Privacy policy
What we collect, why, and who else sees it. We never sell your data.
Last updated 28 October 2026
Who is responsible
Splitsetter is made and operated by Ornion OÜ (registry code 14129140), a company registered in Estonia. In the words of the GDPR, we are the data controller: we decide how the data described here is handled.
For any question about your data, write to support@splitsetter.com.
How the app knows you
The first time you open Splitsetter, the app makes up a random identifier and a secret and stores them on your device. That pair is your identity. It is not your phone's serial number or advertising ID; it links to nothing outside Splitsetter, and you can use the app indefinitely without telling us anything more.
If you link an email address, we store it and use it for exactly the things described under Emails below. We sign you in with a link we send you; there is no password. If you sign in with Apple or Google instead, we receive the identifier that provider assigns you for Splitsetter and, if you share it, your email address. We store both and use them only to recognise you next time.
Your profile is a name, an optional photo, and any payment details you choose to add so friends can pay you back: a Venmo or PayPal handle, an IBAN, a Wise handle, or something similar. Everything on the profile is optional except the name, and all of it is visible only to people who share a group with you. For each device signed in to your account we keep a sign-in token; deleting the account revokes every one of them.
Splitsetter is meant for adults. We do not knowingly collect data from children under 13; if you believe we have, write to us and we will delete it.
What you record
A group has a name, a currency, an optional description and photo, and its members. An expense has a description, an amount, a date, a category, who paid, who owes what, and, if you itemised the bill, its rows. A row read from a receipt you scanned also keeps the receipt's own wording when it was translated, and the expense keeps the receipt's photos. Settlements record who paid whom. If a group mixes currencies, we also keep the exchange rate that was applied.
That is the whole picture. We do not read your bank account, your contacts, your location, or your photo library. The app has no access to any of them, and sees a photo only when you take or choose one yourself.
People you add to a group
When you add a friend to a group, you type a name and, if you choose to invite them, an email address. We store both so the group's books balance and so we can send the invitation. That person's name and share of each expense are visible to everyone in the group.
If you are that person and never joined, you can still ask us to remove the data about you: write to support@splitsetter.com. Someone who does accept an invitation takes over the placeholder and becomes a member in their own right.
Photos
You can add a photo to a group and to your profile, and an expense you save from a scanned receipt keeps the receipt's photos. Before a photo is stored, we strip the metadata cameras embed in it: the location, the device, the time. Only the pixels are kept. Photos are served only to signed-in members of the group they belong to; nobody else can load them, and there is no public address for them.
A receipt's photos are erased when someone removes them from the expense, when the expense or its group is deleted, or when the account that added them is deleted. Receipt photos that never end up attached to an expense are erased after seven days.
Receipt scanning
Scanning a receipt is optional, and the app asks before your first scan. When you scan one, the app sends the receipt's photos to our server, with the languages you read and the group's currency. Our server passes them to Anthropic, an AI company that reads the receipt for us and sends back its items, amounts, date and currency. Anthropic does not use the photos or what it read to train its models. It deletes them within 30 days, unless its automated safety systems flag the request as breaking its usage policy, in which case it may keep them for up to two years.
A receipt can show more than prices: the shop, the last digits of a card, a loyalty number, sometimes a name. Whatever is on the photo goes to Anthropic, so crop or cover what you would rather not send.
Our server does not keep the photos it passes on. It keeps what Anthropic read for 24 hours, so that trying again does not cost a second scan, and then deletes it. The photos stay only with an expense you save from the scan, as described under Photos. For each scan we also keep a record that holds no photo and nothing read from it: when it ran, in which group, which model read it and what that cost us, whether it worked, what paid for it, and how many rows you changed and how long assigning them took before you saved. We use these records to count your scans, to keep our spending within budget, and to see how well each model reads.
You can read the notice again, or withdraw your agreement, from your profile under Receipt scanning, Scan privacy. After a withdrawal the app asks again before your next scan, on every device.
Scan packs
Every account gets a few free scans; more come in packs bought in the app. Apple's App Store and Google Play sell the packs and take the payment, so we never see your card or your billing details. We receive the store's record of the purchase: which pack, the order or transaction number, and when. We verify it before adding the scans, and keep it so that each purchase is credited once and taken back if the store refunds it. Apple and Google tell us about refunds directly.
Your free scans, the scans you bought and any scans we gave you belong to your Splitsetter account. When you sign in on a device to an account you already have, the scans bought or given on that device move to the account.
Where your data lives
Splitsetter is local-first. The full copy of your groups and expenses sits on your device: in the app's own database on a phone, in the browser's storage on the web. The app works offline, and everything you do is recorded first on the device.
Each change is then sent to our server as a small event so it can reach your other devices and the other members of the group. The server keeps those events, because that is how a device that has been offline for a week catches up. It shows them to the group's members and to nobody else; a person who is not in the group cannot see the group, its expenses, or who is in it.
Our server is in Finland, in the European Union. Nothing about your groups or expenses is sent anywhere else, apart from the photos of a receipt you scan, which Anthropic reads for us (see Receipt scanning), and the text of a push notification you turned on, which Google delivers (see Notifications).
Emails
We send email for these reasons only: the sign-in link you asked for, an invitation you asked us to send, a note to say your email address is now linked to your account, a note to say someone you invited has joined, and the notifications described under Notifications. No newsletters, no marketing, no "we miss you".
We keep a copy of each email we send, with its recipient, so we can see whether it was delivered when you tell us it was not. Deleting your account deletes them.
Notifications
Splitsetter can tell you when something happens in your groups: you were added to or removed from a group, a group was deleted, someone settled up with you, and, if you ask for them, expenses that involve you and people joining your groups. In the app, under Notifications, you choose for each of these whether it reaches you by push, by email, both or neither, and you can mute a single group. Notification emails go only to the email address linked to your account, and each one has a link that stops it.
The app asks your phone for permission before it turns push on. Only then does it fetch a push token: an address Google issues for this copy of the app on this phone. We store the token with the platform (Android or iOS), the app's version number and when we last saw it, so that we know where to send your notifications. Each push carries a title and a line of text, which name the group, the person who made the change and, for an expense or a settlement, the amount, and a link to what it is about. We delete the token when you sign out or delete your account, and when Google tells us it no longer reaches your phone, for example after you uninstall the app. You can turn push off at any time in your phone's settings.
To send notifications at a sensible hour, we keep the time zone and the language your phone reports. Changes made close together wait about two minutes and then arrive as one message; if you chose a daily email for expenses, it waits until 8 in the morning.
Who else receives data
Hetzner (Finland) hosts our servers, so your data is on their disks, in the EU, under a data-processing agreement with us.
Virtuaal.com (Estonia) runs the mail server that sends the messages listed above, so it sees the recipient address and the content of each one.
Sentry (EU region) receives a report when the app or the server breaks: what failed and the state of the program at that moment. Reports never carry your name, your email address, or the contents of an expense, and they are deleted within ninety days.
Anthropic (Anthropic Ireland, Limited) reads the receipts you scan. It processes them outside the EU, including in the United States, under a data-processing agreement with us that includes the EU's Standard Contractual Clauses. It does not train its models on them and deletes them within 30 days, as described under Receipt scanning.
Google (Firebase Cloud Messaging) delivers the push notifications you turn on, to Android phones directly and to iPhones through Apple's push service. Both see your phone's push token and the text of each push. Google may process them outside the EU, including in the United States, under its data-processing terms, which include the EU's Standard Contractual Clauses.
Apple and Google are otherwise involved only if you choose to sign in with them, to tell us who you are, or if you buy scans in their stores, which take the payment. What they record about a sign-in or a purchase is governed by their own privacy policies.
There are no ads, no analytics services, and no tracking scripts, in the app or on this website. The website loads its fonts from Fontshare and Google Fonts, so those two see your IP address when you open a page here, exactly as they would for any site using them. The app itself bundles its fonts and contacts nobody but our server, the App Store or Google Play when you buy scans, and Firebase once you turn push notifications on.
What we ourselves can see
We can look at the database directly, and do so to answer a support request, investigate abuse, or repair a sync problem. There is no feature that lets us act inside the app as you.
Our servers keep ordinary technical logs: IP address, page requested, time, and browser type. We use them to find and stop abuse and to debug failures, and delete them within thirty days.
Our legal basis
The GDPR requires us to name a legal basis for each use of your data. Here they are. We hold your identity, your profile, your groups and expenses, and the record of emails we sent you to perform our contract with you: to run the service you signed up for. Reading a receipt you scan, keeping your scan balance and keeping the record of the packs you bought perform that contract too: you asked for the scan or bought the pack. We keep the scan records that hold no receipt content on legitimate interest: counting scans fairly, keeping our costs within budget, and improving how receipts are read. Sending the notifications you leave on, and keeping the push token, time zone and language they need, performs that contract as well: they are part of the service, and each one can be turned off. We handle error reports and technical logs on legitimate interest: keeping the service working and secure. The name and email address of a friend you add are handled on your legitimate interest in sharing a bill with them and ours in delivering the invitation you asked for.
How long we keep things
Everything stays until you delete it. There is no automatic expiry, because an old trip's ledger is exactly the kind of thing people come back to.
When you delete an expense or a group, it is marked deleted rather than erased on the spot, so your other devices and your group's devices learn about the deletion the next time they sync. The marked record then stays in the sync history.
Scanning runs on shorter clocks. What Anthropic read from a receipt is kept on our server for 24 hours, and Anthropic deletes the photos and what it read within 30 days.
Backups of the database and of the uploaded photos are taken nightly, encrypted, and kept for about five weeks. Anything deleted disappears from them on that schedule.
Deleting your account
You can delete your account yourself, from your profile in the app, at any time. No email, no waiting.
Deleting it removes your email address, your photo, your payment details, your device's credentials, the receipt photos you added to expenses, your scan balance, your agreement to scanning, your notification settings and your push tokens from our server, and signs out every device. Your name on past expenses becomes "Former member" for everyone who shared a group with you, in the current data and in the sync history alike, so the group's books still balance but no longer point at you. Your own devices are told to forget you too.
We do not delete the groups you were in or the expenses you were part of, because they belong to the other members as much as to you. If you want a group gone, delete it before you delete the account.
The records of your scans and of the packs you bought stay, with nothing left in them that points at you: a group's credits, a refund the store reports later and our monthly budgets all depend on them.
Your rights
You can ask for a copy of the data we hold about you, have it corrected, have it deleted, restrict or object to how it is used, or receive it in a machine-readable form to take elsewhere. Most of it you can see and change in the app itself; for the rest, write to support@splitsetter.com and we respond within a month.
If you believe we have handled your data badly and we have not fixed it, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the supervisory authority of the country you live in.
Ornion OÜ · support@splitsetter.com