Privacy Policy

1. Scope

This Privacy Policy describes how Ownsplit ("we", "us") collects, uses, stores, and shares personal data when you use Ownsplit (the "Service") through our websites and related online services that link to this policy.

If you do not agree with this Policy, do not use the Service.

2. Overview — how the Service works

Ownsplit is designed as a shared ledger: when you record or share expenses and balances, people you choose (for example group members) may see related details according to how the product works and the permissions you (and they) use.

You decide what you enter and with whom you share it. You are responsible for not including sensitive personal data about others beyond what is reasonably needed, and for complying with applicable privacy laws when you invite others or add their information.

3. Data controller

The controller of your personal data is Ownsplit.

Contact: support@ownsplit.com.

4. Data we collect

We may collect:

• Account data: email, display name or username, authentication identifiers, and similar registration data.
• Expense and ledger data: amounts, descriptions, categories, currency, splits, groups, comments, and attachments you choose to upload (for example receipt images).
• Technical data: IP address, device and browser type, app or site version, approximate location derived from IP where not more precise, diagnostic logs, and security-related signals.
• Support and feedback: information you send when you contact us or respond to surveys.
• Cookies and similar technologies on our website: strictly necessary session or security cookies as needed to operate the site. If we introduce optional analytics or marketing cookies, we will describe them here and obtain consent where required.

5. How we use data and legal bases

We process personal data to:

• Provide the Service (create and maintain your account, sync data you save, display shared information to people you connect with) — contract and, where the law requires it, consent for specific optional features.
• Secure the Service (prevent abuse, fraud, and attacks; monitor errors) — legitimate interests and, where applicable, legal obligation.
• Communicate with you (service messages, security alerts, responses to support) — contract / legitimate interests.
• Improve the product (understand usage in aggregate, fix bugs) — legitimate interests, and where required consent (for example for non-essential cookies or marketing).
• Comply with law (respond to lawful requests, comply with retention or reporting duties) — legal obligation.

Where we rely on legitimate interests, we balance our interests against your rights. You may object to certain processing as described below or under applicable law.

6. Sharing and processors

We share personal data only as needed to run the Service:

• Other users — according to the sharing and group features you use (for example group members seeing shared expenses).
• Infrastructure and service providers (for example hosting, email delivery, database or authentication providers such as Supabase if used, error monitoring) under data-processing agreements or equivalent safeguards.
• Authorities or third parties when required by law, regulation, legal process, or to protect vital interests, rights, and security.

We do not sell your personal data. We do not use it for third-party marketing beyond what you explicitly agree to, if we offer such options in the future.

7. International transfers

If we transfer personal data outside the European Economic Area, the United Kingdom, or Switzerland (as applicable), we will use appropriate safeguards required by applicable law (for example Standard Contractual Clauses approved by the European Commission or equivalent mechanisms), unless another lawful derogation applies.

8. Retention

We keep personal data only as long as necessary for the purposes above, including security, dispute resolution, and legal compliance. When you deactivate your account, it is deactivated immediately. If you do not reactivate, 30 days after deactivation we permanently and irreversibly remove your account and the personal data we hold for it, subject to technical limits and copies retained in other users' ledgers where information was shared (for example a shared expense may remain visible to others as part of their history without your contact details, depending on product behaviour).

For how to deactivate your account, see Section 9 and our dedicated Account deactivation page.

9. Your rights

Depending on where you live, you may have the right to access, rectify, erase, restrict processing, data portability, and to object to certain processing, and to withdraw consent where processing is based on consent.

To exercise your rights, email support@ownsplit.com.

Account deactivation: Account deactivation

You may also lodge a complaint with a supervisory authority in your country.

10. Children

The Service is not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal data from children below that age. If you believe we have, contact support@ownsplit.com and we will take appropriate steps.

11. Security

We use appropriate technical and organizational measures to protect personal data. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

12. Changes to this Policy

We may update this Policy from time to time. We will post the new version here and change the "Last updated" date.

Unless applicable mandatory law requires a different process or notice period, updates take effect immediately when posted. If we make material changes, we will also use reasonable additional notice where required (for example a prominent notice or email). Continued use of the Service after the effective time indicates that you acknowledge the updated Policy, subject to any stricter consent rules that apply to specific processing.

13. Contact

Privacy questions: support@ownsplit.com.