Privacy policy
What we collect, why, and who else sees it. We never sell your data.
Last updated 15 September 2026
Who is responsible
Splitsetter is made and operated by Ornion OÜ (registry code 14129140), a company registered in Estonia. In the words of the GDPR, we are the data controller: we decide how the data described here is handled.
For any question about your data, write to support@splitsetter.com.
How the app knows you
The first time you open Splitsetter, the app makes up a random identifier and a secret and stores them on your device. That pair is your identity. It is not your phone's serial number or advertising ID; it links to nothing outside Splitsetter, and you can use the app indefinitely without telling us anything more.
If you link an email address, we store it and use it for exactly the things described under Emails below. We sign you in with a link we send you; there is no password. If you sign in with Apple or Google instead, we receive the identifier that provider assigns you for Splitsetter and, if you share it, your email address. We store both and use them only to recognise you next time.
Your profile is a name, an optional photo, and any payment details you choose to add so friends can pay you back: a Venmo or PayPal handle, an IBAN, a Wise handle, or something similar. Everything on the profile is optional except the name, and all of it is visible only to people who share a group with you. For each device signed in to your account we keep a sign-in token; deleting the account revokes every one of them.
Splitsetter is meant for adults. We do not knowingly collect data from children under 13; if you believe we have, write to us and we will delete it.
What you record
A group has a name, a currency, an optional description and photo, and its members. An expense has a description, an amount, a date, a category, who paid, who owes what, and, if you itemised the bill, the rows you typed. Settlements record who paid whom. If a group mixes currencies, we also keep the exchange rate that was applied.
That is the whole picture. We do not read your bank account, your contacts, your location, or your photo library. The app has no access to any of them.
People you add to a group
When you add a friend to a group, you type a name and, if you choose to invite them, an email address. We store both so the group's books balance and so we can send the invitation. That person's name and share of each expense are visible to everyone in the group.
If you are that person and never joined, you can still ask us to remove the data about you: write to support@splitsetter.com. Someone who does accept an invitation takes over the placeholder and becomes a member in their own right.
Photos
You can add a photo to a group and to your profile. Before a photo is stored, we strip the metadata cameras embed in it: the location, the device, the time. Only the pixels are kept. Photos are served only to signed-in members of the group they belong to; nobody else can load them, and there is no public address for them.
Where your data lives
Splitsetter is local-first. The full copy of your groups and expenses sits on your device: in the app's own database on a phone, in the browser's storage on the web. The app works offline, and everything you do is recorded first on the device.
Each change is then sent to our server as a small event so it can reach your other devices and the other members of the group. The server keeps those events, because that is how a device that has been offline for a week catches up. It shows them to the group's members and to nobody else; a person who is not in the group cannot see the group, its expenses, or who is in it.
Our server is in Finland, in the European Union. Nothing about your groups or expenses is sent anywhere else.
Emails
We send email for four reasons only: the sign-in link you asked for, an invitation you asked us to send, a note to say your email address is now linked to your account, and a note to say someone you invited has joined. No newsletters, no marketing, no "we miss you".
We keep a copy of each email we send, with its recipient, so we can see whether it was delivered when you tell us it was not. Deleting your account deletes them.
Who else receives data
Hetzner (Finland) hosts our servers, so your data is on their disks, in the EU, under a data-processing agreement with us.
Our email delivery provider carries the messages listed above, which means it sees the recipient address and the content of each one.
Sentry (EU region) receives a report when the app or the server breaks: what failed and the state of the program at that moment. Reports never carry your name, your email address, or the contents of an expense, and they are deleted within ninety days.
Apple and Google are involved only if you choose to sign in with them, and only to tell us who you are. What they record about that sign-in is governed by their own privacy policies.
There are no ads, no analytics services, and no tracking scripts, in the app or on this website. The website loads its fonts from Fontshare and Google Fonts, so those two see your IP address when you open a page here, exactly as they would for any site using them. The app itself bundles its fonts and contacts nobody but our server.
What we ourselves can see
We can look at the database directly, and do so to answer a support request, investigate abuse, or repair a sync problem. There is no feature that lets us act inside the app as you.
Our servers keep ordinary technical logs: IP address, page requested, time, and browser type. We use them to find and stop abuse and to debug failures, and delete them within thirty days.
Our legal basis
The GDPR requires us to name a legal basis for each use of your data. Here they are. We hold your identity, your profile, your groups and expenses, and the record of emails we sent you to perform our contract with you: to run the service you signed up for. We handle error reports and technical logs on legitimate interest: keeping the service working and secure. The name and email address of a friend you add are handled on your legitimate interest in sharing a bill with them and ours in delivering the invitation you asked for.
How long we keep things
Everything stays until you delete it. There is no automatic expiry, because an old trip's ledger is exactly the kind of thing people come back to.
When you delete an expense or a group, it is marked deleted rather than erased on the spot, so your other devices and your group's devices learn about the deletion the next time they sync. The marked record then stays in the sync history.
Backups of the database are taken nightly, encrypted, and kept for about five weeks. Anything deleted disappears from them on that schedule.
Deleting your account
You can delete your account yourself, from your profile in the app, at any time. No email, no waiting.
Deleting it removes your email address, your photo, your payment details, and your device's credentials from our server, and signs out every device. Your name on past expenses becomes "Former member" for everyone who shared a group with you, in the current data and in the sync history alike, so the group's books still balance but no longer point at you. Your own devices are told to forget you too.
We do not delete the groups you were in or the expenses you were part of, because they belong to the other members as much as to you. If you want a group gone, delete it before you delete the account.
Your rights
You can ask for a copy of the data we hold about you, have it corrected, have it deleted, restrict or object to how it is used, or receive it in a machine-readable form to take elsewhere. Most of it you can see and change in the app itself; for the rest, write to support@splitsetter.com and we respond within a month.
If you believe we have handled your data badly and we have not fixed it, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the supervisory authority of the country you live in.
Ornion OÜ · support@splitsetter.com