Privacy policy

Last updated: 13 August 2026

SplitSmart is a private, self-hosted app for splitting household expenses. It is run by Freegrove Consulting Limited for a single household. It is not a product the company sells, and there is no advertising and no analytics.

This policy explains what the app holds, who can see it, and what leaves the server. If anything here is unclear, ask: info@freegrove.co.uk.

Who is responsible

Freegrove Consulting Limited operates the server and decides how your data is handled. That makes it the data controller for the purposes of UK data protection law.

Contact: info@freegrove.co.uk

What the app holds

Your account. When you sign in with Google, the app receives your email address, your name, and your Google account identifier. It does not receive your password, your contacts, or anything else from your Google account. If you sign in with an email and password instead, the app stores your email and a hashed version of your password. The password itself is never stored.

Your session. A cookie in your browser identifies your signed-in session. It is essential to the app working and is not used for tracking.

Expenses and settlements. Everything you enter or import: dates, amounts, descriptions, currencies, categories, how each expense was split, and any notes.

Imported statements. When you import a bank statement, the rows go into your private inbox and the uploaded file is kept temporarily so the import can be re-run. Uploaded files are deleted automatically 24 hours after they stop being referenced by an undecided row.

Receipt images, if you use the Telegram receipt feature. Photos you send are stored on the server and attached to the expense they become.

History. Every edit, deletion and import is recorded in an audit log, along with what the record looked like beforehand. This is what makes undo work. It also means that deleting an expense hides it from the ledger but does not erase it: the record and its history stay in the database so the deletion can be reversed. See "Deleting your data" below for how to remove it properly.

Server logs. Ordinary web server logs, which include IP addresses and timestamps. Expense descriptions and amounts are deliberately kept out of logs above debug level so they cannot leak between users through a log file.

Why the app holds it

To run the thing you signed up for: recording who paid for what, working out who owes whom, and letting you review imported transactions before they reach the shared ledger.

Under UK data protection law the lawful basis is performance of a contract (providing the service you asked for) and, for security logging, legitimate interests in keeping the server working and unabused.

Who can see it

The other people in your household can see the shared ledger: every expense and settlement, who paid, and how it was split.

Nobody else can see your inbox. Imported rows are private to whoever imported them until that person promotes them to the shared ledger or discards them. This is enforced on every read, not just in the interface. If you import a statement and decide a transaction is nobody's business but yours, discarding it means nobody else ever sees it.

The server administrator can read the database. This is worth stating plainly rather than implying otherwise. The app runs on a server that Freegrove Consulting Limited controls, and anyone with administrative access to that server can read anything in it, including the private inbox. With one administrator who is also a member of the household, this is the same trust boundary you already have with the person you are splitting bills with.

What leaves the server

Very little, and none of it is sold or shared for advertising.

Google, when you sign in. Google learns that you signed in to this app. Governed by Google's own privacy policy.

Frankfurter (api.frankfurter.dev), for exchange rates on foreign-currency expenses. The request contains a date and two currency codes and nothing else. It does not contain the amount, the description, your name, or anything that identifies you or your household. Rates are cached, so a repeated date and currency pair does not produce a repeated request.

Anthropic or OpenAI, only if receipt scanning is switched on. A photo you send to the Telegram bot is transmitted to whichever vision provider is configured, which reads the merchant, date and total from it. Receipt photos can contain more than the total, so this is the one place where a meaningful amount of information leaves the server. Receipt scanning is optional and can be turned off, in which case photos stay on the server and you type the details yourself.

Telegram, only if you use the receipt bot. Photos you send pass through Telegram's servers in the ordinary course of sending a message to a bot.

These providers are in the United States, so using those optional features involves an international transfer of data.

There are no analytics, no advertising trackers, no error-reporting service, and no third-party scripts in the app.

How long it is kept

Expenses, settlements and their history are kept for as long as the household uses the app, because a ledger with holes in it is not a ledger.

Uploaded statement files are deleted 24 hours after nothing refers to them. Receipt photos for discarded rows are deleted after 30 days. Session records are removed when you sign out or the session expires.

Your rights

Under UK data protection law you can ask to see the data held about you, correct it, have it deleted, restrict or object to how it is used, or receive a copy in a portable format. Ask at info@freegrove.co.uk.

In practice most of these are self-service: you can see and correct your own expenses in the app, and export the ledger.

Deleting your data. Because the audit log intentionally retains prior versions, deleting an expense in the app is not erasure. If you want your data genuinely removed, ask, and it will be purged from the database and the audit log together. Bear in mind that expenses you shared with the household are also part of someone else's record of who owed whom, so removing them changes the balance the other person sees. That is a conversation to have with them rather than a button.

If you think your data has been mishandled, you can complain to the Information Commissioner's Office at ico.org.uk.

Security

The app is served over HTTPS. Sessions use cookies that JavaScript cannot read and that are only sent to this site. Passwords, where used, are hashed with argon2id. Access is invite-only: signing in with a Google account is not enough on its own, and an uninvited account reaches a polite dead end.

The database is a single file on the server, backed up regularly. Backups contain the same data as the app and are treated the same way.

No system is perfectly secure, and this one is run by one person rather than a security team. It is designed for a household ledger, not for anything you would be seriously harmed by losing.

Children

The app is not intended for children and there is nothing in it aimed at them.

Cookies

One essential cookie, holding your signed-in session. No analytics cookies, no advertising cookies, nothing shared with anyone else. Because the only cookie is strictly necessary to provide a service you asked for, there is no consent banner.

Changes

If this policy changes in a way that matters, you will be told in the app before the change takes effect. The current version is always at this address, and its full history is in the project's public repository.

Contact

info@freegrove.co.uk