Privacy Policy

This policy covers the Splitmate Android app, the web app at web.splitmate.quizuncle.com, which you sign in to with Google, and this website. It is written in plain English because the honest version is short. “We” means Quizuncle, the indie studio behind Splitmate; “you” means whoever is using the app.

In short

This website

splitmate.quizuncle.com is a set of static files served by Firebase Hosting, which is Google. There are no analytics, no tracking pixels, no embedded videos, no web fonts loaded from anyone else and no third-party scripts of any kind: no page here fetches anything from another company, before or after you interact with it, and there is no script on this site capable of sending anything anywhere.

That paragraph is about splitmate.quizuncle.com and nothing else. web.splitmate.quizuncle.com is a separate site: an application you sign in to with Google, rather than a set of pages, and it does load a Google script — see the web client. Keeping the two apart matters here more than anywhere: a promise about scripts is worth nothing if it quietly covers a second hostname where it is not true.

Nothing you type here is sent anywhere, because there is nothing to type into. Until Splitmate’s public release on 8 October 2026 the home page carried a form for being told when that happened, which sent the email address typed into it to this same domain. The form has been removed. Any address it collected is the only personal data this website has ever held, and the next section says what happens to it.

There is one cookie, and it is a preference rather than a tracker: qu_theme, whose entire value is the word dark or light. It records whether you asked for the light or the dark version of this page. It is scoped to .quizuncle.com so the same choice applies on quizuncle.com and the other Quizuncle sites — that sharing is the only reason it is a cookie rather than localStorage, which is kept separate per subdomain. It holds no identifier, it is not used to recognise you, and no server does anything with it. Clear your cookies and it is gone, after which the site follows your operating system’s light or dark setting.

Google, as the hosting provider, processes ordinary web server logs — your IP address and your user agent — in order to send you the page. That happens under Google’s own privacy policy, and we add nothing of our own on top of it.

The notify list

Until Splitmate’s public release on 8 October 2026, the home page had a form for being told when that release happened. The server code behind it was removed on 2 September 2026, and the form itself is now gone too. Any address it stored may still be held until the promise below is kept, so it is set out in the same detail as the app. None of this has anything to do with the app on your phone: no Splitmate install is involved, no group is involved, and being on the list is not an account.

What is stored. Three things for each address, and they are the whole record:

• the email address you typed;
• the moment our server received it;
• a short label recording which form it came from.

Nothing else is attached to it. Not your IP address, not your browser’s user agent, not the page you arrived from, and no cookie or identifier of any kind. The form also carried one extra field, hidden from view and meant to stay empty, whose only job was to catch automated submissions; a submission that filled it was discarded and never written down.

Where it is stored. In the same Firebase Realtime Database operated by Google in the asia-southeast1 region (Singapore) that the app uses, under a top-level key of its own. It sits beside the group data described below rather than inside it: no group can see it and it is not part of any group’s records.

Who can read it. No client can — not this website, not the app, not a stranger with a browser and the address of the database. The security rules deny every path they do not explicitly open, and nothing opens this one, so only someone with administrative access to the database can reach it. There is no page anywhere, public or private, that lists these addresses.

How long it is kept. Almost everything else on this page is kept until it is removed. This is the exception, and it is a promise rather than a description of something automatic — nothing expires these addresses on a schedule, so whoever sends the release email is the one who has to honour it:

To have an address removed sooner, email splitmate@quizuncle.com and say so. It is listed on the data deletion page alongside everything else we can remove.

The web client

web.splitmate.quizuncle.com is a second Splitmate client: your groups, plus a view-only Me tab. Everything it can add or change belongs to a group you are already in — creating one or joining one, expenses and splits, settlements, members, and that group’s conversation — and it also shows each group’s balances and spending charts. The expenses you log as Just me live in a database on the phone. If you turned on their optional backup, the browser reads it to show them to you on its Me tab, beside your share of your groups’ expenses, and that is all it does with it: it cannot add, change or delete a Just-me expense, and it never writes to that backup. Leave the backup off and there is nothing there for it to read. A good deal of what the rest of this page describes simply does not arise in the browser. It is served by Firebase Hosting, the same as this site.

Signing in with Google is required, and that is a real difference from the phone. There is no anonymous route in: a browser cannot usefully hold the per-install anonymous identity described under who Splitmate thinks you are, so Google is the only door. When you use it, Firebase Authentication holds the same provider record it holds for the app — your Google email address, your Google display name and the URL of your Google profile picture — and the same limits apply: we receive an ID token and nothing else, and Splitmate never asks for access to your Gmail, your contacts or your Drive.

On the wire it is mostly groups, too. The client touches three top-level keys as a matter of course — /groups, /invites and /userGroups — in the same asia-southeast1 Realtime Database the phone uses, which is why a group you join in the browser is the same group on the phone. Your Just-me expenses are view-only there, and the client touches the personal-ledger backup path in two places only. Opening the Me tab reads /personalLedger/{uid}/transactions — your own backup, the same copy the phone wrote — so it can list your Just-me expenses; it never writes to that path. And deleting your account removes it, along with any backup the Android app made for the same account. Opening an expense there also reads, and adding to it writes, the same /receipts and /comments entries the phone does — see receipts and comments.

Chat is the exception, and it is the same chat data the phone writes. Opening a group’s conversation reads and writes /chats/{chatId} — its meta, its members, its messages, and your own delivery marker under recv — along with /userChats/{uid}, which is your own index of the conversations you are in. Blocking somebody writes /blocks/{uid}, which can only be read by you. Reporting a message writes /reports, and what it writes is a copy of the message text, not a pointer to it, so that a report stays readable to us even if the message is deleted afterwards. Every one of those rows is described in what is uploaded, and none of it is new data — it is the same tree the Android app has always written, now written from a second place.

A conversation is fetched in pages, not in one go. Opening one asks the database for the most recent 50 messages; anything older is read a page at a time, and only when you ask for it. That is a description of what gets downloaded and when rather than a privacy promise — the older messages are on the server either way — but it is the honest answer to “what did that browser actually download”.

The browser also keeps some things in its own storage for this site. Preferences that never leave it: your display settings and default currency, how your groups are sorted and which are pinned, the payment method you last recorded, your own UPI ID if you enter one, any UPI ID you save for someone so Pay via UPI can fill it in, when you last opened each group and the Activity feed, whether you dismissed the install prompt, and the random id described below for notifications. And, for working offline, a cached copy of your groups (including each chat's latest message and recent edit history), a copy of the Just-me expenses the Me tab read from your backup, plus any expenses or payments still waiting to be sent — those are uploaded once you are back online. Deleting your account in the web app erases all of it. Signing out clears the cached copy but keeps the preferences, and keeps any writes still waiting, so they can go out the next time that account signs in on this browser.

It can be notified, and that is the other thing it writes outside those three keys. Turning notifications on from Settings (the ⚙ on the Me tab) — the only thing that starts it, since nothing is requested when the page loads — stores this browser’s notification token at /pushDevices/{uid}/{deviceId}, with the word web and a timestamp beside it. The device id is a random value the browser generates and keeps for itself; nothing about it is derived from your machine, your screen or anything else that would identify you. It can only be read by you, and the Cloud Function reads it with administrative access in order to send. What then arrives is the same fan-out a phone receives, which means a notification about a chat message carries the message text — see notifications. Tapping one opens Splitmate rather than the conversation it is about, because the chat fan-out’s link still points at the site root.

It loads Google reCAPTCHA v3, which no page on splitmate.quizuncle.com does. It runs on every page of it and reports signals about the browsing session to Google, under Google’s own privacy policy. It feeds Firebase App Check, which is wired into both clients — reCAPTCHA v3 here, Play Integrity on Android — and which is not enforced on any Firebase service. No request is refused for want of a token. What decides who may open a group is the same thing it has always been, the server-side rules under who can read it.

Nothing there counts what you do. Unlike the Android app, which now carries Firebase Analytics and Crashlytics, the browser client loads Firebase Authentication, the Realtime Database, Firebase Cloud Messaging (and that only once you turn notifications on) and the reCAPTCHA script above, and nothing else. No analytics, no crash reporting, no advertising SDK, and no cookie of its own.

Everything else on this page applies to it unchanged. A group created or joined there is stored exactly as what is uploaded describes, kept for as long as how long it stays says, and removed by the same routes in deleting your data. Signing out ends the session on that device and removes nothing from the server.

On your phone only

The app keeps its own database in Android’s private per-app storage. It holds everything you have entered: your personal ledger, every group you are in, member names and pictures, the expenses and settlements in each group, a local copy of each chat, your display name, your chosen currency, your theme, and the invite code of any group you have shared. Android does not give you a file path to it and other apps cannot read it.

An expense you log as Just me stays on your phone only, unless you turn on backup. It is not part of any group, and by default no code path in the app uploads one. With that switch left off — which is how it starts — this is a deliberate design choice and it has a real cost: uninstalling the app, clearing its data, or losing the phone destroys those expenses, and neither you nor we can get them back. If you are not backing them up and they matter to you, write them down somewhere else as well. The switch itself, and what turning it on changes, is the next section.

The app also keeps its own picture file for your avatar, and the Firebase client keeps a disk cache of group data it has already synced, so a group you have opened before still works with no connection. Both live inside the same private storage and both go when the app’s data goes.

A few more things are kept in the same place and never uploaded: the payment method you last recorded, your own UPI ID if you enter one in your profile, any UPI ID you save for a friend so that Pay via UPI can fill it in, when you last opened each group (which is how the app knows what to mark as new), how your groups are sorted, and whether the monthly recap reminder is on. Your own UPI ID, the one recorded in your profile, leaves the phone only inside a reminder message you choose to send. Signing out or deleting your account erases all of them.

Backing up your personal ledger is optional, and off by default

Settings has a switch called Back up your personal expenses, and it starts off for everyone. Leave it off and the previous section is the whole story: your Just-me expenses live only on this phone. Turn it on and each one is copied to the same Firebase Realtime Database in asia-southeast1 that group data uses — under a path of its own, not inside any group, encrypted in transit the same as everywhere else on this page, and readable only by you. No other member of any group can see it, and it is not part of any group’s records.

Turning the switch on also copies whatever Just-me history you already had, not only what you add afterwards, so switching it on late still backs up what came before. Turning it off asks a second question — keep the stored copy, or delete it too — and choosing delete removes it from the server outright. Either way, your expenses stay on this phone the entire time; the switch only ever decides whether a second copy also exists on the server.

A browser can show it to you, and do nothing else with it. If you also use Splitmate in a browser signed in to the same Google account, its Me tab reads this copy to show you your Just-me expenses there, view-only: the browser cannot add, change or delete one, and it never writes to the copy. It keeps what it read so the tab can still show them without a connection, and drops it when you sign out there or delete your account. If you delete the stored copy, the browser’s Me tab stops showing those expenses the next time it opens.

What is uploaded

Creating or joining a group is what starts an upload. From that point on, that group’s records sync to a Firebase Realtime Database operated by Google in the asia-southeast1 region (Singapore). This is the complete list of what is written there and what each entry holds. Two other things can also leave your phone — the optional personal-ledger backup just above, and the analytics and crash reports described further down — but nothing besides those three ever sends anything anywhere.

Receipt photos and comments

Receipt photos. If you attach a photo to an expense, the photo is resized and re-saved on your device before it is uploaded, which removes hidden metadata such as the location where it was taken. The photo is stored in our database (Google Firebase Realtime Database) with the expense’s group and can be seen by every current member of that group. Attaching a photo is optional, and an expense holds one at most. The photo is not end-to-end encrypted; it is protected in transit by TLS. Nothing reads what is in it: Splitmate does not scan receipts.

Comments. Comments you write on an expense are stored in the same database and can be read by every current member of the group. They are optional and not end-to-end encrypted.

Whose name is on them. The name shown on a comment or a receipt (and in a comment notification) is the group member the writer’s app says it is; Splitmate does not independently verify it, so a member of a group could make a comment appear to come from another member of that group.

Who can read it, and who cannot

Server-side security rules stand in front of every path above. A group’s records can only be read by a device holding an entry under that group’s auth node, which is created by presenting the group’s invite code. A group’s chat thread is gated on that same entry, whichever of the two clients you opened it in, and so are the receipt photos and comments every member of it can see. Your group index and your notification token can only be read by you. Everything outside those paths is denied by default, and nothing anywhere in the tree can be listed or enumerated by a stranger.

Traffic between the app and the database is encrypted in transit. That is not the same claim as end-to-end encryption, and this is the part worth reading twice:

Who Splitmate thinks you are

There is no signup, no email address, no password and no phone number, and there is no user directory, so nobody can search for you or find you by name.

That is not the same as having no identifier, and the difference matters. The first time the app needs the network it creates a Firebase Anonymous Auth identity — an anonymous account, generated per install, consisting of nothing but a random user id. That id is what every security rule checks, what a group’s auth entry is keyed to, and what your notification token is filed under. Nothing about you is attached to it: it carries no name, no address and no device identifier, and it is not shared with anybody outside the paths in the table above.

Because it belongs to the install rather than to you, clearing the app’s data or uninstalling the app ends it. A fresh install is a different anonymous identity, with no way back to the groups the previous one was in.

The web client has no anonymous identity at all. There is no install for one to belong to, so signing in with Google is the only route in there — required in the browser, optional on the phone. See the web client.

Signing in with Google is optional

The one thing that changes that is the optional Back up your identity row in Settings, and the Restore with Google button during onboarding. Signing in attaches your Google account to the same anonymous identity, so that a reinstall can pick it up again and find your groups and chats. It is used for backup and restore, and for nothing else.

When you use it, Firebase Authentication — Google — holds a provider record alongside the identity: your Google email address, your Google display name and the URL of your Google profile picture. We do not copy any of that into the group database, and it is never shown to other members. Your personal ledger is not part of this backup, because it was never uploaded in the first place.

We only receive an ID token from the sign-in. Splitmate never asks for access to your Gmail, your contacts, your Drive or anything else in your Google account.

Notifications

Splitmate sends two completely different kinds of notification, and only one of them involves a server at all.

• Some are local. Settlement reminders, the optional monthly recap reminder and the optional Quick add entry are scheduled or shown by the app on your own phone with Android’s own notification and alarm services. Nothing is sent to a server for them, nobody else is told, and the person being notified is you. The recap reminder names a group and a month and carries no amounts.
• The rest go through Google. Six things raise one: a message sent in a chat, an expense added to a group, a payment recorded in a group, a comment on an expense, a nudge from somebody you owe, and somebody leaving a group. In each case a Cloud Function reads the participant or member list, looks up each recipient’s notification token, and hands the notification to Firebase Cloud Messaging for delivery. They are addressed to a person rather than to a device, so every device that person has registered receives them — their phone, and a browser they have turned notifications on in.

Comments are the other notification that carries text. When someone comments on an expense you created, paid for or have commented on, we send you a notification that includes the commenter’s name, the expense title and the first part of the comment, which may appear on your lock screen. You can switch these off in your device’s notification settings (the “Comments” channel on Android).

A nudge carries the name of the person asking, the group’s name and the amount, and nothing anybody typed — there is no message field in a nudge.

Deleting a message raises no notification: the fan-out only runs when a message is first created. A notification already delivered to someone’s phone is out of our reach, and deleting the message does not recall it.

Your notification token is written to /pushDevices/{uid}/{deviceId}, one entry per device, so a phone and a browser can both be registered at once without displacing each other. Older installs of the app still use /pushTokens/{uid}, which held a single token, and both are read when a notification is sent. Either way it can only be read by you. The Cloud Function reads it with administrative access in order to send; no other user can. A token that Google reports as dead is deleted automatically.

Android permissions

The app declares three permissions of its own, and inherits a fourth from the component that scans invite codes. It asks for nothing else, and it never asks for a permission at launch.

• Internet. Required for group sync, chat, notifications and the optional Google sign-in. Nothing else in the app uses the network.
• Notifications. Requested in context, never on first launch: the first time you open a chat thread, the first time you set a settlement deadline, and when you turn on the Quick add notification or the monthly recap reminder in Settings. Decline it and the rest of the app carries on working.
• Run at startup. Used for one thing only. Android clears every scheduled alarm when the phone restarts, so this lets the notification component put your own settlement reminders back on the schedule. It runs no app code and sends nothing.
• Camera. Used when you scan a QR code to join a group, when you take a new profile picture for yourself instead of choosing an existing one, and when you take a photo of a receipt to share with every member of a group. The camera is never opened in the background.

If you choose Add receipt on Android, you pick Take photo or Choose from gallery. “Take photo” opens your phone’s own camera app; if you have not already allowed Splitmate to use the camera (for example for scanning a group’s QR code), Android asks you for camera permission at that moment. “Choose from gallery” opens Android’s own photo picker, which needs no permission: Splitmate receives only the one photo you pick and does not get access to your photo library. In the web app, where you sign in with Google, your browser or device opens its own camera or file picker; Splitmate does not open your camera by itself. Either way the photo you attach is seen by every member of that group.

Alongside those, the Firebase and notification components add the ordinary supporting permissions Android grants without asking — network state, wake lock, vibrate and message receipt. None of them reads anything about you.

Analytics and crash reports

The app uses two Google Firebase services with no equivalent above: Firebase Analytics and Firebase Crashlytics. Both start the moment the app opens, in every release build, and there is no in-app switch to turn either one off yet.

Analytics logs seven events, and that is the complete list: finishing onboarding, creating a group, sharing an invite, opening an invite, joining a group, adding an expense, and settling up. Only adding an expense carries anything beyond the event itself, and what it carries is a single yes-or-no flag for whether the expense was in a group or logged as Just me. No event carries an amount, a name, a description, a note, a message, or a group’s name — that is a property of the seven calls that write these events, not a promise about ones that might be added later.

Crashlytics collects a report when the app fails unexpectedly, so bugs can be found and fixed. It is built to hold a stack trace and information about your device, not anything you typed — but we do not promise it is always completely clean of your input: an error message raised from deep inside the phone’s own storage layer can occasionally carry a fragment of the text that caused it. Treat a crash report as usually free of anything you typed into the app, not guaranteed free of it.

Both services run on Google’s own SDKs, which attach some device-level context of their own by default — a Firebase installation id, your device model, its OS and app version, and a coarse region worked out from your IP address. The app’s own code does not add a name, an email address or any identifier of yours on top of that; nothing in it calls the functions that would.

The advertising identifier is not collected. Firebase Analytics normally pulls in the Android permissions needed to read it; this app removes all three of them from its manifest by name and turns off ad-ID collection in the SDK itself, so no advertising identifier is ever read, let alone sent anywhere.

What we never collect

This is a list of things the app does not do, and it is provable rather than promised: none of the code that would do them is in the app at all. Analytics and crash reporting used to be on this list; they no longer are — see analytics and crash reports just above for what changed and exactly what each one collects.

• No advertising. No ad network and no ad-mediation SDK. The advertising identifier is explicitly not collected either — see analytics and crash reports for how. The app shows no advertising and never will while it has no code that could.
• No billing. No payment library of any kind. Splitmate cannot take money and does not know how to, and it never moves money between people either — a settle-up is a record of a payment you made somewhere else. See the terms.
• No location, no contacts, no calendar, no microphone, and no access to your files or photo library. The app does not ask for any of them. The one photo you choose for a receipt or a profile picture is handed over by Android’s picker and nothing else is, and a receipt photo’s location data is removed before it is uploaded and shown to every member of the group.
• No selling and no sharing. We do not sell your data, we do not share it with advertisers or data brokers, and we run no profiling and no automated decision-making on it. The only third party involved is Google, as the provider of the hosting, the database, the sign-in, the notification service, and the analytics and crash-reporting tools described above. When you use Pay via UPI, the payment happens in your own UPI app, under that app’s terms; Splitmate hands it the payee’s UPI ID and the amount and is told nothing back, and it records the payment only when you say you made it.

How long it stays

The honest answer is the uncomfortable one, so here it is plainly.

Group data is kept until it is removed. There is no expiry and no retention window for a group’s records, with one scheduled exception: when an expense has been deleted, a daily job on our server removes its receipt photo and its comments, within about two days. The expense itself is only marked as deleted for every member, which is what makes the deletion travel between phones, and the entry it marks, including its description, its amount and its note, stays on the server behind that marker. The same is true of a member entry that has been removed. Most of the rest is erased only by the email request on the data deletion page, which also lists the few things the app itself can remove.

We could have written a number here. We have not, because apart from that daily removal the app does not honour one, and a retention period a system does not enforce is a false claim rather than a policy.

An invite link stops letting new people in 30 days after it was last shared or copied. Each time somebody taps Share invite link or Copy invite link in a current version of either client, or creates a group in the browser after signing in with Google, its code gets a fresh 30-day deadline, and the server refuses a join after it. A code that has never been shared or copied that way has no deadline until somebody does: for example, a group created on the phone and only shown as a QR code, or one shared before links had a deadline. The code itself never changes: the app cannot rotate one, so sharing the group again revives the same code. The entry that maps a code to its group is removed when the last member leaves. Anyone who has already joined keeps their access regardless — a deadline only stops new people. Hand a code only to people you want in the group.

Two small counters limit abuse. To limit abuse we keep a small counter per account of how many comment notifications it has caused recently, and another of how many nudges it has sent. They contain only identifiers and timestamps, not the text of any comment, a name or an amount. Old entries inside them are dropped as they age; the counters themselves are not removed when you delete your account. No client can read either one.

A group’s edit history is permanent. Each entry records which member changed an expense, a payment or the group’s settings, when, and what the values were before and after. The rules let a member add an entry and let nobody change or delete one — not the person who made the change, not another member, and not us through the app. It stays with the group for as long as the group’s other records do.

Your notification token is overwritten each time it changes and is deleted automatically when Google reports the device unreachable. Server logs at the hosting layer are Google’s and are kept under Google’s own policy.

The notify list is the one thing on this page that we delete on a promise rather than by a system, and the difference is deliberate: it holds an email address rather than a shared group’s history, so nothing else’s arithmetic breaks when it goes. The notify list states the commitment in full.

Deleting your data

There are five routes, and they remove different things. The data deletion page sets each one out in full, with a table showing which route removes which data. In summary:

1. Clearing the app’s data or uninstalling it removes everything held on this phone, including every Just-me expense. It removes nothing from the server.
2. Deleting your account yourself is in both clients, and they are not the same deletion. On the phone it also removes your personal-ledger backup and marks you as having left every group, so you drop out of their balances. The browser keeps no ledger of its own — only a cached copy of what its Me tab read, which it erases — and deleting your account there also removes any personal-ledger backup the Android app made for the same account; your member row is deliberately left standing, so groups you shared go on seeing your name where it already is. Neither removes expenses, settlements, chat messages, comments, receipt photos or edit history inside those groups — those stay, visible to every member still in them, and nobody can remove them afterwards, except that any member can remove a receipt photo, and deleting an expense also removes its receipt photo and comments, within about two days. Both are set out side by side.
3. Removing a member, or leaving a group yourself takes that person out of the balances and out of new splits. Neither reaches their phone, and their name and profile picture stay in the group’s records. Both clients refuse to let you leave while you still owe money. Where they differ is the other direction: the browser also refuses when money is owed to you, while the phone warns and lets you decide, on the grounds that walking away from your own credit is your own call. Leaving a group explains it.
4. Delete for everyone on your own chat message erases the text on the server for every participant, leaving only an empty marker in its place.
5. Emailing us at splitmate@quizuncle.com reaches what deleting your account cannot — your name and picture in a group you shared, and a whole group’s own records. Read the deletion page before you send it — it explains what to include, and why sending it before you clear the app’s data or delete your account matters.

Removing receipts and comments. Any member of a group can remove a receipt photo from an expense, which every member of the group could see until then. Comments cannot be erased one by one: the person who wrote a comment can hide it from the group’s view, but the text is kept in our database. Deleting your Splitmate account stops you from adding or hiding anything further; it does not erase comments you already wrote or photos you attached to a shared group, which stay with the group (another member can still remove a photo). Deleting the expense also removes its photo and its comments from the server, within about two days.

The notify list is outside all five, because it is website data rather than app data and no install is involved in it: coming off it is a one-line email to the same address, and it is deleted after the release email anyway. See the notify list.

Children

Splitmate is not for anyone under 18. It is not directed at children, we do not knowingly collect anything from them, and a person under 18 should not create a group, join one, or put their name, picture or messages into the app. If you believe someone under 18 has done so, email splitmate@quizuncle.com and we will remove what we can identify.

Your rights

You can ask us what we hold about you, ask for it to be corrected, and ask for it to be erased. Because Splitmate has no login, an anonymous identity is all we have to match a request against, so the deletion page explains what to include to make yourself identifiable. There is no advertising and no profiling to consent to; see analytics and crash reports for what the app's analytics and crash reporting carry instead, and the data described on this page is what the app needs in order to show a shared group to the people in it.

We are a small studio in India, and this policy is governed by Indian law — see the terms. If something here does not answer your question, ask us rather than guessing.

Changes to this policy

When this policy changes, the effective date at the top and bottom of this page moves. If a change alters what leaves your phone, or who can read it, we will say so here in words rather than only moving the date.

What changed on this date. The web client’s Me tab now reads your own personal-ledger backup, if you turned it on, to show you your Just-me expenses there — view-only, never written by the browser, and kept in the browser only until you sign out or delete your account. Deleting an expense now also removes, from the server and within about two days, the receipt photo and comments every member of its group could see; see deleting your data, and how long it stays now names that daily removal. And Splitmate is now publicly released on Google Play, so the form on the home page for being told when that happened has been removed; the notify list now says that the server code behind it was removed on 2 September 2026, and what happens to any address it stored.

What changed on 7 October 2026. Splitmate 1.3 lets any member of a group attach a receipt photo and comments to an expense, and this policy now says what is stored for each, who can see them, what a comment notification carries, how the camera and photo picker are used, and what can and cannot be removed. A receipt photo is a new kind of data — a photo, shared with every member of its group. The policy also now lists a group’s edit history, its optional trip dates and per-expense currencies, the nudge and comment counters, the device-only preferences, the six things that raise a notification, and the 30-day deadline on a shared invite link, all of which the app already had. The revision before that, on 22 August 2026, added the web app and its Google sign-in.

Contact

Questions about any of this, and requests to delete your data, go to splitmate@quizuncle.com. A real person reads it.

Effective 8 October 2026. See also the terms of use and how to delete your data.