Privacy Policy

Who is responsible for your data

Couplesplit is developed and operated by Erik From, an independent developer based in Chile, who is the controller of your personal data. For anything about privacy, including access and deletion requests, write to [email protected].

In short

• We do not sell your data, we do not show ads and we do not track you across other companies’ apps or websites.
• We never ask for your bank password and we never connect to your bank.
• Your partner sees what is in Ours. What is in Mine is for you only.
• You can delete your account from the app at any time.

What we collect and why

• Account. Your name, your email address and how you sign in (Sign in with Apple, Google Sign-In or a one-time code sent to your email), plus an internal user ID and household ID. We use them to create your account, sign you in and link you with your partner. With Sign in with Apple’s “Hide My Email” we receive Apple’s relay address instead of your email.
• Profile photo (optional). If you add one, it is stored with your profile and shown to your partner.
• Expenses and household finances. Amounts, currencies, categories, titles, notes, dates, who paid and how it is split, installments, recurring and fixed payments, bills, trips, settlements, budgets and limits, comments between partners and payment reminders. This is the service itself.
• Income. If you enter your salary or your partner’s to split in proportion to income, those amounts are stored in the household settings and both members can see them, because the split depends on them. Salary change requests and their history are stored so both of you can review and approve them.
• Where an expense happened (iPhone, optional). If you allow location access, the iPhone app attaches the place (name, address and coordinates) where you add an expense, or where an Apple Pay purchase is captured. The place is saved with the expense and synced to our servers, so it is visible wherever the expense is visible, including to your partner for expenses in Ours. The Android app does not ask for location. You can change the place of an expense, or turn off location access in your phone’s settings, at any time.
• Trips. Destination (city and country), dates, budget and the trip’s expenses.
• Subscription. Your plan, its status and expiry date and the store’s transaction data. Apple or Google handle the payment; we never see your card.
• Device and technical data. Your notification token (Apple Push Notification service or Firebase Cloud Messaging), a credential for each installation of the app, app version, platform, language, time zone and currency, and the IP address that any server sees when your phone connects to it.
• Usage analytics. Which screens and features are used, for example “expense added” or “report opened”, with coarse values such as a US dollar range for shared expenses. Never exact amounts, expense titles, notes, names or email addresses. Details below.
• Crash reports (Android). Crash and error reports through Firebase Crashlytics, with the device model, system version and the state of the app when it failed. The iPhone app has no crash reporting service of its own; if you choose to share analytics with app developers in your iPhone’s settings, Apple shares crash reports with us.
• Messages to support. If you write to us, we keep the conversation to answer you.

Your partner, Ours and Mine

A household has two members. Everything in Ours is shared with your partner: shared expenses and their details (including the place and notes), comments, trips, bills, the household budget, the salaries used for the split, and each member’s name, email address and photo.

Everything in Mine belongs to your account only: personal expenses, personal fixed payments, personal settings and limits. It is stored on our servers under your account, our servers are built to return it only to a session signed in as you, and it is left out of the household balance, shared activity and shared reports. If you move an expense from Mine to Ours, your partner will see it. Automatic expenses always land in Mine first and only reach Ours when you choose to share them.

Automatic expenses

Automatic expenses are optional and stay off until you set them up.

• iPhone. You create an automation in Apple’s Shortcuts app. When you pay with Apple Pay, or when a notification arrives from a bank app you chose, Shortcuts passes to Couplesplit the amount and the merchant or, for bank notifications, the notification’s title, text, app name and time. If you allowed location access, the app also attaches your current location. Apple Pay automations work on iOS 18 and later; bank notification automations need iOS 27.
• Android. You give Couplesplit notification access in the system settings. The app only looks at notifications from a fixed list of bank and wallet apps, such as Google Wallet. Notifications from every other app are ignored before their text is read, and one-time security codes are discarded.
• Read on your phone first. The phone reads the notification itself whenever it can. Then the only thing that leaves your phone is the resulting expense (amount, merchant, category, date, the bank app’s name and, on iPhone, the place), saved in Mine and synced like any other expense.
• Reading with AI, only if you allow it. A notification the phone cannot read with confidence is sent to our server and on to OpenAI to read it, and TypeSafe may choose its category and title. Before it leaves your phone, card and account numbers, codes, phone numbers, email addresses and links are replaced with placeholders, and so are your and your partner’s names where the app recognizes them. Amounts and merchant names stay, because they are what has to be read. We ask OpenAI not to store the request, and our server does not keep the text. You can change this at any time in Settings, Automatic expenses, How your data is used.
• Help improve detection (on unless you turn it off). Bank notifications the app could not read with certainty, masked the same way, are kept together with the bank app’s name, currency, language and your answer (purchase or not) for 90 days, without your user or household ID, to improve detection for every bank. You can turn it off in the same place.

AI and smart features

• Category suggestions. When the phone cannot guess the category of an expense, its title and amount may be sent to OpenAI to suggest one. On iPhone this only happens if you allowed reading with AI, and never for expenses in Mine. On Android it can happen for shared expenses when you add or organize them.
• Importing from Splitwise. When you import a Splitwise file, the imported rows (description, Splitwise category, date and amount) may be sent to OpenAI to check their categories.
• Payment reminder messages (iPhone). When you ask the app to write a reminder, the amount and tone are sent to OpenAI with placeholders instead of your names, and the names are filled in on your phone.
• Monthly insights. The sentences about your month are computed by our own server from totals the app sends (for example spending by category, pace and budget). To pick which sentence to show, our server may send candidate sentences, without names, merchants, account data or identifiers, to TypeSafe.
• AI output is for information only and is not financial advice.

Notifications and email

• To send notifications (for example when your partner adds an expense), we store your notification token with your user and household IDs and your language. The notification text, which can include an expense title and amount, passes through Apple or Google to reach your phone.
• For the Sunday summary, the app sends a small snapshot of the week: the shared total, the balance, the number of expenses without a category, your partner’s name, your time zone and currency.
• Sign-in codes are sent by email through Resend. We do not use your email address for marketing.

Analytics in the app

We use Amplitude to understand which features help couples, and its in-app guides and surveys to show occasional announcements or questions. Amplitude receives your user ID, a one-way hashed household identifier, a random device identifier, the app version, platform, language and the IP address it sees, from which it may estimate an approximate location such as the country or city. Events never contain exact amounts, expense titles, notes, names or email addresses. Analytics are turned off in demo mode. The apps have no switch for it yet; if you object, write to us and we will stop it for your account.

Invitations and this website

An invitation link opens a page on join.couplesplit.xyz that shows the inviter’s name and photo. The QR code on that page is drawn by goQR.me (api.qrserver.com), which receives the invitation link. Invitations expire after 30 days. We count visits to that page with a hashed invitation identifier.

On couplesplit.app, Google Analytics 4 runs with Advanced Consent Mode. Before you choose, or if you continue without cookies, Google receives limited cookieless signals about page and feature use and no analytics cookies are set. With your permission, first-party analytics cookies allow more detailed measurement. Measurements may include the page address, language, device and browser, store button clicks, feature interactions, calculator use and the result of an Android list signup. We never send email addresses, financial data or app user IDs to Google Analytics. Advertising storage, ad personalization and Google Signals are always off. You can change your choice at any time with Analytics settings in the footer.

If you joined the Android launch list on this website, we use that email address only to tell you when the Android app is available. Write to us to remove it.

Service providers

These companies process data on our behalf, only for the purposes described here:

• Supabase: database for synced household and personal data, hosted in the United States (Oregon, us-west-2).
• Cloudflare: our servers and their storage for notification tokens, device credentials, invitations, sign-in codes, weekly summaries, subscription status and masked detection samples; hosting of this website.
• Apple: Sign in with Apple, notifications, App Store purchases, Maps (naming places and searching destinations) and iCloud, where the iPhone app keeps a few preferences, such as your Home layout, in your own iCloud account.
• Google: Google Sign-In, Firebase Cloud Messaging, Firebase Crashlytics (Android), Google Play Billing and purchase verification, and Google Analytics on this website.
• RevenueCat (iPhone subscriptions): receives your user ID, household ID and App Store transaction data.
• Amplitude: product analytics, in-app guides and surveys.
• Resend: sends sign-in code emails.
• OpenAI and TypeSafe: the AI features described above.
• Pexels and Wikipedia (Wikimedia): trip cover photos. Our server sends them only the city and country. Your phone then downloads the photo from their image servers, which see your IP address, and in some cases the iPhone app looks the destination up on Wikipedia directly.
• open.er-api.com and Frankfurter: exchange rates. They receive only currency codes and your IP address.
• goQR.me: the QR code on invitation pages.

International transfers

We are based in Chile and our providers process data in the United States and other countries. When your data leaves your country, we rely on the safeguards in those providers’ data processing terms, such as standard contractual clauses where they apply.

How long we keep data

• Account, household and personal data: while your account exists, then as described under “Deleting your account”.
• Notification tokens: up to 90 days after your phone last refreshed them, and removed when you delete your account or leave a household.
• Weekly summary snapshots: 8 days.
• Masked detection samples: 90 days.
• Sign-in codes: 10 minutes. Invitations: 30 days.
• Subscription status: until the subscription expires, plus a short grace period.
• Analytics and crash reports: for the retention period of Amplitude and Firebase Crashlytics. They are not deleted automatically with your account; ask us and we will request their deletion.
• Our providers’ backups can keep deleted data for a limited time until they rotate.

Deleting your account

In the app, go to Settings, open your profile and choose Delete account. Our server then deletes your profile, your settings and salary data, your comments, your salary change requests, the shared expenses you paid (unless you are leaving the household and keep them for your partner) and all your Mine expenses and personal settings. It revokes your devices’ access, unlinks your Apple, Google or email sign-in and, for Sign in with Apple, asks Apple to revoke the app’s authorization. If you were the last member of the household, all of its shared expenses are deleted too. The data on your phone is erased.

The in-app deletion does not yet remove trips, household and personal bills, payment reminders, analytics events, crash reports or purchase records held by RevenueCat, Apple or Google. Expenses your partner paid stay in your partner’s household. To have the rest removed, or if you can no longer open the app, write to [email protected] from your account’s email address.

Your rights

Depending on where you live, including under the GDPR in the European Union, the LGPD in Brazil and Chile’s Law 19.628 as amended by Law 21.719, you can ask to access your data, correct it, delete it, receive it in a portable format, restrict or object to its processing (for example to analytics), and withdraw any consent you gave, without affecting what happened before. You can correct most data and delete your account in the app yourself.

For everything else write to [email protected]. We may need to confirm that the account is yours, and we will answer within the time the law gives us, usually one month. You can also complain to your data protection authority, for example your national authority in the EU, the ANPD in Brazil or, in Chile, the Personal Data Protection Agency created by Law 21.719.

We process your data to provide the service you asked for (contract), with your consent (location, reading with AI, photos, notifications and cookies on this website), for our legitimate interests in improving and securing Couplesplit (analytics, crash reports, detection samples and abuse prevention) and to meet legal obligations. We do not make decisions with legal or similarly significant effects about you based solely on automated processing.

Children

Couplesplit is meant for adults managing a household. It is not directed to children and should not be used by anyone under 16. We do not ask for age and do not knowingly collect children’s data. Tags such as “For: Kids” and children’s categories are labels on your own expenses; they do not create a profile of a child. Please avoid writing a child’s personal details in notes. If you believe a child has given us data, write to [email protected] and we will delete it.

Security

Data travels over encrypted connections (HTTPS). Access to the database is only through our servers, and each installation of the app gets its own signed, expiring credential that is revoked when you delete your account or leave a household. On your phone, sign-in data is kept in the iPhone Keychain or Android’s encrypted storage, and you can lock the app with Face ID, Touch ID or your fingerprint. Our providers encrypt stored data. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.

Changes to this policy

When the apps change what they do with data, we update this page and its date. If a change is significant, we will also tell you in the app.

Contact

Erik From, Couplesplit. [email protected]