Splitn – Privacy Policy
Last updated: 24 October 2026
1. Controller
The controller responsible for processing personal data in the Splitn app is:
VisionIT
Zuckerkandlgasse 48/2,
1190 Vienna, Austria
Email: developer@vision-it.at
For any questions about data protection and to exercise your rights, you can reach us at this email address.
2. What data we process
Splitn only processes the data needed to split expenses together.
| Category | Data | Required? |
|---|---|---|
| Account | Email address, username, password (stored only as a hash) or Google account ID when using “Sign in with Google” | Yes |
| Profile | First name, last name, phone number, profile picture, preferred currency and language | No (except currency/language, which are preset) |
| Groups and expenses | Group name and icon, members, expenses (description, amount, currency, date, who paid, split), settlement payments between members | Yes, to use the app |
| Notifications | Device token for push notifications and platform (Android/iOS) | No, only if you allow notifications |
| Technical data | Login sessions, request times, server logs for troubleshooting | Yes |
Other members of your groups can see your name, username, profile picture and the shared expenses and balances. Your email address and phone number are not shown to other users. Other users can only find you by your username, your exact email address or your QR code.
On your device, the app stores your login (encrypted), your settings and a copy of your profile so that the app starts faster.
3. Purposes and legal bases
We process your data to provide you with the app and rely on the GDPR to do so.
| Purpose | Legal basis |
|---|---|
| Creating an account, signing in, managing groups and expenses, calculating balances | Performance of a contract (Art. 6(1)(b) GDPR) |
| Emails with verification and password reset codes | Performance of a contract (Art. 6(1)(b) GDPR) |
| Push notifications about new expenses and settlement requests | Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in your device settings |
| Security, abuse prevention and troubleshooting (server logs) | Legitimate interest (Art. 6(1)(f) GDPR) |
| First name and expenses remain visible in shared groups after an account is deleted (see section 6) | Legitimate interest of the other group members in correct settlements (Art. 6(1)(f) GDPR) |
We do not use your data for advertising, we do not sell it and we do not create profiles about you.
4. Recipients and processors
We use the following service providers to operate the app. Data processing agreements under Art. 28 GDPR are in place with all of them.
| Service | Provider | Purpose | Data location |
|---|---|---|---|
| Render | Render Services, Inc., USA | Running the app server | Frankfurt |
| Supabase | Supabase, Inc., USA | Database with account, group and expense data, storage for profile pictures | EU (Ireland) |
| Firebase Cloud Messaging | Google Ireland Ltd. / Google LLC | Delivery of push notifications | EU/USA |
| Google Sign-In | Google Ireland Ltd. / Google LLC | Signing in with a Google account, only if you choose this option | EU/USA |
| Resend | Resend, Inc., USA | Sending emails with verification and password reset codes | USA |
Other members of your groups receive the group data listed in section 2. Beyond that, we only share data if we are legally required to do so.
5. Transfers to third countries
Some of the providers listed are based in the USA, so data may be transferred there. Such transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
The database with your account, group and expense data is located in the EU (Ireland).
6. Retention period and deleting your account
We store your data for as long as your account exists. You can delete your account at any time in the app under “Delete account” or request deletion by email to developer@vision-it.at.
When your account is deleted:
- Deleted: email address, last name, phone number, profile picture, password, Google sign-in data, all login sessions and device tokens for notifications. It is no longer possible to sign in with this account.
- Retained: your first name (or username) with the suffix “(deleted)” as well as your expenses and settlement payments in groups where other members are still active. Without this information, the other members' settlements and balances would be wrong.
- Completely deleted: groups with no active member left after your deletion, including all their expenses.
Server logs are deleted automatically after [number] days. Statutory retention obligations remain unaffected.
7. Permissions on your device
The app only requests the permissions a feature needs, and only when you use that feature.
| Permission | Used for |
|---|---|
| Camera | Scanning other users' QR codes to create a group; optionally taking a profile photo |
| Photo picker | Choosing a profile picture. The app only sees the photo you select, not your entire gallery |
| Notifications | Alerts about new expenses and settlement requests |
| Internet | Connecting to the Splitn server |
You can revoke these permissions at any time in your device settings.
8. Your rights
You have the right at any time to:
- Access the data stored about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR), subject to the restriction for shared groups described in section 6
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing based on our legitimate interest (Art. 21 GDPR)
- Withdraw consent with effect for the future (Art. 7(3) GDPR)
To do so, write to us at developer@vision-it.at. You can also lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
9. No advertising, no tracking
Splitn contains no advertising, no analytics or tracking services and no social media plugins.
Minimum age: The app is intended for people aged 16 and over. We do not knowingly process data of children under 16 without the consent of their parents or guardians.
Changes: If the app or the services we use change, we will update this privacy policy. You can always find the current version at www.vision-it.at/en/app/splitn/datenschutz.