Privacy policy

1. Who we are

SplitFamilia is a shared-expense ledger offered by <OWNER_OR_COMPANY_NAME> ("we", "us"). It runs as a website at https://splitfamilia.up.railway.app and as an Android app that opens that website. This policy explains what information SplitFamilia handles, why, who receives it, how long it is kept and what you can do about it. LEGAL/OWNER INPUT REQUIRED: the name to show here.

Effective date: <EFFECTIVE_DATE>.

2. The short version

• There are no accounts. You never give us an email address, a phone number or a password.
• A group holds what its members type: people's names, expenses, payments recorded between them, and a currency symbol. Anyone who has the group's invite link can see and change it.
• That information is kept on SplitFamilia's own server, so every phone in the group sees the same ledger.
• There are no ads, no analytics, no crash reporting and no cookies. We don't sell your information or share it for advertising.
• SplitFamilia only records payments made elsewhere. It never moves money and doesn't connect to banks or payment apps.

3. Information you give us

There is no account information: SplitFamilia has no sign-up, sign-in or password, and never asks for an email address or a phone number.

The people in a group type the group's information:

• people's names, up to 60 characters each, written however the group likes (a first name or a nickname is enough);
• expenses: what each was for (up to 200 characters), the amount, the date and time, who paid and whom it is split among;
• payments recorded between people, such as "Ben paid Asha ₹100", with the amount and the date;
• the group's currency symbol.

Each group also has a code, which is part of its invite link. A new group gets a code with a long random part. The code works like a password for the group.

The server also records when each entry was added and, for a removed person or a deleted or edited expense, when that happened.

Anyone with the invite link can read every entry, so write only what the group needs.

4. Information kept on your phone

To work offline, the app keeps some information in your browser's storage for the SplitFamilia site:

• a copy of each group opened on the phone, and any changes still waiting to be sent;
• the group open now, and a list of up to 20 groups opened on the phone, with when each was last opened ("Your groups");
• the app's own files, so it can start without a connection.

This stays on the phone. "Remove from this device" (in "Your groups", under Edit) deletes a group's entry and the phone's copy of it; a change still waiting to be sent is still sent the next time a group is open in the app while online. Clearing the site's data in your browser deletes all of it.

5. Technical information

Every device that loads a web page sends its IP address and a description of its browser and device (the "user agent").

• Our hosting provider, Railway, records each request in its logs: the IP address, the user agent, the address requested and the result. When an invite link is opened, the address requested can include the group's code. Railway keeps these logs for 30 days, and we use them only to fix problems.
• SplitFamilia's server uses the IP address in memory only, to limit how many requests one address can make, so no one can guess group codes or flood a group. It keeps the address while a live connection from the app is open (the app keeps one open while a group is open, for live updates), and for at most 11 minutes after the last request from that address. It never stores or logs the address.
• The page's fonts come from Google Fonts, so each time the page loads, Google receives the device's IP address, the user agent and the site's address (not the group's). Google's privacy policy (https://policies.google.com/privacy) applies to that.

We don't use IP addresses to work out where anyone is.

6. How we use information

We use information only to run SplitFamilia: to keep one shared ledger for each group, work out who owes whom, keep every phone in the group up to date, and keep the service working and safe from abuse. We don't use it for advertising, and we don't sell it.

7. Where it is stored, and how it travels

• The groups are stored in a database on SplitFamilia's server, which runs on Railway in Railway's Southeast Asia (Singapore) region. Railway keeps a daily backup of that database for 6 days. OWNER CONFIRMATION REQUIRED: the region.
• Every connection uses HTTPS, which encrypts the information on its way between your phone and the server. A request over plain HTTP is redirected to HTTPS.

LEGAL/OWNER INPUT REQUIRED: whether to say more about information travelling from your users' countries to Singapore.

8. Who else receives information

• Other members of your group: everyone with the group's invite link sees everything in the group.
• Railway (https://railway.com), our hosting provider: it runs the server and stores the database, its backups and the request logs for us.
• Google Fonts: the IP address and browser details, as in section 5.

We can read the database too, and we do so only to keep the service running, to fix a problem or to handle your request. No one else receives the information, and we don't share it for advertising. LEGAL/OWNER INPUT REQUIRED: what to say about disclosure when the law requires it.

The Android app asks for no permissions and contains no analytics or advertising code. It shows the website in your phone's browser (usually Chrome), and that browser's own privacy policy covers the browser.

9. No ads, analytics, crash reporting or cookies

SplitFamilia shows no ads and uses no analytics, crash reporting, tracking or advertising ID. It sets no cookies and sends no notifications.

10. How long we keep it

• A group, with everything in it, is kept until we delete it at someone's request (section 12). Nothing is deleted automatically.
• Removing a person, or deleting or editing an expense, takes it off the group for everyone straight away. The server keeps the old entry, marked as deleted, until the whole group is deleted, so that a phone which was offline can't bring a deleted entry back.
• Railway's backups are kept for 6 days, and its request logs for 30 days. The server keeps an IP address in memory only while a live connection from the app is open, and for at most 11 minutes after the last request from it.
• On your phone, the information stays until you remove the group from the device or clear the site's data.

11. Accounts and account deletion

SplitFamilia has no accounts, so there is no account to create or delete. Section 12 explains how to delete information.

12. Deleting your information

In the app:

• An expense or a payment: tap it, tap Delete, then confirm. It disappears for everyone in the group (the server keeps it marked as deleted, as in section 10).
• A person: in People, tap Remove next to their name. Someone who is part of an expense can be removed only after their expenses are deleted.
• A group on your phone: in "Your groups", tap Edit, then "Remove from this device". The group stays for everyone else.

On request: email <CONTACT_EMAIL> with the group's invite link and what you would like deleted. We will delete the whole group from the server, including the entries marked as deleted, within <RESPONSE_TIME>, and reply when it is done. The backups that still hold it are gone within 6 days, and the request logs within 30 days. Copies on other people's phones stay until they remove the group from their device. OWNER CONFIRMATION REQUIRED: the response time, who may ask for a whole group to be deleted, and whether you will also delete a single entry on request.

13. Security

• Every connection uses HTTPS.
• The invite link is the key to a group: anyone who has it can see and change the group. Share it like a password, only with the people in the group.
• The server has no list of groups that anyone can browse, and it blocks an address that tries many wrong codes.
• Anyone who uses your phone can open the groups on it, so keep your phone locked.

14. Children

SplitFamilia is meant for adults (18 and over) sharing costs, and it is not directed at children. We don't knowingly collect information from children. If you think a child has entered information, contact us and we will delete it. LEGAL/OWNER INPUT REQUIRED: the age of consent that applies in <JURISDICTION>.

15. Your rights

LEGAL/OWNER INPUT REQUIRED: the laws that apply in <JURISDICTION>, and any rights or legal-basis statement they require. This draft names no law and claims compliance with none.

16. Changes to this policy

If this policy changes, the new version will be posted on this page with a new effective date. OWNER CONFIRMATION REQUIRED: whether to announce changes in the app as well.

17. Contact

Questions and requests: <CONTACT_EMAIL>. <OWNER_OR_COMPANY_NAME>, <JURISDICTION>.