Privacy Policy

1. Information We Collect

We collect information in two ways. Information you provide directly: your name, email address, profile photo, group and trip details, expense descriptions, and payment method details (processed securely by our payment partners we never store raw card numbers). Information collected automatically: device type, operating system, app version, IP address, usage patterns, crash reports, and session data. If you sign in via Apple or Google, we receive only the basic profile details you authorize. We never access your contacts or location without explicit permission.

2. How We Use Your Information

We use your information to: (a) provide, operate, and maintain SplitPilot; (b) process and display expenses, settlements, and group balances; (c) send transactional emails and push notifications relevant to your activity; (d) detect and prevent fraud, abuse, and security incidents; (e) analyze aggregate usage trends to improve app performance and design; (f) comply with legal obligations; and (g) respond to support requests. We do not use your expense data for advertising profiling or sell it to third parties.

3. How We Share Your Information

We never sell your personal information. We share data only in these circumstances: (a) With group members expense and settlement data is visible to other members of groups you join, by design. (b) With service providers trusted vendors (cloud hosting, analytics, payment processing, email delivery) under strict data processing agreements. (c) For legal compliance if required by law, court order, or to protect rights and safety. (d) Business transfers in a merger or acquisition, your data may transfer to the successor entity under the same privacy protections. We require all third parties to respect data security and prohibit them from using your data for their own purposes.

4. Third-Party AI Services

5. Data Security

We protect your data with multiple layers of security: all data in transit is encrypted using TLS 1.2 or higher; data at rest is encrypted using AES-256; access to production systems is restricted to authorized personnel with multi-factor authentication; we conduct regular security audits and vulnerability assessments. In the event of a data breach that poses a risk to your rights, we will notify you and relevant authorities within the timeframes required by applicable law. While we take every reasonable precaution, no transmission over the internet is 100% secure.

6. Your Choices and Rights

Depending on your location, you may have the following rights regarding your personal data: Access request a copy of the data we hold about you. Rectification correct inaccurate or incomplete data. Erasure request deletion of your account and associated data. Portability receive your data in a structured, machine readable format. Restriction ask us to limit how we process your data. Objection object to processing based on legitimate interests. To exercise any of these rights, contact us at [email protected]. You can also unsubscribe from marketing emails at any time via the link in any email. We will respond within 30 days.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. If you delete your account: your profile and expense data are deleted within 30 days; anonymized aggregate statistics may be retained indefinitely for analytics purposes; legal and financial records may be retained for up to 7 years where required by law. Backups are purged on a rolling 90 day cycle. You may request earlier deletion by contacting [email protected].

8. Cookies and Tracking

SplitPilot's mobile app does not use browser cookies. On our website, we use: Essential cookies necessary for login sessions and security. Analytics cookies anonymous usage data (e.g., page views) to improve our website. We do not use advertising or cross site tracking cookies. You can manage or disable cookies via your browser settings; note that disabling essential cookies may affect website functionality. Our mobile app uses device identifiers (e.g., advertising ID) only for aggregate, anonymous crash reporting, and you can reset or disable this ID in your device settings.

9. Children's Privacy

SplitPilot is not directed to children under the age of 13 (or 16 in the EU/EEA). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at [email protected]. We will promptly delete such data upon verification. If we discover that we have inadvertently collected data from a child, we will delete it without delay.

10. International Data Transfers

SplitPilot is operated from and primarily stores data in the United States. If you are accessing our services from the European Economic Area, United Kingdom, or other regions with data protection laws, your information may be transferred to and processed in countries that may not have the same data protection standards as your home country. We use Standard Contractual Clauses (SCCs) approved by the European Commission and other appropriate safeguards to ensure your data receives adequate protection wherever it is processed.

11. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email and/or an in app notification at least 14 days before the changes take effect, and update the 'Last updated' date at the top of this page. For non material changes (e.g., grammar fixes, clarifications), we will update the date without separate notification. Continued use of SplitPilot after the effective date of any update constitutes your acceptance of the revised policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact our Privacy team at [email protected]. For general support, reach us at [email protected]. EU/EEA residents may also lodge a complaint with their local data protection supervisory authority. We aim to respond to all privacy related inquiries within 30 days.