Privacy Policy

This policy covers the Splitmate Android app, the groups-only web client at web.splitmate.quizuncle.com, and this website. It is written in plain English because the honest version is short. “We” means Quizuncle, the indie studio behind Splitmate; “you” means whoever is using the app.

In short

This website

splitmate.quizuncle.com is a set of static files served by Firebase Hosting, which is Google. There are no analytics, no tracking pixels, no embedded videos, no web fonts loaded from anyone else and no third-party scripts of any kind: no page here fetches anything from another company, before or after you interact with it, and there is no script on this site capable of sending anything anywhere.

That paragraph is about splitmate.quizuncle.com and nothing else. web.splitmate.quizuncle.com is a separate site running a groups-only application rather than a set of pages, and it does load a Google script — see the web client. Keeping the two apart matters here more than anywhere: a promise about scripts is worth nothing if it quietly covers a second hostname where it is not true.

One thing does leave, and only if you ask it to. The home page carries a form for being told when Splitmate has a public release. The email address you type into it is sent to this same domain — not to a mailing-list company, not to a form service — and only when you press the button. Typing in the box sends nothing; leaving the page sends nothing. What we then do with the address is the next section, and it is the only personal data this website collects.

There is one cookie, and it is a preference rather than a tracker: qu_theme, whose entire value is the word dark or light. It records whether you asked for the light or the dark version of this page. It is scoped to .quizuncle.com so the same choice applies on quizuncle.com and the other Quizuncle sites — that sharing is the only reason it is a cookie rather than localStorage, which is kept separate per subdomain. It holds no identifier, it is not used to recognise you, and no server does anything with it. Clear your cookies and it is gone, after which the site follows your operating system’s light or dark setting.

Google, as the hosting provider, processes ordinary web server logs — your IP address and your user agent — in order to send you the page. That happens under Google’s own privacy policy, and we add nothing of our own on top of it.

The notify list

This is the one place where this website collects something about a person, so it is set out in the same detail as the app. It has nothing to do with the app on your phone: no Splitmate install is involved, no group is involved, and being on this list is not an account.

What is stored. Three things, and they are the whole record:

• the email address you typed;
• the moment our server received it;
• a short label recording which form it came from.

Nothing else is attached to it. Not your IP address, not your browser’s user agent, not the page you arrived from, and no cookie or identifier of any kind. The form does carry one extra field, hidden from view and meant to stay empty, whose only job is to catch automated submissions; a submission that fills it is discarded and never written down.

Where it is stored. In the same Firebase Realtime Database operated by Google in the asia-southeast1 region (Singapore) that the app uses, under a top-level key of its own. It sits beside the group data described below rather than inside it: no group can see it and it is not part of any group’s records.

Who can read it. No client can — not this website, not the app, not a stranger with a browser and the address of the database. The security rules deny reads and writes on that path outright, and the only thing that reaches it is server-side code running with administrative access, which the rules do not apply to. There is no page anywhere, public or private, that lists these addresses.

How long it is kept. Everything else on this page says that we do not delete things. This is the exception, and it is a promise rather than a description of something automatic — nothing expires this list on a schedule, so whoever sends the launch email is the one who has to honour it:

To come off the list before then, email splitmate@quizuncle.com and say so. It is listed on the data deletion page alongside everything else we can remove.

The web client

web.splitmate.quizuncle.com is a second Splitmate client, and a groups-only one. Everything it can open belongs to a group you are already in: creating one or joining one, expenses and splits, balances, settlements, members, that group’s own spending charts, and its conversation. There is no personal ledger in it — the expenses you log as Just me live in a database on the phone and have no copy on any server for this client to read — so a good deal of what the rest of this page describes simply does not arise there. It is served by Firebase Hosting, the same as this site.

Signing in with Google is required, and that is a real difference from the phone. There is no anonymous route in: a browser cannot usefully hold the per-install anonymous identity described under who Splitmate thinks you are, so Google is the only door. When you use it, Firebase Authentication holds the same provider record it holds for the app — your Google email address, your Google display name and the URL of your Google profile picture — and the same limits apply: we receive an ID token and nothing else, and Splitmate never asks for access to your Gmail, your contacts or your Drive.

It is groups only on the wire, too. The client touches three top-level keys as a matter of course — /groups, /invites and /userGroups — in the same asia-southeast1 Realtime Database the phone uses, which is why a group you join in the browser is the same group on the phone. It never touches the personal-ledger backup path, because there is no personal ledger here to put in it.

Chat is the exception, and it is the same chat data the phone writes. Opening a group’s conversation reads and writes /chats/{chatId} — its meta, its members, its messages, and your own delivery marker under recv — along with /userChats/{uid}, which is your own index of the conversations you are in. Blocking somebody writes /blocks/{uid}, which can only be read by you. Reporting a message writes /reports, and what it writes is a copy of the message text, not a pointer to it, so that a report stays readable to us even if the message is deleted afterwards. Every one of those rows is described in what is uploaded, and none of it is new data — it is the same tree the Android app has always written, now written from a second place.

A conversation is fetched in pages, not in one go. Opening one asks the database for the most recent 50 messages; anything older is read a page at a time, and only when you ask for it. That is a description of what gets downloaded and when rather than a privacy promise — the older messages are on the server either way — but it is the honest answer to “what did that browser actually download”.

It can be notified, and that is the other thing it writes outside those three keys. Turning notifications on from the Me tab — the only thing that starts it, since nothing is requested when the page loads — stores this browser’s notification token at /pushDevices/{uid}/{deviceId}, with the word web and a timestamp beside it. The device id is a random value the browser generates and keeps for itself; nothing about it is derived from your machine, your screen or anything else that would identify you. It can only be read by you, and the Cloud Function reads it with administrative access in order to send. What then arrives is the same fan-out a phone receives, which means a notification about a chat message carries the message text — see notifications. Tapping one opens Splitmate rather than the conversation it is about, because the chat fan-out’s link still points at the site root.

It loads Google reCAPTCHA v3, which no page on splitmate.quizuncle.com does. It runs on every page of it and reports signals about the browsing session to Google, under Google’s own privacy policy. It feeds Firebase App Check, which is wired into both clients — reCAPTCHA v3 here, Play Integrity on Android — and which is not enforced on any Firebase service. No request is refused for want of a token. What decides who may open a group is the same thing it has always been, the server-side rules under who can read it.

Nothing there counts what you do. Unlike the Android app, which now carries Firebase Analytics and Crashlytics, the browser client loads Firebase Authentication, the Realtime Database, Firebase Cloud Messaging (and that only once you turn notifications on) and the reCAPTCHA script above, and nothing else. No analytics, no crash reporting, no advertising SDK, and no cookie of its own.

Everything else on this page applies to it unchanged. A group created or joined there is stored exactly as what is uploaded describes, kept for as long as how long it stays says, and removed by the same routes in deleting your data. Signing out ends the session on that device and removes nothing from the server.

On your phone only

The app keeps its own database in Android’s private per-app storage. It holds everything you have entered: your personal ledger, every group you are in, member names and pictures, the expenses and settlements in each group, a local copy of each chat, your display name, your chosen currency, your theme, and the invite code of any group you have shared. Android does not give you a file path to it and other apps cannot read it.

An expense you log as Just me stays on your phone only, unless you turn on backup. It is not part of any group, and by default no code path in the app uploads one. With that switch left off — which is how it starts — this is a deliberate design choice and it has a real cost: uninstalling the app, clearing its data, or losing the phone destroys those expenses, and neither you nor we can get them back. If you are not backing them up and they matter to you, write them down somewhere else as well. The switch itself, and what turning it on changes, is the next section.

The app also keeps its own picture file for your avatar, and the Firebase client keeps a disk cache of group data it has already synced, so a group you have opened before still works with no connection. Both live inside the same private storage and both go when the app’s data goes.

Backing up your personal ledger is optional, and off by default

Settings has a switch called Back up your personal expenses, and it starts off for everyone. Leave it off and the previous section is the whole story: your Just-me expenses live only on this phone. Turn it on and each one is copied to the same Firebase Realtime Database in asia-southeast1 that group data uses — under a path of its own, not inside any group, encrypted in transit the same as everywhere else on this page, and readable only by you. No other member of any group can see it, and it is not part of any group’s records.

Turning the switch on also copies whatever Just-me history you already had, not only what you add afterwards, so switching it on late still backs up what came before. Turning it off asks a second question — keep the stored copy, or delete it too — and choosing delete removes it from the server outright. Either way, your expenses stay on this phone the entire time; the switch only ever decides whether a second copy also exists on the server.

What is uploaded

Creating or joining a group is what starts an upload. From that point on, that group’s records sync to a Firebase Realtime Database operated by Google in the asia-southeast1 region (Singapore). This is the complete list of what is written there and what each entry holds. Two other things can also leave your phone — the optional personal-ledger backup just above, and the analytics and crash reports described further down — but nothing besides those three ever sends anything anywhere.

Who can read it, and who cannot

Server-side security rules stand in front of every path above. A group’s records can only be read by a device holding an entry under that group’s auth node, which is created by presenting the group’s invite code. A group’s chat thread is gated on that same entry, whichever of the two clients you opened it in. Your group index and your notification token can only be read by you. Everything outside those paths is denied by default, and nothing anywhere in the tree can be listed or enumerated by a stranger.

Traffic between the app and the database is encrypted in transit. That is not the same claim as end-to-end encryption, and this is the part worth reading twice:

Who Splitmate thinks you are

There is no signup, no email address, no password and no phone number, and there is no user directory, so nobody can search for you or find you by name.

That is not the same as having no identifier, and the difference matters. The first time the app needs the network it creates a Firebase Anonymous Auth identity — an anonymous account, generated per install, consisting of nothing but a random user id. That id is what every security rule checks, what a group’s auth entry is keyed to, and what your notification token is filed under. Nothing about you is attached to it: it carries no name, no address and no device identifier, and it is not shared with anybody outside the paths in the table above.

Because it belongs to the install rather than to you, clearing the app’s data or uninstalling the app ends it. A fresh install is a different anonymous identity, with no way back to the groups the previous one was in.

The web client has no anonymous identity at all. There is no install for one to belong to, so signing in with Google is the only route in there — required in the browser, optional on the phone. See the web client.

Signing in with Google is optional

The one thing that changes that is the optional Back up your identity row in Settings, and the Restore with Google button during onboarding. Signing in attaches your Google account to the same anonymous identity, so that a reinstall can pick it up again and find your groups and chats. It is used for backup and restore, and for nothing else.

When you use it, Firebase Authentication — Google — holds a provider record alongside the identity: your Google email address, your Google display name and the URL of your Google profile picture. We do not copy any of that into the group database, and it is never shown to other members. Your personal ledger is not part of this backup, because it was never uploaded in the first place.

We only receive an ID token from the sign-in. Splitmate never asks for access to your Gmail, your contacts, your Drive or anything else in your Google account.

Notifications

Splitmate sends two completely different kinds of notification, and only one of them involves a server at all.

• Settlement reminders are local. The app schedules them on your own phone with Android’s alarm service. Nothing is sent to a server, nobody else is told, and the person being reminded is you.
• The rest go through Google. Three things raise one: a message sent in a chat, an expense added to a group, and somebody leaving a group. In each case a Cloud Function reads the participant or member list, looks up each recipient’s notification token, and hands the notification to Firebase Cloud Messaging for delivery. They are addressed to a person rather than to a device, so every device that person has registered receives them — their phone, and a browser they have turned notifications on in.

Deleting a message raises no notification: the fan-out only runs when a message is first created. A notification already delivered to someone’s phone is out of our reach, and deleting the message does not recall it.

Your notification token is written to /pushDevices/{uid}/{deviceId}, one entry per device, so a phone and a browser can both be registered at once without displacing each other. Older installs of the app still use /pushTokens/{uid}, which held a single token, and both are read when a notification is sent. Either way it can only be read by you. The Cloud Function reads it with administrative access in order to send; no other user can. A token that Google reports as dead is deleted automatically.

Android permissions

The app declares three permissions of its own, and inherits a fourth from the component that scans invite codes. It asks for nothing else, and it never asks for a permission at launch.

• Internet. Required for group sync, chat, notifications and the optional Google sign-in. Nothing else in the app uses the network.
• Notifications. Requested in context, never on first launch: the first time you open a chat thread, and the first time you set a settlement deadline. Decline it and the rest of the app carries on working.
• Run at startup. Used for one thing only. Android clears every scheduled alarm when the phone restarts, so this lets the notification component put your own settlement reminders back on the schedule. It runs no app code and sends nothing.
• Camera. Used when you scan a QR code to join a group, and when you take a new profile picture for yourself instead of choosing an existing one. Both are handled on the phone; the camera is never opened in the background.

Alongside those, the Firebase and notification components add the ordinary supporting permissions Android grants without asking — network state, wake lock, vibrate and message receipt. None of them reads anything about you.

Analytics and crash reports

The app uses two Google Firebase services with no equivalent above: Firebase Analytics and Firebase Crashlytics. Both start the moment the app opens, in every release build, and there is no in-app switch to turn either one off yet.

Analytics logs seven events, and that is the complete list: finishing onboarding, creating a group, sharing an invite, opening an invite, joining a group, adding an expense, and settling up. Only adding an expense carries anything beyond the event itself, and what it carries is a single yes-or-no flag for whether the expense was in a group or logged as Just me. No event carries an amount, a name, a description, a note, a message, or a group’s name — that is a property of the seven calls that write these events, not a promise about ones that might be added later.

Crashlytics collects a report when the app fails unexpectedly, so bugs can be found and fixed. It is built to hold a stack trace and information about your device, not anything you typed — but we do not promise it is always completely clean of your input: an error message raised from deep inside the phone’s own storage layer can occasionally carry a fragment of the text that caused it. Treat a crash report as usually free of anything you typed into the app, not guaranteed free of it.

Both services run on Google’s own SDKs, which attach some device-level context of their own by default — a Firebase installation id, your device model, its OS and app version, and a coarse region worked out from your IP address. The app’s own code does not add a name, an email address or any identifier of yours on top of that; nothing in it calls the functions that would.

The advertising identifier is not collected. Firebase Analytics normally pulls in the Android permissions needed to read it; this app removes all three of them from its manifest by name and turns off ad-ID collection in the SDK itself, so no advertising identifier is ever read, let alone sent anywhere.

What we never collect

This is a list of things the app does not do, and it is provable rather than promised: none of the code that would do them is in the app at all. Analytics and crash reporting used to be on this list; they no longer are — see analytics and crash reports just above for what changed and exactly what each one collects.

• No advertising. No ad network and no ad-mediation SDK. The advertising identifier is explicitly not collected either — see analytics and crash reports for how. The app shows no advertising and never will while it has no code that could.
• No billing. No payment library of any kind. Splitmate cannot take money and does not know how to, and it never moves money between people either — a settle-up is a record of a payment you made somewhere else. See the terms.
• No location, no contacts, no calendar, no microphone, no files. The app does not ask for any of them and could not read them if it did.
• No selling and no sharing. We do not sell your data, we do not share it with advertisers or data brokers, and we run no profiling and no automated decision-making on it. The only third party involved is Google, as the provider of the hosting, the database, the sign-in, the notification service, and now the analytics and crash-reporting tools described above.

How long it stays

The honest answer is the uncomfortable one, so here it is plainly.

Group data is kept until it is removed on request. There is no expiry, no retention window and no scheduled clean-up: nothing in the app deletes a group’s records from the server, ever. Deleting an expense inside the app marks it as deleted for every member, which is what makes the deletion travel between phones — but the entry it marks, including its description, its amount and its note, stays on the server behind that marker. The same is true of a member entry that has been removed. The route that actually erases data is the email request on the data deletion page, and it is the only one.

We could have written a number here. We have not, because the app does not honour one, and a retention period a system does not enforce is a false claim rather than a policy. If a scheduled clean-up is ever built, this section changes and the effective date moves with it.

An invite code never expires. The entry that maps a code to its group is written once, when the group is first shared, and nothing in the app removes it or replaces it. A code therefore goes on resolving to its group indefinitely — after everyone has stopped using the group, and after the group has been marked deleted. The app cannot rotate a code or withdraw one. Treat any code you hand out as permanent, and hand it only to people you want in the group.

Your notification token is overwritten each time it changes and is deleted automatically when Google reports the device unreachable. Server logs at the hosting layer are Google’s and are kept under Google’s own policy.

The notify list is the one thing on this page with an end date on it, and the difference is deliberate: it holds an email address rather than a shared group’s history, so nothing else’s arithmetic breaks when it goes. The notify list states the commitment in full.

Deleting your data

There are five routes, and they remove different things. The data deletion page sets each one out in full, with a table showing which route removes which data. In summary:

1. Clearing the app’s data or uninstalling it removes everything held on this phone, including every Just-me expense. It removes nothing from the server.
2. Deleting your account yourself is in both clients, and they are not the same deletion. On the phone it also removes your personal-ledger backup and marks you as having left every group, so you drop out of their balances. In the browser there is no personal ledger to remove, and your member row is deliberately left standing, so groups you shared go on seeing your name where it already is. Neither removes expenses, settlements or chat messages inside those groups — those stay, visible to everyone still in them, and nobody can remove them afterwards. Both are set out side by side.
3. Removing a member, or leaving a group yourself takes that person out of the balances and out of new splits. Neither reaches their phone, and their name and profile picture stay in the group’s records. Both clients refuse to let you leave while you still owe money. Where they differ is the other direction: the browser also refuses when money is owed to you, while the phone warns and lets you decide, on the grounds that walking away from your own credit is your own call. Leaving a group explains it.
4. Delete for everyone on your own chat message erases the text on the server for every participant, leaving only an empty marker in its place.
5. Emailing us at splitmate@quizuncle.com reaches what deleting your account cannot — your name and picture in a group you shared, and a whole group’s own records. Read the deletion page before you send it — it explains what to include, and why sending it before you clear the app’s data or delete your account matters.

The notify list is outside all five, because it is website data rather than app data and no install is involved in it: coming off it is a one-line email to the same address, and it is deleted after the launch anyway. See the notify list.

Children

Splitmate is not for anyone under 18. It is not directed at children, we do not knowingly collect anything from them, and a person under 18 should not create a group, join one, or put their name, picture or messages into the app. If you believe someone under 18 has done so, email splitmate@quizuncle.com and we will remove what we can identify.

Your rights

You can ask us what we hold about you, ask for it to be corrected, and ask for it to be erased. Because Splitmate has no login, an anonymous identity is all we have to match a request against, so the deletion page explains what to include to make yourself identifiable. There is no advertising and no profiling to consent to; see analytics and crash reports for what the app's analytics and crash reporting carry instead, and the data described on this page is what the app needs in order to show a shared group to the people in it.

We are a small studio in India, and this policy is governed by Indian law — see the terms. If something here does not answer your question, ask us rather than guessing.

Changes to this policy

When this policy changes, the effective date at the top and bottom of this page moves. If a change alters what leaves your phone, or who can read it, we will say so here in words rather than only moving the date.

What changed on this date. Splitmate gained a second client you use in a browser — groups only, Google sign-in required, online-only — and this policy gained a section for it. It adds no new kind of data: it writes the same group records the app writes, to the same database. It does add one processor and one requirement, and both are named there — Google reCAPTCHA v3 runs on every page of it, and there is no anonymous way in. Nothing about the Android app or about what it collects changed with it.

Contact

Questions about any of this, and requests to delete your data, go to splitmate@quizuncle.com. A real person reads it.

Effective 22 August 2026. See also the terms of use and how to delete your data.