Privacy Policy

The controller for the processing described here is:

Luckysoft GmbH is being founded. Until it is entered in the Swiss commercial register, the people founding it act in its name and are responsible for this processing.

For every question about data protection, and to exercise your rights, write to support@splitpop.app. We have not appointed a data protection officer; this address reaches the people responsible directly.

Most of this data you enter yourself. Some is entered by other members of your groups, and some arises when you use SplitPop.

• Account: your name, email address, language, display currency, notification settings, whether you have paused access for AI assistants, and which version of the terms and this policy you accepted, and when. Our sign-in provider also processes your password or other sign-in method and a record of your sign-ins, with IP address and device.
• People: the names, emojis or pictures and email addresses of the people in your groups — including people without an account whom a member added (see “People added by others”).
• Groups: names and emojis, members and their roles, settings, invitations, and requests to join a group or to claim a name in it, with the decisions on them.
• Financial records: expenses and payments with amount, currency, exchange rate, date, who paid, how they are split, category and note; and the balances, suggested transfers and statistics SplitPop calculates from them. SplitPop does not hold or move money and never asks for bank or card details.
• Messages and files: chat messages, reactions, and the files you attach, such as receipts and photos. We check a file's type, size and integrity; we do not otherwise analyse its content.
• Activity: what happened in a group, by whom and when — added, changed, deleted, restored.
• AI assistants: a record of each call an assistant makes for you (see “AI assistants”).
• Communication: the notifications, invitations and reminders SplitPop sends by email or push; the bug reports and ideas you send from the app, with the page you were on, your language and your browser; and the emails you write to us. For the invitation emails it sends to an email address, SplitPop also keeps two short lists of hashes of those addresses, now made with a key only SplitPop holds, not the addresses themselves (see “How long we keep data”).
• Technical data: IP address, browser, device, the addresses opened, times and error details in server logs; the same without your IP address in error reports and measurements of loading times.
• On your device: cookies and entries in your browser's storage (see “Cookies and storage on your device”).

Please do not enter sensitive data such as health information, identity documents or full bank or card numbers; SplitPop needs none. SplitPop shows no advertising, and we neither sell personal data nor use it for advertising profiles.

We process personal data for these purposes only. The legal bases named are those of the GDPR; under the FADP we follow its principles of processing and, where a justification is needed, rely on the same purposes.

• Providing SplitPop — accounts, groups, expenses, payments, balances, chat, attachments, sharing, invitations, notifications, export and import, and the connector for AI assistants: performance of our contract with you (Art. 6(1)(b) GDPR).
• Keeping a group's records complete, including people who were added by others and have no account: our legitimate interest and that of the group's members in shared records that add up (Art. 6(1)(f)).
• Security and operation — sign-in, protection against abuse and spam, rate limits, logs, error reports, measurements of loading times and backups: our legitimate interest in a secure service that works (Art. 6(1)(f)).
• Answering your messages, bug reports and ideas, and improving SplitPop with them: our legitimate interest, or our contract with you where your request concerns your account (Art. 6(1)(f) and (b)).
• Complying with the law and establishing, exercising or defending legal claims: legal obligation and legitimate interest (Art. 6(1)(c) and (f)).
• Where we ask for your consent — for example the notification permission of the mobile app — your consent (Art. 6(1)(a)). You can withdraw it at any time, with effect for the future.

We make no automated individual decisions about you, and we do not use your data to train artificial intelligence models.

What you enter in a group is shared with that group. In detail:

• The members of a group see all of it: people, expenses, payments, balances, chat, activity and attachments, and each other's names and emojis.
• In a group's list of people, only its owners and admins see email addresses. Everyone who shares a group with you also sees your email address among their contacts, if SplitPop has one for you.
• Requests to join a group or to claim a name in it, with the name and email address given, are seen by the group's owners and admins, who decide on them.
• Your contacts are the people you share groups with. When you add a contact to another group, their name, emoji and email address become part of that group as well.
• A public group, or an expense published on its own, can be read by anyone with its link (see the next section).

A new group is public unless you choose otherwise. Anyone who has the link of a public group reads the whole group without an account: its name, the people in it (names and emojis, never email addresses), expenses, payments, balances, chat, activity and attachments — receipts and photos included, which they can download.

Software can read it too. AI assistants and other programs can read a public group through SplitPop's public tools without signing in, if they have its link. Public pages ask search engines not to index them, but a link can be passed on, and neither we nor you can control who receives it or what they do with what they read.

A private group's link shows only its name and a way to ask to join. If the group allows it, a single expense can still be published on its own; its page is then public in the same way.

Owners and admins can make a group private when creating it and at any time afterwards under Group settings → Visibility. Public access then ends at once, but copies somebody already made cannot be taken back. Anything that should not be public does not belong in a public group.

Groups often contain people who have no SplitPop account: a member adds them by name, sometimes with an email address, and records what they paid and what they owe. For these people we process their name, the emoji chosen for them, their email address if one was entered, and the entries, notes and messages that concern them. We use these details only for the group they were entered in and, when a member invites them, to send that invitation by email.

Whoever enters another person's details must be allowed to do so (see the Terms of Use).

If you find yourself in a group and do not want to be there, you can ask the member who added you to change or remove your details, claim your place in the group with your own account, or write to support@splitpop.app with the link of the group. We then remove your email address and replace your name with a neutral label within 30 days. The amounts stay, because the other members' balances depend on them, but they no longer identify you.

These providers process personal data on our behalf, only on our instructions and under agreements on data processing. Each entry says what they do and where.

• Hetzner Online GmbH, Germany

  Our servers: the database with all of SplitPop's data, the application backend, server logs and backups.

  Where: Nuremberg, Germany

  Privacy policy

• Cloudflare, Inc., USA

  File storage (Cloudflare R2) for attachments and for technical files of our database; name servers for splitpop.app.

  Where: Cloudflare's worldwide network

  Privacy policy

• Vercel Inc., USA

  Hosting and delivery of the website and web app, and measurement of loading times (Speed Insights).

  Where: Server functions in Frankfurt, Germany; pages delivered from Vercel's worldwide network

  Privacy policy

• WorkOS, Inc., USA

  Sign-in and account security (AuthKit), including the sign-in of the AI assistants you connect.

  Where: USA

  Privacy policy

• Resend, Inc., USA

  Sending emails: notifications, invitations and reminders.

  Where: Sent from Ireland (EU) through Amazon Web Services

  Privacy policy

• Functional Software, Inc. (Sentry), USA

  Error reports and session replays (see “Error reports and loading times”).

  Where: Stored in Germany (EU)

  Privacy policy

• 650 Industries, Inc. (Expo), USA

  Push notifications to the SplitPop mobile app, delivered through Apple or Google — only if you use the app and allow notifications.

  Where: USA

  Privacy policy

• Hostpoint AG, Switzerland

  Our email inbox, including support@splitpop.app.

  Where: Switzerland

  Privacy policy

We check that each provider protects personal data appropriately, and we update this list before we add or replace one.

Personal data also reaches:

• the other members of your groups and, for a public group, anyone with its link (see above);
• the AI assistants you connect, and the companies behind them (see “AI assistants”);
• authorities, courts and other parties where the law obliges us, or where it is necessary to establish, exercise or defend legal claims;
• a buyer or successor, if SplitPop is transferred or the company is merged, restructured or sold; this policy then continues to apply to your data.

Exchange rates come from the Frankfurter service (frankfurter.dev). Our server asks it for currency pairs only; those requests contain no personal data.

Our database runs in Germany. Switzerland and the EU recognise that Germany and the other states of the EU and the EEA protect personal data adequately.

Some of the providers above are based in the USA or process data worldwide. For these transfers we rely on the EU Standard Contractual Clauses, with the adaptations Switzerland requires, and, where a provider is certified, on the EU-U.S. Data Privacy Framework and its Swiss-U.S. counterpart. You can ask for a copy of these safeguards at support@splitpop.app.

When you connect an AI assistant, what it reads goes to the company behind it, wherever that company processes it.

You can connect SplitPop to an AI assistant such as Claude or ChatGPT, through SplitPop's connector at https://site.splitpop.app/mcp. Whether you connect one is your choice. The assistant then acts as you: it sees what you can see in SplitPop, with your role in each group, and can do only what you can do.

What an assistant reads leaves SplitPop. When you ask it something, it calls SplitPop's tools, and SplitPop sends it what those calls ask for — your groups, balances, expenses and payments, the people in them, their messages. When it adds or changes something for you, SplitPop stores that like an entry of yours, and the group's members are notified as usual. If you hand it a receipt or photo to attach, SplitPop downloads the file from the address the assistant gives — for ChatGPT, OpenAI's file storage — and keeps it as an attachment.

The company behind the assistant — for example Anthropic for Claude (privacy policy) or OpenAI for ChatGPT (privacy policy) — processes everything its assistant reads and writes as a separate controller, under its own terms and privacy policy, not on our behalf. We have no influence on what it stores or how it uses it, including whether your conversations are used to train its models. Check your assistant's settings before you connect it.

SplitPop itself does not use your data to train AI models, and hands data to an AI assistant only when that assistant asks for it on your behalf — or, for a public group, when an assistant reads it like any other visitor with the link.

What we keep about assistants: for every call, the name and version the client gives itself, the tool, how the call ended and how long it took — never what it sent or read, and never its access token. These records are deleted after 90 days. The result of each change an assistant makes is kept for 24 hours, with the key it sent, so that a repeated attempt does not write twice. When we refuse to download a file, we keep the name of the file's host — never the file's address, and never who asked.

You stay in control. On your profile, under Connected apps, you see what assistants did for you and can pause every assistant's access at once. To end a connection, remove SplitPop in the assistant's settings; its remaining short-lived access then expires within minutes. Without signing in, an assistant can read only public groups.

SplitPop uses only the cookies and browser storage it needs to work, or that remember your own choices. There are no advertising or tracking cookies.

• wos-session: keeps you signed in. Encrypted; set when you sign in and removed when you sign out.
• workos-access-token: hands your sign-in to a page as it loads; deleted straight away, and valid for 30 seconds at most.
• splitpop-sign-in: ties a sign-in to the browser that started it, so that nobody can sign you in to someone else's account with a link; set when a sign-in starts and kept for 10 minutes at most.
• Short-lived cookies of our sign-in provider that protect the sign-in itself.
• splitpop.locale: remembers your language, for one year.
• Browser storage: the group you opened last (removed when you sign out), the split you last used in each group, and your display currency. These stay on your device until you clear them.
• Tab storage for technical markers of the open tab, including the one our error monitoring uses to link a session replay to an error.
• An offline page kept by the app's service worker, so that SplitPop can tell you when you have no connection.

When something goes wrong, the website and app send an error report to Sentry: what failed, the address of the page, browser, device and the steps that led to it. A report carries no IP address: SplitPop does not add yours, and tells Sentry not to record the address a report arrives from. Sign-in codes, access tokens, cookies, invitation links and any search words in the page address are removed before a report is sent.

No visit is recorded for its own sake. For about one in ten visits in which an error occurs, Sentry also receives a session replay of the minute before the error: the layout of the page and how you moved through it — clicks, scrolling, page changes. Every text on the screen and everything you type is masked, and images and media are blocked, before the replay leaves your device, so a replay shows no names, amounts or messages. We use replays only to find and fix errors.

Vercel Speed Insights measures how fast pages load, without cookies and without identifying you.

We rely on our legitimate interest in a service that works (Art. 6(1)(f) GDPR). You can object at any time at support@splitpop.app; if you block these requests in your browser, SplitPop still works.

We keep personal data only as long as we need it for the purposes above, or as long as the law requires:

Your account

As long as it exists. When you delete it in the app, it is deleted at once; when you ask us to delete it, within 30 days.

Groups and their content: people, expenses, payments, chat, attachments, activity

As long as the group exists, because its members depend on these records. A group with nobody else in it at all is deleted with everything in it when its last member deletes their account; one with other people in it stays for them.

Deleted expenses and payments

Kept with the group, so that its owners and admins can restore them.

Deleted chat messages

The text is removed at once — and the text of all your own messages within minutes when you delete your account.

Removed attachments

The file within an hour; its name, type and size after 7 days.

People added by others

As long as the group exists, or until they are removed or anonymised on request (within 30 days).

Invitations

The link is valid for 7 days. Invitations never accepted are deleted 90 days after the link expired, including those withdrawn earlier.

Record of invitation emails sent

A hash of the address made with a key only SplitPop holds (not the address), the group, whether it was an invitation or a withdrawal, and the time. It serves only to limit SplitPop to 3 such emails a day to one address and one invitation a day per group and address. Deleted about 48 hours after sending.

Invitation opt-outs

If someone chooses “Don't e-mail me invitations” in an invitation email, we keep a hash of that address and the time, for as long as we need it so that we send no more invitations to it. The hash is made with a key only SplitPop holds: it cannot be read as an address, and without the key nobody can check an address against it. Because SplitPop can, we treat it as personal data. An opt-out made before 5 October 2026, or through a link sent before then, may still be kept under an earlier hash without a key until SplitPop is next about to email that address. Deleting an account does not remove it, because it belongs to an address, not an account.

Requests to join a group or to claim a name

Kept with the group, as part of its history of members.

Records of the notifications we sent

30 days, also for the copies our email provider's software keeps on our server; records of failed deliveries 90 days.

Email addresses that bounced or reported spam

As long as needed so that we do not write to them again.

Calls made by AI assistants

90 days, or until you delete your account.

Results of changes made by AI assistants, with their key

24 hours.

Bug reports and ideas

24 months, or until you delete your account.

Emails you write to us

24 months after the matter is closed.

Server and security logs

At most 90 days.

Error reports and session replays

At most 90 days.

Backups

At most 12 months, overwritten on a rolling basis.

Earlier versions inside the database

At most 48 hours after an entry is changed or deleted. Records we kept from moving the service to its current database in 2026, and import files of groups, are deleted by 31 March 2027.

Deleted data can remain in backups until they are overwritten. Backups are used only to recover from a failure; if we ever restore one, we delete such data again.

Where the law requires us to keep data for longer — for example business records, if SplitPop ever charges for something — we keep it for that period and use it for nothing else.

Under the FADP and, where it applies, the GDPR, you have the right to:

• access: find out whether we process data about you, and receive a copy of it;
• correction: have incorrect data corrected — you change your name and emoji on your profile yourself, and members correct the entries in their groups;
• deletion: have your data deleted, unless we must or may keep it;
• data portability: receive the data you gave us in a common machine-readable format — owners and admins download a group's ledger as JSON under Group settings → Import & export, and we send you everything else on request;
• objection: object to processing based on our legitimate interest, for reasons arising from your particular situation;
• restriction: have processing restricted while a request of yours is being examined;
• withdrawal of consent, at any time and with effect for the future;
• complaint to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of the country where you live.

Write to support@splitpop.app — from the email address of your account, if the request concerns it. We answer within 30 days and may ask you to confirm your identity.

You delete your account yourself, in the app: on your profile page, under “Delete account” (how it works: Delete your account). If you cannot sign in any more, write to us from the email address of your account, and we delete it within 30 days. Deleting your account deletes at once your account data, your sign-in, your notification settings, push tokens and push notifications, the access of the AI assistants you connected, and your name, email address and picture wherever you appear; within minutes it also deletes the record of the assistants' calls, your bug reports and ideas, and the text of your own chat messages with their attachments, the names of those attachments and your reactions. A group with nobody else in it at all — no other member, nobody else added to it, no invitation or request open — is deleted with everything in it. In groups with other people, the expenses and payments you took part in stay with their amounts, because the other members' balances depend on them, and so do the titles, notes and receipts you added to them; there you appear as “Deleted person”, with no name, email address or picture. A group you owned passes to its longest-standing admin or, without one, to its longest-standing member. A group with other people in it but no other member stays for them as an archive: it can be read (by its link, if it is public) and its ledger exported, without email addresses, by whoever can read it, but nobody can join it or change anything; only somebody accepting an invitation that was sent before the deletion becomes its owner and reopens it. An event sentence that the group's history kept from the earlier version of SplitPop, and that cannot be read as a structured record, may still contain your name; write to us and we remove it. Signing up again later with the same email address creates a new, empty account.

You choose which notification emails you receive in your notification settings, for all groups or group by group.

We protect personal data with technical and organisational measures that suit the risk: encrypted connections throughout, sign-in through a specialised provider, a permission check on every read and every write, servers that are reachable only through a firewall and only by authorised people with personal keys, limits against automated abuse, and regular security updates.

No system is completely secure. If a security incident is likely to put your rights at serious risk, we inform you and the authorities as the law requires. How to report a security problem to us is described in our security note.

SplitPop is not meant for children. You must be at least 16 years old to use it with your own account. If we learn that someone younger has an account, we delete it. Parents and guardians can write to support@splitpop.app.

Adults may record shared costs that concern a child, such as a family holiday. Enter no more than the group needs — a first name, for example.

We update this policy when SplitPop or the law changes; the date at the top shows the current version. If a change significantly affects how we process your data, we tell you in the app or by email before it takes effect.

Questions about this policy or about your data: support@splitpop.app. Our postal address is in the imprint.