on all devices from the mobile account screen.
Retention and deletion
Guest and free bills expire after 90 days. Session credentials expire after 30 days. Scan-operation logs and optional analytics events are retained for up to 90 days. Account deletion removes your profile, groups and bills you organized; your shares in other people’s bills are anonymized. Encrypted operational backups may retain deleted records until their rotation period ends. Backups rotate after seven days. Active Pro accounts retain their bills; after Pro expires, bills remain for at least 90 days from the last retention extension.
Your controls
You can export your data, change analytics consent, and delete your account from Account settings. Contact [email protected] for access, correction, privacy requests, or questions. Store subscriptions must be canceled separately. Camera and photo permissions are optional; manual entry remains available.
Before public launch
This draft describes the implemented beta. The operator must confirm its legal business identity, postal address, data-processing vendors, supported regions, age policy and final retention schedule before production marketing or paid launch.