Privacy Policy
SplitIt is a small web app for splitting bills among friends. This page explains what data we collect, who else sees it, and what you can do about it.
What we collect
- Email address (used to sign you in).
- Username and display name (shown to other trip members so they know who paid for what).
- Optional Venmo or Zelle handle, if you choose to add one to your profile.
- Trip data you enter: trip names, expense names, line items, amounts, dates, and which member is responsible for each item.
- Receipt photos you upload for OCR.
Where it's stored
SplitIt's database and uploaded receipt images are hosted on Supabase. The app itself runs on Vercel. Both providers operate from data centers in the United States.
Third-party services
A few external services receive small amounts of your data so the app can do its job:
- Anthropic (Claude API) — receipt photos are sent for OCR when you scan a receipt. Before upload, the photo is downsampled and re-encoded in your browser, which strips EXIF metadata such as GPS coordinates, capture timestamp, and camera model — only the resized image (without that metadata) is uploaded to our Supabase storage or sent to Anthropic. The copy sent to Anthropic is handled per their published data-retention policy.
- Resend — trip-invitation emails (and any other transactional email) are delivered through Resend.
- Cloudflare Turnstile— the signup form runs a Turnstile challenge to verify you're human. Cloudflare receives a one-time challenge token; no signup form fields are sent to Cloudflare.
We do not sell your data to advertisers.
Your rights
- Access: download all of your data as a JSON file from your account settings. Receipt images are excluded from the automatic export and must be downloaded individually by opening each expense in the app.
- Deletion: delete your account at any time from the same page. Trips you participated in remain visible to the other members so their settlements stay intact, but your name is replaced everywhere with “Deleted user.”
- Correction: update your display name, username, or payment handles from your profile.
- For anything else, email us at the address below.
Retention
- Receipt images are deleted when the underlying expense is deleted.
- All other personal data is deleted when you delete your account.
- Trip data you contributed to remains visible to your former trip members after account deletion (with your name replaced as described above).
Children
SplitIt is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has signed up, contact us and we'll remove the account.
Changes
If we make material changes to this policy, we'll update the “Last updated” date and, where reasonable, notify you by email.
Contact
For privacy questions or requests, email privacy@your-domain.example.
This policy is plain-language guidance for a hobby launch and is not a substitute for review by a lawyer.