Privacy policy

Last updated: 25 August 2026

SplitSmart is a private, self-hosted app for splitting household expenses. It is run by Christopher Doyle, a private individual, for one household. It is not a product, nobody is charged for it, and there is no advertising and no analytics.

This policy explains what the app holds, who can see it, and what leaves the server. If anything here is unclear, ask: info@freegrove.co.uk.

Who is responsible

Christopher Doyle runs the server and decides how the data is handled.

Contact: info@freegrove.co.uk

What the app holds

Your account. When you sign in with Google, the app receives your email address, your name, and your Google account identifier. It does not receive your password, your contacts, or anything else from your Google account. If you sign in with an email and password instead, the app stores your email and a hashed version of your password. The password itself is never stored.

Your session. A cookie in your browser identifies your signed-in session. It is essential to the app working and is not used for tracking.

Expenses and settlements. Everything you enter or import: dates, amounts, descriptions, currencies, categories, how each expense was split, and any notes.

Imported statements. When you import a bank statement, the rows go into your private inbox and the uploaded file is kept temporarily so the import can be re-run. Uploaded files are deleted automatically 24 hours after they stop being referenced by an undecided row.

Receipt images, if you photograph a receipt in the app or send one to the Telegram bot. The photo is stored on the server and stays with the expense it becomes, or with the inbox row you keep.

Notification subscriptions, if you turn on notifications. Your browser issues an address that lets the server send a message to that specific browser on that specific device, and the app stores it. It is not an identifier anyone else can use to reach you, and it is deleted if it stops working or after 90 days without use.

History. Every edit, deletion and import is recorded in an audit log, along with what the record looked like beforehand. This is what makes undo work. It also means that deleting an expense hides it from the ledger but does not erase it: the record and its history stay in the database so the deletion can be reversed. See "Deleting your data" below for how to remove it properly.

Server logs. Ordinary web server logs, which include IP addresses and timestamps. Expense descriptions and amounts are deliberately kept out of logs above debug level, so they cannot leak through a log file.

Why the app holds it

To do the thing you signed in for: recording who paid for what, working out who owes whom, and letting you review imported transactions privately before any of them reach the shared ledger.

Who can see it

The other people in your household can see the shared ledger: every expense and settlement, who paid, and how it was split. That is the point of it.

Your inbox is yours. Imported rows, and receipts you choose to keep rather than share, are private to you until you promote them to the shared ledger or discard them. The app never shows them to another member, never includes them in anything it sends to another member, and scopes every read to the person asking rather than filtering them out at the last moment. If you import a statement and decide a transaction is nobody's business but yours, discarding it means it never appears to anyone else.

Notifications say who, not how much. A notification tells you that something happened and who did it, never the amount or the description. This is deliberate: notifications are handled by Apple or Google on the way to your device and are drawn on a lock screen, where anyone holding your phone can read them.

What leaves the server

Very little, and none of it is sold or shared for advertising.

Google, when you sign in. Google learns that you signed in to this app. Governed by Google's own privacy policy.

Frankfurter (api.frankfurter.dev), for exchange rates on foreign-currency expenses. The request contains a date and two currency codes and nothing else: not the amount, not the description, not your name, nothing that identifies you or your household. Rates are cached, so the same date and currency pair does not produce a second request.

Anthropic, only if receipt scanning is switched on. A photo you send is transmitted to Anthropic's API, which reads the merchant, date and total from it. A receipt can show more than its total, so this is the one place where a meaningful amount of information leaves the server. Receipt scanning is optional and can be turned off, in which case photos stay on the server and you type the details in yourself.

Telegram, only if you use the receipt bot. Photos and messages you send to the bot pass through Telegram's servers in the ordinary course of sending a message, and your conversation with the bot is stored by Telegram like any other chat.

Apple or Google, only if you turn on notifications, and only to carry the notification to your device. See "Notifications say who, not how much" above for what those messages contain.

Backblaze, which holds the nightly backup. The backup is encrypted on this server before it is uploaded, so Backblaze holds ciphertext and cannot read it.

These providers are outside the UK, so using them involves an international transfer of data.

There are no analytics, no advertising trackers, no error-reporting service, and no third-party scripts in the app.

How long it is kept

Expenses, settlements and their history are kept for as long as the household uses the app, because a ledger with holes in it is not a ledger.

Uploaded statement files are deleted 24 hours after nothing refers to them. Receipt photos for rows you discard are deleted after 30 days; a receipt on a row you have kept stays until you decide what to do with it. Notification subscriptions are deleted after 90 days without use. Session records are removed when you sign out or the session expires.

Backups are kept for 14 days, then weekly for 8 weeks and monthly for a year, after which they are deleted. A backup taken before you deleted something will still contain it until it ages out.

Your rights

You can ask to see the data held about you, correct it, have it deleted, or receive a copy in a portable format. Ask at info@freegrove.co.uk.

In practice most of that is self-service: you can see and correct your own expenses in the app, and export the ledger whenever you like.

Deleting your data. Because the audit log deliberately retains prior versions, deleting an expense in the app is not erasure. If you want your data genuinely removed, ask, and it will be purged from the database and the audit log together. Bear in mind that expenses you shared with the household are also part of someone else's record of who owed whom, so removing them changes the balance the other person sees. That is a conversation to have with them rather than a button.

If you think your data has been mishandled, you can complain to the Information Commissioner's Office at ico.org.uk.

Security

The app is served over HTTPS. Sessions use cookies that JavaScript cannot read and that are only sent to this site. Passwords, where used, are hashed with argon2id. Access is invite-only: signing in with a Google account is not enough on its own, and an uninvited account reaches a polite dead end.

The database is a single file on a server run by one person, and the nightly backup of it is encrypted before it leaves that server.

No system is perfectly secure, and this one is maintained by one person rather than a security team. It is built for a household ledger, not for anything you would be seriously harmed by losing.

Children

The app is not intended for children and there is nothing in it aimed at them.

Cookies

One essential cookie, holding your signed-in session. No analytics cookies, no advertising cookies, nothing shared with anyone else. Because the only cookie is strictly necessary to provide a service you asked for, there is no consent banner.

Changes

If this policy changes in a way that matters, you will be told in the app before the change takes effect. The current version is always at this address, and its full history is in the project's public repository.

Contact

info@freegrove.co.uk