Legal
Privacy Policy
Effective
This policy covers the Splitmate Android app and this website. It is written in plain English because the honest version is short. “We” means Quizuncle, the indie studio behind Splitmate; “you” means whoever is using the app.
In short
- Expenses you log as Just me never leave your phone. There is no cloud copy of them and no backup of them, which cuts both ways: nobody else can see them, and losing the phone loses them for good.
- A group is the opposite. Its member names, profile pictures, expenses, settlements and chat messages are all uploaded to a Google database in Singapore, and they are stored in a form we can read. Chat messages are not end-to-end encrypted — see what is uploaded.
- A chat notification carries the message text in it, so the first line of what you send appears on the other person’s lock screen.
- There is no analytics, no crash reporting, no advertising and no billing code in the app. Nothing measures how you use it, so there is nothing about your usage to collect, keep or hand on.
- This website collects one thing, and only if you ask it to: the email address you type into the notify form on the home page, so we can tell you when Splitmate is public. Nothing else about your visit is recorded — see the notify list.
This website
splitmate.quizuncle.com is a set of static files served by Firebase Hosting, which is Google. There are no analytics, no tracking pixels, no embedded videos, no web fonts loaded from anyone else and no third-party scripts of any kind: no page here fetches anything from another company, before or after you interact with it, and there is no script on this site capable of sending anything anywhere.
One thing does leave, and only if you ask it to. The home page carries a form for being told when Splitmate has a public release. The email address you type into it is sent to this same domain — not to a mailing-list company, not to a form service — and only when you press the button. Typing in the box sends nothing; leaving the page sends nothing. What we then do with the address is the next section, and it is the only personal data this website collects.
There is one cookie, and it is a preference rather than a tracker: qu_theme, whose entire value is the word dark or light. It records whether you asked for the light or the dark version of this page. It is scoped to .quizuncle.com so the same choice applies on quizuncle.com and the other Quizuncle sites — that sharing is the only reason it is a cookie rather than localStorage, which is kept separate per subdomain. It holds no identifier, it is not used to recognise you, and no server does anything with it. Clear your cookies and it is gone, after which the site follows your operating system’s light or dark setting.
Google, as the hosting provider, processes ordinary web server logs — your IP address and your user agent — in order to send you the page. That happens under Google’s own privacy policy, and we add nothing of our own on top of it.
The notify list
This is the one place where this website collects something about a person, so it is set out in the same detail as the app. It has nothing to do with the app on your phone: no Splitmate install is involved, no group is involved, and being on this list is not an account.
What is stored. Three things, and they are the whole record:
- the email address you typed;
- the moment our server received it;
- a short label recording which form it came from.
Nothing else is attached to it. Not your IP address, not your browser’s user agent, not the page you arrived from, and no cookie or identifier of any kind. The form does carry one extra field, hidden from view and meant to stay empty, whose only job is to catch automated submissions; a submission that fills it is discarded and never written down.
Where it is stored. In the same Firebase Realtime Database operated by Google in the asia-southeast1 region (Singapore) that the app uses, under a top-level key of its own. It sits beside the group data described below rather than inside it: no group can see it and it is not part of any group’s records.
Who can read it. No client can — not this website, not the app, not a stranger with a browser and the address of the database. The security rules deny reads and writes on that path outright, and the only thing that reaches it is server-side code running with administrative access, which the rules do not apply to. There is no page anywhere, public or private, that lists these addresses.
How long it is kept. Everything else on this page says that we do not delete things. This is the exception, and it is a promise rather than a description of something automatic — nothing expires this list on a schedule, so whoever sends the launch email is the one who has to honour it:
Addresses are kept until Splitmate is publicly released. We then send one email saying so, and a second asking whether you want to stay on the list. Everyone who does not reply is deleted.
To come off the list before then, email splitmate@quizuncle.com and say so. It is listed on the data deletion page alongside everything else we can remove.
On your phone only
The app keeps its own database in Android’s private per-app storage. It holds everything you have entered: your personal ledger, every group you are in, member names and pictures, the expenses and settlements in each group, a local copy of each chat, your display name, your chosen currency, your theme, and the invite code of any group you have shared. Android does not give you a file path to it and other apps cannot read it.
An expense you log as Just me is only ever there. It is not part of any group, no code path in the app uploads one, and there is no cloud copy to restore from. That is a deliberate design choice and it has a real cost: uninstalling the app, clearing its data, or losing the phone destroys those expenses, and neither you nor we can get them back. If they matter to you, write them down somewhere else as well.
The app also keeps its own picture file for your avatar, and the Firebase client keeps a disk cache of group data it has already synced, so a group you have opened before still works with no connection. Both live inside the same private storage and both go when the app’s data goes.
What is uploaded
Creating or joining a group is what starts an upload. From that point on, that group’s records sync to a Firebase Realtime Database operated by Google in the asia-southeast1 region (Singapore). This is the complete list of what is written there and what each entry holds. Nothing else about you is sent anywhere.
| Where | What it holds |
|---|---|
/groups/{id}/meta | The group’s name, its currency code, its emoji, a deleted marker, the settle-by date, the reminder interval and the amount threshold if either is set, and when it was last changed. |
/groups/{id}/members/{uuid} | One entry per member: the display name, the avatar colour, a deleted marker, a timestamp, and — only if that person set one — their profile picture, as a 256-pixel JPEG encoded into text, capped at 48KB. |
/groups/{id}/expenses/{uuid} | The description, the amount in minor units, who paid, the category key, the split type, the note, the date, a deleted marker, a timestamp, and each member’s share and weight. |
/groups/{id}/settlements/{uuid} | Who paid whom, how much, which method label was chosen (cash, upi or other), the note, the date, a deleted marker and a timestamp. |
/groups/{id}/secret/code | The group’s eight-character invite code. |
/groups/{id}/auth/{uid} | One entry per device that has joined: the anonymous identity, the code it joined with, and which member of the group it claims to be. This entry is what the server checks on every read and every write. |
/invites/{code} | Which group an invite code opens. Written once, and never removed — see how long it stays. |
/userGroups/{uid}/{groupId} | Your own list of which groups you are in, and the code for each. Readable by you alone. It is what Restore with Google reads to find your groups again. |
/chats/{chatId}/meta | Whether the conversation is a group thread or a one-to-one, which group it belongs to, the group’s display name, and when it was created. |
/chats/{chatId}/members/{uid} | One entry per participant: display name, which member of the group they are, how far they have read, and whether they are typing. |
/chats/{chatId}/messages/{id} | The message text itself, in plain form, up to 2,000 characters, with the sender, the server timestamp, which message it replies to, and a marker set when it is deleted. |
/userChats/{uid}/{chatId} | Your own list of which conversations are yours. Readable by you alone. It carries no content of its own. |
/pushTokens/{uid} | Your device’s notification token, the platform it is on, and a timestamp. The token is what makes this specific phone addressable — see notifications. |
Who can read it, and who cannot
Server-side security rules stand in front of every path above. A group’s records can only be read by a device holding an entry under that group’s auth node, which is created by presenting the group’s invite code. A group’s chat thread is gated on that same entry, and a one-to-one conversation is gated on its own two participants. Your group index and your notification token can only be read by you. Everything outside those paths is denied by default, and nothing anywhere in the tree can be listed or enumerated by a stranger.
Traffic between the app and the database is encrypted in transit. That is not the same claim as end-to-end encryption, and this is the part worth reading twice:
Splitmate chat is not end-to-end encrypted. Messages are stored on the server as ordinary text. The security rules decide who is allowed to open a thread, but they are a permission check, not encryption — we hold the data in a form we could read if we looked, and so could anyone we are legally compelled to give it to. The same is true of every other row in the table above: member names, expense descriptions, notes and profile pictures are all stored in a form we can read.
Treat a Splitmate chat the way you would treat an ordinary group chat, and not the way you would treat a private one. Do not use it for anything you would not want us to be able to read.
Who Splitmate thinks you are
There is no signup, no email address, no password and no phone number, and there is no user directory, so nobody can search for you or find you by name.
That is not the same as having no identifier, and the difference matters. The first time the app needs the network it creates a Firebase Anonymous Auth identity — an anonymous account, generated per install, consisting of nothing but a random user id. That id is what every security rule checks, what a group’s auth entry is keyed to, and what your notification token is filed under. Nothing about you is attached to it: it carries no name, no address and no device identifier, and it is not shared with anybody outside the paths in the table above.
Because it belongs to the install rather than to you, clearing the app’s data or uninstalling the app ends it. A fresh install is a different anonymous identity, with no way back to the groups the previous one was in.
Signing in with Google is optional
The one thing that changes that is the optional Back up your identity row in Settings, and the Restore with Google button during onboarding. Signing in attaches your Google account to the same anonymous identity, so that a reinstall can pick it up again and find your groups and chats. It is used for backup and restore, and for nothing else.
When you use it, Firebase Authentication — Google — holds a provider record alongside the identity: your Google email address, your Google display name and the URL of your Google profile picture. We do not copy any of that into the group database, and it is never shown to other members. Your personal ledger is not part of this backup, because it was never uploaded in the first place.
We only receive an ID token from the sign-in. Splitmate never asks for access to your Gmail, your contacts, your Drive or anything else in your Google account.
Notifications
Splitmate sends two completely different kinds of notification, and only one of them involves a server at all.
- Settlement reminders are local. The app schedules them on your own phone with Android’s alarm service. Nothing is sent to a server, nobody else is told, and the person being reminded is you.
- Chat notifications go through Google. When someone sends a message, a Cloud Function reads the conversation’s participant list, looks up each recipient’s notification token, and hands the notification to Firebase Cloud Messaging for delivery.
A chat notification contains the message text. The sender’s name — and, in a group thread, the group’s name as well — becomes the title, and the first 120 characters of what they wrote become the body. So the text appears on the recipient’s lock screen whether or not the phone is unlocked, and it passes through Google’s notification service on the way. This is the single most surprising thing in the data flow and we would rather you heard it here than discovered it.
Deleting a message raises no notification: the fan-out only runs when a message is first created. A notification already delivered to someone’s phone is out of our reach, and deleting the message does not recall it.
Your notification token is written to /pushTokens/{uid} and can only be read by you. The Cloud Function reads it with administrative access in order to send; no other user can. A token that Google reports as dead is deleted automatically.
Android permissions
The app declares three permissions of its own, and inherits a fourth from the component that scans invite codes. It asks for nothing else, and it never asks for a permission at launch.
- Internet. Required for group sync, chat, notifications and the optional Google sign-in. Nothing else in the app uses the network.
- Notifications. Requested in context, never on first launch: the first time you open a chat thread, and the first time you set a settlement deadline. Decline it and the rest of the app carries on working.
- Run at startup. Used for one thing only. Android clears every scheduled alarm when the phone restarts, so this lets the notification component put your own settlement reminders back on the schedule. It runs no app code and sends nothing.
- Camera. Used when you scan a QR code to join a group, and when you take a new profile picture for yourself instead of choosing an existing one. Both are handled on the phone; the camera is never opened in the background.
Alongside those, the Firebase and notification components add the ordinary supporting permissions Android grants without asking — network state, wake lock, vibrate and message receipt. None of them reads anything about you.
What we never collect
This is a list of things the app does not do, and it is provable rather than promised: none of the code that would do them is in the app at all.
- No analytics. There is no analytics library in the dependency tree. Nothing counts screens, taps, sessions or features, so there is no usage data to collect and none is uploaded.
- No crash reporting. There is no crash reporter either. A crash is not reported to us or to anyone else.
- No advertising. No ad network, no advertising identifier, no tracking SDK, no attribution SDK. The app shows no advertising and never will while it has no code that could.
- No billing. No payment library of any kind. Splitmate cannot take money and does not know how to, and it never moves money between people either — a settle-up is a record of a payment you made somewhere else. See the terms.
- No location, no contacts, no calendar, no microphone, no files. The app does not ask for any of them and could not read them if it did.
- No selling and no sharing. We do not sell your data, we do not share it with advertisers or data brokers, and we run no profiling and no automated decision-making on it. The only third party involved is Google, and only as the provider of the hosting, the database, the sign-in and the notification service described above.
How long it stays
The honest answer is the uncomfortable one, so here it is plainly.
Group data is kept until it is removed on request. There is no expiry, no retention window and no scheduled clean-up: nothing in the app deletes a group’s records from the server, ever. Deleting an expense inside the app marks it as deleted for every member, which is what makes the deletion travel between phones — but the entry it marks, including its description, its amount and its note, stays on the server behind that marker. The same is true of a member entry that has been removed. The route that actually erases data is the email request on the data deletion page, and it is the only one.
We could have written a number here. We have not, because the app does not honour one, and a retention period a system does not enforce is a false claim rather than a policy. If a scheduled clean-up is ever built, this section changes and the effective date moves with it.
An invite code never expires. The entry that maps a code to its group is written once, when the group is first shared, and nothing in the app removes it or replaces it. A code therefore goes on resolving to its group indefinitely — after everyone has stopped using the group, and after the group has been marked deleted. The app cannot rotate a code or withdraw one. Treat any code you hand out as permanent, and hand it only to people you want in the group.
Your notification token is overwritten each time it changes and is deleted automatically when Google reports the device unreachable. Server logs at the hosting layer are Google’s and are kept under Google’s own policy.
The notify list is the one thing on this page with an end date on it, and the difference is deliberate: it holds an email address rather than a shared group’s history, so nothing else’s arithmetic breaks when it goes. The notify list states the commitment in full.
Deleting your data
There are four routes, and they remove different things. The data deletion page sets each one out in full, with a table showing which route removes which data. In summary:
- Clearing the app’s data or uninstalling it removes everything held on this phone, including every Just-me expense. It removes nothing from the server.
- Removing a member inside the app takes that person out of the balances and out of new splits. It does not reach their phone, and their name and profile picture stay in the group’s records.
- Delete for everyone on your own chat message erases the text on the server for every participant, leaving only an empty marker in its place.
- Emailing us at splitmate@quizuncle.com is the route that erases your data from the server. Read the deletion page before you send it — it explains what to include, and why sending it before you clear the app’s data matters.
The notify list is outside all four, because it is website data rather than app data and no install is involved in it: coming off it is a one-line email to the same address, and it is deleted after the launch anyway. See the notify list.
Children
Splitmate is not for anyone under 18. It is not directed at children, we do not knowingly collect anything from them, and a person under 18 should not create a group, join one, or put their name, picture or messages into the app. If you believe someone under 18 has done so, email splitmate@quizuncle.com and we will remove what we can identify.
Your rights
You can ask us what we hold about you, ask for it to be corrected, and ask for it to be erased. Because Splitmate has no login, an anonymous identity is all we have to match a request against, so the deletion page explains what to include to make yourself identifiable. There is nothing to consent to, because there is no analytics, no advertising and no profiling to consent to; the data described on this page is what the app needs in order to show a shared group to the people in it.
We are a small studio in India, and this policy is governed by Indian law — see the terms. If something here does not answer your question, ask us rather than guessing.
Changes to this policy
When this policy changes, the effective date at the top and bottom of this page moves. If a change alters what leaves your phone, or who can read it, we will say so here in words rather than only moving the date.
Contact
Questions about any of this, and requests to delete your data, go to splitmate@quizuncle.com. A real person reads it.
Effective . See also the terms of use and how to delete your data.