Privacy Policy

1. Overview

SplitBank ("we", "us", "our") is an expense-splitting application that helps individuals track and settle shared expenses. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our service at splitbank.app and related subdomains (the "Service").

By using SplitBank, you agree to the practices described in this policy. If you do not agree, please do not use the Service.

2. Information We Collect

Account information

When you create an account, we collect your name. An email address is optional: if you sign up with email we also store a hashed password, and if you sign in via Google we receive your name, email address, and profile photo from Google. If you use a passkey, we store only its public key and the device name it was created on — your fingerprint, face and device PIN never leave your device. Recovery codes are stored only as a one-way hash.

Bank account data (via Teller)

SplitBank uses Teller, Inc. ("Teller") to connect to your bank accounts. When you link a bank account, Teller provides us with:

• Account names, types, and last-four digits of account numbers
• Transaction history: merchant name, amount, date, and category
• An encrypted access token that allows us to retrieve this data on your behalf

We never receive or store your bank login credentials. Your bank credentials are entered directly into Teller's secure interface and are never transmitted to our servers. Teller's access tokens are encrypted at rest using AES-256-GCM encryption.

Statements you import

When you import a card or bank statement, the file is read on your own device and is never uploaded to or stored on our servers. A statement password, if you enter one, is used only to open the file on your device. We store only the transactions you choose to import (date, description and amount) and the card or account they belong to (a name, its type and the last four digits, if shown on the statement).

Receipt photos

When you scan or attach a receipt, the text is read on your device. A reduced-size copy of the photo is stored with the expense so that everyone on that expense can view it. It is deleted when you remove it or delete the expense.

Notifications

If you turn on push notifications, we store the delivery address your browser gives us for that device (and a short device name, such as "iPhone · Safari"). Notifications are delivered through your browser's push service (for example Apple, Google or Mozilla) and contain a short summary, such as who added an expense and how much you owe. You can turn them off at any time in Account, and a device that removes permission is removed automatically.

Expense and split data

We store the expenses, splits, and group information you create within the app, including amounts, descriptions, participants, and payment status.

Payment handle information

You may optionally provide your Venmo username, Cash App handle, Zelle phone/email, or PayPal email so group members can send you payments. This information is stored in your profile and visible to users who share splits with you.

Usage data

We may collect standard web server logs including IP address, browser type, and pages visited for security and debugging purposes. We do not use third-party advertising trackers.

3. How We Use Your Information

• To provide and operate the Service (displaying your transactions, splits, and balances)
• To authenticate your identity and maintain session security
• To sync your bank transactions when you request it
• To allow group members to see balances and payment handles needed to settle up
• To send transactional emails (password resets, if applicable)
• To investigate security incidents and prevent fraud

We do not sell your personal information. We do not use your financial data for advertising or share it with data brokers.

4. How We Share Your Information

With other users

Users who are members of the same group can see your name, email, payment handles, and split amounts, and the receipt photo on any expense they are part of. They cannot see your bank account details, imported statements or full transaction history.

With service providers

• Teller, Inc. — provides bank connectivity; subject to Teller's Privacy Policy
• Supabase — hosts our PostgreSQL database in a secured, encrypted environment
• Vercel — hosts the application; subject to Vercel's privacy policy
• Your browser's push service (Apple, Google or Mozilla) — delivers push notifications, only if you turn them on

Legal requirements

We may disclose information if required by law, court order, or to protect the rights and safety of SplitBank, our users, or the public.

5. Data Security

We implement industry-standard security measures including:

• TLS encryption for all data in transit
• AES-256-GCM encryption for Teller access tokens at rest
• Bcrypt hashing for passwords (never stored in plain text)
• Row-level security policies on our database
• Rate limiting on authentication and data-import endpoints

No method of electronic storage or transmission is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security.

6. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal information and transaction data within 30 days, except where we are required to retain it by law.

You may request deletion of your account by emailing us at the address below.

7. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Request deletion of your account and associated data
• Export your data in a portable format
• Disconnect your bank accounts at any time from the Account tab

To exercise these rights, contact us at the email address in Section 9.

8. Children

SplitBank is not intended for users under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has provided us with their information, contact us and we will delete it promptly.

9. Contact

Questions about this policy or your data can be directed to:

SplitBank
Email: jugaltsanghvi@gmail.com

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the date at the top of this page and, where appropriate, by email. Continued use of the Service after changes constitutes acceptance of the updated policy.