1. Controller
Developer: Daniel Kimmich
Address: c/o Block Services, Stuttgarter Str. 106, 70736 Fellbach, Germany
Email: info@splithappens.io
2. Overview
This Privacy Policy informs you about the processing of your personal data when using the SplitHappens app ("App"). SplitHappens is an expense-sharing app for groups with AI-powered receipt recognition and real-time collaboration.
3. Data We Collect
3.1 Registration and Profile Data
- Email address (upon registration)
- Name/display name (freely chosen)
- Profile picture (optional, uploaded by the user)
- User ID (automatically generated)
Note: Uploaded profile and cover images are stored in a publicly accessible location and can be retrieved via their URL. Please do not upload images containing confidential information.
3.2 Third-Party Authentication Data
- Google Sign-In: Name, email address, profile picture (if you sign in via Google)
- Apple Sign-In: Name, email address or anonymous email (if you sign in via Apple)
3.3 Financial and Transaction Data
- Expenses and receipts (amounts, descriptions, categories)
- Group memberships and friend connections
- Balances and debts between users
- Payment history and settlement calculations
3.4 Multimedia Data
- Receipt photos (for AI-based text recognition and data extraction)
- Scan feedback (optional): If you actively send us feedback on a receipt scan, we store the relevant receipt photo, the recognized data, and your optional comment to improve recognition quality.
3.5 Device and Usage Data
- Device information (operating system, app version)
- Push token (device identifier used to deliver push notifications)
- Network connection data (for real-time synchronization)
4. Legal Basis for Processing
Your data is processed on the basis of the EU General Data Protection Regulation (GDPR):
- Art. 6(1)(a) GDPR: Consent (e.g., for optional profile picture)
- Art. 6(1)(b) GDPR: Performance of a contract (providing app functionality)
- Art. 6(1)(f) GDPR: Legitimate interests (security, error analysis)
5. Purposes of Data Processing
5.1 Providing App Features
- User registration and authentication
- Expense tracking and management
- Group management and friend connections
- Real-time synchronization across devices
- Balance calculation and settlement suggestions
5.2 AI-Based Services
- Receipt recognition: Automatic text recognition from receipt photos using Azure Document Intelligence (Microsoft, EU servers)
5.3 App Improvement and Support
- Error analysis and resolution
- Performance optimization
- Development of new features
- Customer support for issues
6. Data Sharing with Third Parties
6.1 Supabase (Backend Service) — Self-Hosted
Operation: Self-hosted on Hetzner Cloud, Germany (EU)
Software: Supabase (Open Source)
Data: All data stored in the app (profiles, expenses, friendships)
Purpose: Database, authentication, real-time synchronization
Location: Data center in Germany — your data does not leave the EU
6.2 Azure Document Intelligence (Receipt Recognition)
Provider: Microsoft Corporation (Azure)
Data: Receipt photos (only temporarily for text recognition)
Purpose: AI-powered receipt recognition and data extraction
Location: EU servers (GDPR-compliant)
Privacy: Microsoft Privacy Statement
6.3 Google Services (for Google Sign-In)
Provider: Google LLC, USA
Data: Name, email address, profile picture
Purpose: Authentication
Privacy: Google Privacy Policy
6.4 Apple Services (for Apple Sign-In)
Provider: Apple Inc., USA
Data: Name, email address (or anonymous email)
Purpose: Authentication
Privacy: Apple Privacy Policy
6.5 Firebase Cloud Messaging (Push Notifications)
Provider: Google LLC, USA (Firebase)
Data: Device push token
Purpose: Delivery of push notifications (e.g., new expenses, payment reminders)
Location: USA
Legal basis for transfer: EU-US Data Privacy Framework / Standard Contractual Clauses
Privacy: Firebase Privacy
6.6 No Sharing with Other Third Parties
Your data is not shared with advertisers, data brokers, or other commercial third parties.
7. Data Storage and Deletion
7.1 Retention Period
- Profile data: As long as your account is active
- Expenses and receipts: As long as the corresponding groups exist
- Receipt photos: After successful text recognition (max. 30 days)
- Scan feedback (photo + recognized data): As long as needed for quality improvement; deleted earlier upon request
7.2 Account Deletion
You can permanently delete your account at any time:
- In the app settings under "Delete Account"
- Or by email to info@splithappens.io
- Complete deletion of all your data within 30 days
8. Your Rights
Under the GDPR, you have the following rights:
Right of Access (Art. 15 GDPR)
You can request a copy of all data stored about you.
Right to Rectification (Art. 16 GDPR)
You can have incorrect or incomplete data corrected.
Right to Erasure (Art. 17 GDPR)
You can request the deletion of your data ("right to be forgotten").
Right to Restriction of Processing (Art. 18 GDPR)
You can request the temporary suspension of data processing.
Right to Data Portability (Art. 20 GDPR)
You can receive your data in a structured, commonly used format.
Right to Object (Art. 21 GDPR)
You can object to the processing of your data.
Contact for privacy inquiries: info@splithappens.io
9. Data Security
We implement technical and organizational measures to protect your data:
- Encryption: All data is transmitted encrypted (TLS/SSL)
- Access control: Restricted access to personal data
- Secure servers: Self-hosted infrastructure on Hetzner Cloud (Germany)
- Regular updates: Security patches and system updates
10. International Data Transfers
Your app data is stored on our self-hosted servers in Germany (Hetzner Cloud) and does not leave the EU. Data transfers only occur when using third-party authentication:
- Google Sign-In / Apple Sign-In: Authentication data is transmitted to Google LLC or Apple Inc. (USA)
- Firebase Cloud Messaging: Device push tokens are transmitted to Google LLC (USA)
- Legal basis: EU-US Data Privacy Framework / EU Commission adequacy decision for the USA, Standard Contractual Clauses
- Additional safeguards: Encryption, access restrictions
11. Children's Privacy
The app is intended for persons aged 16 and older. We do not knowingly collect data from children under 16. If you become aware that a child under 16 has submitted data, please contact us immediately.
12. Cookies and Tracking
The SplitHappens app uses no cookies or third-party tracking tools. All data is processed exclusively for app functionality.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. In the event of material changes, you will be notified via the app. The current version is always available at this URL.
14. Contact and Complaints
Privacy Inquiries:
Email: info@splithappens.io
Response time: Within 72 hours
Complaints:
You have the right to lodge a complaint with a data protection supervisory authority:
- Germany: Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (Federal Commissioner for Data Protection and Freedom of Information)
- Or with the supervisory authority of your EU member state
15. Additional Privacy Information for United States Residents
This section applies to residents of the United States and serves as our “Notice at Collection” under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). We also honor the comparable rights granted by other U.S. state privacy laws (e.g., Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas TDPSA). We extend these rights to all U.S. users as a matter of good practice, regardless of whether a given law's business-size or volume thresholds apply to us.
15.1 Notice at Collection — Categories of Personal Information
In the preceding 12 months, we have collected the following categories of personal information (using CCPA/CPRA terminology):
- Identifiers: name, email address, optional phone number, account/user ID, and device push token
- Customer records & financial information: payment method details you choose to add (e.g., IBAN or PayPal handle), stored encrypted; balances and shares you track
- Commercial information: bills, items, settlements, and event participation you create in the app
- Visual information: receipt photos you upload for automated recognition
- Internet or other electronic network activity: only the limited technical data necessary to operate the app — we use no analytics, advertising, or tracking cookies
We do not collect precise geolocation, biometric information, or background, education, or employment information, and we do not use your data to derive sensitive inferences about you.
15.2 Purposes of Collection
- Providing and operating the app's core features (expense sharing, settlement tracking)
- Automated receipt recognition (OCR)
- Sending push notifications you have enabled
- Security, fraud prevention, and debugging
- Customer support and communication
- Compliance with legal obligations
15.3 Sources of Personal Information
- Directly from you (registration, profile, bills, receipts)
- Automatically from your device (e.g., push token)
- From Google or Apple when you choose to sign in with those services
15.4 Disclosure for Business Purposes
We disclose certain categories of personal information to service providers who process it on our behalf under contract and may not use it for their own purposes (see Section 6): self-hosted backend infrastructure, Azure Document Intelligence (receipt recognition), Google and Apple (authentication), and Firebase Cloud Messaging (push notifications).
15.5 No Sale or Sharing of Personal Information
We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We have not sold or shared personal information in the preceding 12 months. Because we do neither, no “Do Not Sell or Share My Personal Information” opt-out link is required. We also do not knowingly sell or share the personal information of consumers under 16 years of age.
15.6 Your U.S. State Privacy Rights
Depending on your state of residence, you may have the following rights:
Right to Know / Access
Request the categories and specific pieces of personal information we hold about you.
Right to Delete
Request deletion of your personal information, subject to legal exceptions.
Right to Correct
Request correction of inaccurate personal information.
Right to Opt Out of Sale / Sharing / Targeted Advertising
Not applicable — we do not sell, share, or use your data for targeted advertising.
Right to Limit Use of Sensitive Personal Information
Not applicable — we do not use sensitive personal information to infer characteristics.
Right to Non-Discrimination
We will not discriminate against you for exercising any of these rights.
Right to Appeal
Where your state provides it, you may appeal a decision on your request by contacting us again.
15.7 How to Exercise Your Rights
To exercise any of these rights, email info@splithappens.io. Many rights can also be exercised directly in the app: you can access a complete, machine-readable copy of your data via Profile → Export, and you can delete your account via Profile → Delete Account. We will verify your identity before responding and reply within 45 days (extendable by an additional 45 days where permitted). You may designate an authorized agent to submit a request on your behalf. We do not charge a fee to process or respond to a verifiable request unless it is excessive or repetitive.
15.8 Retention
We retain personal information only for as long as necessary for the purposes described above (see Section 7). Following account deletion, your data is deleted within 30 days.
See also our Terms of Service and Legal Notice.