Privacy Policy

Information we collect

• Account information. Your name, email address, and a securely hashed password (we never store your password in plain text). If you sign in with Google, we receive your Google account identifier, email, and name.
• Expense and group data. The groups, friends, expenses, splits, settlements, comments, and balances you create — including amounts, currencies, dates, categories, and the people you share them with.
• Receipt images. If you use receipt scanning, the images you upload and the details extracted from them.
• Payment information. If you subscribe to Pro, billing is handled by Stripe. We receive limited billing metadata (such as your subscription status and a Stripe customer identifier); we do not receive or store your full card number. Optional "payment links" (e.g. a PayPal or Venmo username) you add to settle up are stored as you enter them.
• Technical and usage data. Limited data needed to operate the Service, such as a one-way hashed form of your signup IP address used to deter referral abuse, and minimal logs for security and reliability.
• Cookies. We use a single, essential session cookie to keep you signed in and a cookie to remember your light/dark theme preference. We do not use advertising or cross-site tracking cookies.

How we use information

• to provide, maintain, and secure the Service;
• to calculate balances and convert currencies using rates recorded on the date of each expense;
• to process receipt images into expense details when you use that feature;
• to process subscriptions and prevent abuse of referrals and rate limits;
• to send transactional emails you've enabled (such as password resets, group invitations, and activity notifications) — you can turn off notification emails in your account settings;
• to comply with legal obligations and enforce our Terms.

We do not sell your personal information, and we do not use it for third-party advertising.

Service providers

We share data with a small set of processors only as needed to run the Service:

• MongoDB Atlas — database hosting for your account and expense data.
• Amazon Web Services (S3) — storage for receipt images.
• Stripe — subscription billing and payment processing.
• Google — optional single sign-on, if you choose it.
• Anthropic — AI processing of receipt images you upload, to extract expense details.
• BuiltWithHeart — delivery of transactional email.

These providers process data on our behalf under their own terms and security commitments.

Data about other people

When you add a friend or invite someone to a group, you may provide their name or email so we can connect your shared expenses. Please only share information you're entitled to share. If someone you've added later creates their own account with that email, their existing shared records may be linked to their account.

Your rights and choices

You can view and update your profile, manage notification emails, and control your subscription from your account settings. You can also:

• Export your data — download a machine-readable copy of your account and expense data from your account settings.
• Delete your account — request deletion from your account settings. To preserve the integrity of shared balances for other members of groups you participated in, we remove or anonymize your personal information (name, email, sign-in credentials, and payment links) while retaining the minimal shared expense records needed by those other members. After deletion you can no longer sign in.

Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA, including rights of access, correction, deletion, and portability. To exercise these, use your account settings or contact us at privacy@makeiteven.com.

Data retention

We keep your information for as long as your account is active or as needed to provide the Service. When you delete your account, we remove or anonymize your personal information as described above. Some records may be retained where required by law, to resolve disputes, or to enforce our agreements.

Security

We protect your data with measures including encrypted transport (HTTPS), strong password hashing (argon2id), signed session cookies, server-side access controls on every request, and rate limiting on sensitive actions. No system is perfectly secure, but we work to keep your data safe.

International transfers

We and our providers may process data in countries other than the one you live in. Where required, we rely on appropriate safeguards for such transfers.

Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information.

Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify you, and we will update the "Last updated" date above.

Contact

Questions about your privacy? Email us at privacy@makeiteven.com.