Privacy notice for Split

The controller for personal data processed in Split is Xoricon GmbH, Aichelbergweg 1a, 88239 Wangen im Allgäu, Germany, email: office@xoricon.com, phone: +49 (0)7522 914 270. For privacy questions, contact us at office@xoricon.com.

Split stores groups and entries on your device first and syncs them for the group via Amazon Web Services servers in Frankfurt. You need neither an email address nor a password.

Split shows no ads, uses no tracking or analytics tools and does not sell data. Only members see a group's content. Split is not end-to-end encrypted: we can technically access stored data, but we only use it to run Split.

On first start, Split creates an anonymous account: a random account ID and a device key. The private key stays on your device; the server only stores the public key, a key ID and the time of creation and last use. Every request to the server is signed with this key.

The purpose is signing in without a password and protecting your data from access by others. The legal basis is performance of the user contract (Art. 6(1)(b) GDPR).

For each group, Split stores the group name and currency, the names of the people in the group, which accounts are members, and expenses, income and payments with title, optional description, amount, currency, date, category, payers and split. Technical data such as creation and change times are added.

All members of a group can see and edit this data; that is the purpose of Split. The legal basis is Art. 6(1)(b) GDPR.

Members can add people who have no account (yet), for example by first name. We process these names so the group can split its expenses (legitimate interest, Art. 6(1)(f) GDPR). Please only add names the people know and expect.

With Premium you can add photos of receipts to entries. The app shrinks them before uploading. They are kept in non-public storage in Frankfurt and delivered to group members only via time-limited signed links. Receipts may contain personal data, such as names on an invoice; upload only what the group needs.

The legal basis is Art. 6(1)(b) GDPR. Deletion periods are listed in section 13.

You can optionally save payment details, such as an IBAN or a PayPal link, so others can copy them when settling up. Members of your groups can see them. Split does not initiate payments. The legal basis is Art. 6(1)(b) GDPR; you can change or delete the details at any time.

If you secure your account with a passkey, the server stores the public key, a hashed passkey identifier, a counter and timestamps. The private key stays on your device or in your password manager.

If you link your account with Google or Apple, you are redirected to that provider to sign in. Afterwards Split only stores a hashed identifier of your Google or Apple account, no email address and no name. Google's and Apple's privacy notices also apply to the sign-in.

The purpose is using Split on several devices and recovering it if you lose a device. The legal basis is Art. 6(1)(b) GDPR.

If you turn on notifications, Split stores your browser's subscription address for this device, the related keys and which kinds of messages you want. Messages contain, for example, the group name, a name and an amount.

They are delivered via your browser's push service, for example Google (Chrome, Android), Apple (Safari), Mozilla (Firefox) or Microsoft (Edge). The content is encrypted for the push service; it only sees that a message is sent to your device.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the app under “Benachrichtigungen” or in your browser settings; the subscription is then deleted.

You pay for Premium via Stripe (Stripe Payments Europe Ltd., Ireland). Stripe collects the data needed for payment, such as email address and payment details, and also processes it under its own responsibility, for example to prevent fraud. Split never receives card details.

For each purchase, Split stores the type, status, the group or account concerned and Stripe references, so Premium can be unlocked and ended on cancellation, refund or chargeback. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for retention under commercial and tax law.

When you open split.xoricon.app, Amazon CloudFront and a web application firewall process technically necessary data such as IP address, time, requested address and browser details, to deliver the app and fend off attacks. The server logs errors and security-relevant events, such as renewing a group link, with technical identifiers but without content.

These logs are deleted after 30 days. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

So that Split works offline, the app stores groups, entries, receipt copies, settings and the device key in your browser's storage (IndexedDB and local storage). This is strictly necessary for the function you requested (section 25(2) no. 2 TDDDG). Split sets no tracking cookies.

You can delete this data by removing the site data of split.xoricon.app in your browser. Anything not yet synced is lost.

We use Amazon Web Services EMEA SARL (Luxembourg) as a processor for servers, database, storage and delivery; the data is stored in the Frankfurt region, and delivery via CloudFront uses locations worldwide. Other recipients are Stripe (section 9), the browsers' push services (section 8) and Google and Apple if you sign in with them (section 7).

Where data may reach the USA, we rely on the adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses.

We remove receipt photos from the server when a group rests: without Premium after 90 days without activity, after 14 days if everything is settled, with Premium after 24 months.

Fully settled groups without Premium become dormant after 120 days without activity and are deleted after another 30 days. We never delete groups with open balances or Premium automatically, so nobody loses money.

If you delete your account, you leave all groups and your account is locked at once. Device keys, passkeys, Google or Apple links and push subscriptions are deleted at once; the account itself, your payment details and licenses after 30 days. Purchase records are kept until the end of the tenth year after the year of purchase because of commercial and tax law, and deleted afterwards. Your name stays on past entries so the balances remain correct for the others, and is deleted with the group. We keep the random account ID as a block marker so it cannot be issued again. Logs are deleted after 30 days; backups keep deleted data for up to 35 more days.

You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests. You can withdraw consent at any time with effect for the future. Write to office@xoricon.com and include the account ID from “Konto & Einstellungen” → “Support-Informationen” so we can find your account.

You can also lodge a complaint with a data protection authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

Split makes no automated decisions within the meaning of Art. 22 GDPR and creates no profiles. Settlement suggestions are a calculation based on the group's entries.

We update this privacy notice when Split or the law changes. The version published here applies.