Privacy Policy
Last updated: May 27, 2026
Last reviewed: 2026-05-27
1. Data We Collect
When you use Olik Split, we may collect the following information:
- Account data — email address, display name, optional username, avatar URL, and (where applicable) a Google or Apple subject identifier provided during sign-up. Sign-in is supported via email/password (bcrypt-hashed), Google, Apple, or as an anonymous account that can be linked to a permanent account later.
- Expense & income data — amounts, descriptions, categories, dates, group associations, recurring schedules, budget settings, savings goals, line-item splits, attached photos, and notes you create within the app.
- Payment method data — payment service identifiers (e.g. PayPal, Revolut, Monobank, IBAN) that you add to facilitate settlements. Private payment methods are encrypted on your device with a key stored in your device's hardware-backed keystore, then transmitted; on the server, the same value is encrypted again with a server key (double encryption). Public (shared with group members) payment methods are encrypted server-side only.
- Group & invite data — group names, membership, invite codes, friend invites, and QR invite links you create or redeem.
- Receipt scanning data (server-side AI mode) — when you use the AI receipt scanner (premium users, or free users who have unlocked a single scan via a rewarded ad), the receipt image is uploaded to our private Cloudflare R2 bucket and submitted to the Anthropic API for line-item extraction. Alongside the image we send a small device-locale context (BCP-47 device locale, region code, IANA timezone, capture timestamp, 12h-vs-24h preference, decimal & grouping separators, and your default in-app currency) so the AI can correctly disambiguate currency, dates, and number formats on the receipt — for example, resolving "1,250" as either 1.25 EUR or 1,250 USD. These signals never include your name, email, account identifier, or precise location. Images are deleted from R2 after processing; only the extracted text and items are retained on the receipt expense. On-device OCR (Google ML Kit on Android, Apple Vision on iOS) does not upload anything.
- Bank transaction data (Android only) — when you connect a bank source, parsed transaction amount, merchant description, category, and date are stored server-side so they can sync across your devices and be converted into expenses with one tap.
- Subscription data — Google Play / App Store purchase tokens and entitlement state, used to verify your premium subscription with the platform stores.
- Client platform — which client you most recently used (Android, iOS, Web, or Desktop) and which one you first signed up from. Stored on your account so we can debug platform-specific issues, prioritise features, and split product metrics by client. No device model, advertising identifier, or other device fingerprint is collected as part of this field.
- Device tokens — Firebase Cloud Messaging (FCM) and Apple Push Notification (APNs) tokens used to deliver push notifications to your device.
- Notification history — records of push notifications sent to your account (title, body, read status), including payment reminders and group activity alerts.
- Analytics events — anonymized product analytics (screen views, feature usage, session and country) are recorded via Firebase Analytics on Android and iOS to help us understand which features are used. Events are tied to a per-install identifier, not your name. Crashes are captured by Firebase Crashlytics on Android.
- Ad measurement data (Android & iOS, free tier only) — when ads are shown (banner, native, interstitial, or rewarded), Google AdMob receives the standard advertising identifier per OS settings and our app emits an
ad_revenue_event linked to your user account for our internal LTV reporting.
- Server logs — for every authenticated API request we log your user ID, IP address, and User-Agent for security, abuse prevention, and debugging. We also keep an audit log of significant account actions (creating or modifying expenses, groups, settlements, payment methods).
- Support tickets — when you contact us through the in-app support form, your email and message body are stored so we can reply.
- Incident reports (in-app "Report an issue") — when you tap Settings → Support → Report an issue, we store the free-text description you type (≤500 characters) along with a diagnostic snapshot of the last 20 HTTP calls your app made (method, path, status code, duration, and, on failures, a 200-character snippet of the server error message). The snapshot never includes request bodies, authorisation tokens, or expense / payment-method data. Reports are stored on our server with a stable issue ID so we can triage them, and a copy of the summary is forwarded to our operator alert channel (Telegram) for real-time triage.
2. Data Stored Only on Your Device
The following data is stored exclusively on your device and is never transmitted to our servers:
- Biometric data — fingerprint or Face ID templates used to unlock the app (managed by the operating system's secure enclave).
- PIN & recovery code — your app-lock PIN hash and one-time recovery code hash are stored in local app settings only.
- Bank notification content (raw) — incoming banking push notifications are parsed on-device. Only the structured result (amount, merchant, date, category) is synced when you choose to convert it into an expense; the raw notification body is never uploaded.
- Receipt images on the free tier without AI — when you scan a receipt with the on-device OCR (default for free users), the image is processed locally and never uploaded.
- Client-side payment encryption keys — private payment method encryption keys are stored in the platform keystore (Android Keystore, iOS Keychain) or in
localStorage via WebCrypto on the web build, and never leave your device.
3. How We Use Your Data
- To provide core functionality: creating groups, tracking expenses and income, calculating balances, simplifying debts, managing budgets and savings goals, and parsing receipts.
- To send push notifications about group activity (new expenses, settlements, payment reminders, and daily nudges if you opt in).
- To enable data export (CSV / PDF) of your expenses and balances.
- To verify your premium subscription state with Google Play or the App Store and unlock premium features (server-side AI receipt scanning, ad-free experience).
- To maintain audit and server-event logs for security, fraud prevention, abuse mitigation, and debugging.
- To synchronize your data across devices via our server when you are online.
- To measure aggregate product usage (non-personal analytics) so we can improve the app.
- To respond to your support requests sent through the in-app form or by email.
4. Third-Party Services
We use the following third-party services. Each is subject to its own privacy policy, linked below.
- Google Sign-In — authentication via your Google account (Android Credential Manager / GoogleSignIn on iOS / Google Identity Services on the web).
- Sign in with Apple — authentication via your Apple ID on iOS and the web.
- Firebase Cloud Messaging (Google LLC; EU-US DPF certified) — push notification delivery on Android. iOS uses Apple's APNs.
- Firebase Analytics (Google LLC; EU-US DPF certified) — anonymous, aggregate product analytics on Android and iOS. We do not use Analytics for ad personalization.
- Firebase Crashlytics (Google LLC; EU-US DPF certified) — crash reporting on Android only. Reports include the stack trace and device model; we do not attach personal expense data.
- Firebase Remote Config (Google LLC; EU-US DPF certified) — server-side feature flags and pricing. No user data is sent to it; it is read-only on the client.
- Google AdMob (Google LLC; EU-US DPF certified; free tier on Android & iOS) — banner, native, interstitial, and rewarded ads. Consent is obtained via Google's User Messaging Platform (UMP) for users in the EEA, UK, and Switzerland (IAB TCF v2.2). On iOS, we request App Tracking Transparency permission before AdMob can use the IDFA.
- Anthropic API (EU-US Data Privacy Framework + SCCs) — server-side AI receipt parsing for premium users and for free users who have unlocked a scan via a rewarded ad. The receipt image and the resulting structured items are sent to Anthropic; per the Anthropic API terms, this content is not used to train Anthropic's models. We never send your account email, name, or other personal identifiers in the prompt.
- Cloudflare R2 (US/global; SCCs) — encrypted-in-transit storage for receipt images uploaded for AI scanning. Images are deleted shortly after processing.
- Google Play Billing / Apple StoreKit — premium subscription billing. We never see your payment instrument; only the platform-issued purchase token.
- Google ML Kit (Android) / Apple Vision (iOS) — on-device OCR for free non-AI scans in multiple scripts (Latin, Chinese, Japanese, Korean, Devanagari). Images are processed locally and never sent to Google or Apple cloud services.
- Telegram Bot API — used only as an internal operator alert channel: when you submit an incident report (Settings → Support → Report an issue), a formatted summary of your report (issue ID, masked user identifier, app version, platform, description, and the diagnostic network log) is forwarded to our private support channel so we can triage it quickly. The same data is already stored on our server (see section 1 — Incident reports); the Telegram leg is a notification fan-out, not a separate store, and we control the channel.
4a. v1.1 Engagement & Premium Features (effective May 24, 2026)
The following features were introduced in Olik Split v1.1. They are processed on data you already provide under section 1 and do not introduce new third-party processors beyond those listed in section 4. This section exists for explicit auditability.
- Achievements — to compute badge progress, we count actions you already perform in the app (creating expenses, settling debts, scanning receipts) and store the resulting counts and unlock timestamps on the server. No new personal data is collected beyond the expense and settlement events covered by section 1.
- Category Mastery & Voucher Rewards — the server keeps per-category interaction counters per user (category ID, count, and the timestamp at which a voucher was claimed) in a
category_mastery_claims table so that earned vouchers can be granted. Only your own category IDs and counts are stored; no expense amounts or descriptions are duplicated into this table.
- AI Advisor (premium) — when you open the AI Advisor, an aggregated, de-identified summary of your recent expense activity (category totals, period, currency) is sent to the Anthropic API (the same processor disclosed in section 4) to generate a written insight. No receipt images, no merchant text, no payment-method data, and no account identifiers (email, name) are included in the prompt. Per Anthropic API terms, this content is not used to train Anthropic's models. The premium subscription state is verified locally before the request is made.
- Trip Pass — a group type tag stored on the existing
groups record. No additional data is collected.
- Invite Rewards / Referrals — when you invite a friend and they install Olik Split and start a premium subscription, both accounts receive a reward. To support this, we generate per-user invite codes, record redemption events (which inviter, which invitee, which timestamp), and attribute the resulting premium activation. Attribution data is processed only on our own server; no referral identifier is shared with any third-party advertising or attribution network.
None of the v1.1 features changes our data retention policy (section 8). You can request deletion of all v1.1 feature data (achievement progress, mastery counters, advisor history, referral attribution) along with your account at any time by following the deletion process in section 8.
5. Data Storage & Security
Your data is stored on a PostgreSQL database hosted on a secure server. Passwords are hashed using bcrypt. All communication between the app and server uses HTTPS/TLS encryption. Receipt images uploaded for AI scanning are stored in a private Cloudflare R2 bucket, signed-URL access only, and deleted after the OCR job completes.
Private payment methods use AES-GCM-256 encryption (CommonCrypto AES on iOS, WebCrypto AES-GCM on the web build). The encryption key is generated on first use and stored in your device's hardware-backed keystore (Android Keystore, iOS Keychain) or — on the web — in localStorage isolated to the oliksplit.app origin. The same value is encrypted again on the server with a separate server-managed key. Public payment methods shared within groups are encrypted server-side only.
Offline data is stored locally using SQLDelight and syncs automatically when connectivity is restored.
6. Data Sharing & Our No-Sale Commitment
We do not sell, rent, or trade your personal data to anyone for any purpose. This includes receipt data, expense entries, payment-method identifiers, and any other personal information you provide. Data is only shared with the third-party processors listed in section 4, and only for the limited purposes of operating the app (authentication, push delivery, AI receipt extraction, ad serving on the free tier, crash reporting, and subscription billing). We will not sell aggregated or anonymized receipt data either, unless and until we update this policy with at least 30 days' advance notice and provide an explicit opt-out.
Within a group, the following is visible to other group members: your display name, username, email, expense/income entries, balances, and public payment methods. Private payment methods are never shared.
7. Access by Authorized Personnel
As the operator of Olik Split, our small operations team may access your account data strictly for the following limited operational purposes:
- Technical support — investigating issues you report to us, such as missing expenses, sync problems, or billing errors.
- Incident response — debugging server errors, database issues, or data corruption.
- Abuse and fraud prevention — investigating spam, harassment, or fraudulent activity reported by other users.
- Legal requests — complying with valid requests under applicable law (including GDPR data access/deletion requests, subpoenas, or court orders).
- Account recovery — assisting you if you lose access to your account.
All administrative access is subject to the following safeguards:
- Logged — every administrative action (such as granting or revoking premium, force-expiring a subscription, or deleting an account) is recorded in an immutable audit log with the administrator's IP address, timestamp, and action type. Administrator accounts are stored with bcrypt-hashed credentials and TOTP secrets, and active admin sessions log their IP + User-Agent for the duration of the session.
- Authenticated — the administrative interface is protected by a strong secret, with automatic IP blocking after repeated failed attempts (offending IPs are stored in a temporary block list and purged automatically).
- Minimized — administrators have routine visibility only into account metadata (email, username, group names, subscription status, member and expense counts). Individual expense amounts, categories, notes, attached receipts, and personal payment methods are not routinely viewed and are accessed only when required to resolve a specific support ticket or legal request.
- Not used for profiling or marketing — administrative access is strictly for operational purposes. Your personal data is never analyzed, aggregated, or shared for advertising or commercial profiling.
You may request a copy of any administrative actions performed on your account by contacting support@oliksplit.app.
8. Data Retention
Your data is retained as long as your account is active. You may request deletion of your account and all associated data at any time via the in-app "Delete Account" option or by contacting us. Upon deletion, all server-side data (expenses, groups, payment methods, device tokens, notifications) is permanently removed.
9. Data Export & Portability
You can export your expense and balance data in CSV or PDF format at any time from within the app.
10. Your Regional Privacy Rights
Your privacy rights vary by jurisdiction. The subsections below describe the rights guaranteed to residents of specific regions. Anywhere else, you may exercise the rights listed in any subsection — we apply the most generous applicable standard to every account.
10a. EEA, United Kingdom & Switzerland (GDPR / UK GDPR / Swiss FADP)
10.1 Controller & Representative
The controller for your personal data is olikbobik (Olik Split). Contact: support@oliksplit.app. Pending: EU Representative under Article 27 GDPR. Until appointed, EEA users may contact support@oliksplit.app directly.
10.2 Legal Bases for Processing
| Processing | Legal basis (GDPR Art. 6) |
|---|
| Account creation, authentication, expense/group sync, subscription billing | Contract (Art. 6(1)(b)) |
| Server-side AI receipt OCR (Anthropic) | Consent (Art. 6(1)(a)) |
| Firebase Analytics product analytics | Consent (Art. 6(1)(a)) |
| Private payment-method storage (encrypted handles) | Consent (Art. 6(1)(a)) |
| AdMob ad serving on the free tier | Consent via UMP / IAB TCF v2.2 (Art. 6(1)(a)) |
| Crashlytics crash reporting, server logs, incident reports, abuse prevention | Legitimate interest (Art. 6(1)(f)) |
| Compliance with legal obligations (tax, court orders) | Legal obligation (Art. 6(1)(c)) |
10.3 Recipients & International Transfers
| Recipient | Location | Transfer mechanism |
|---|
| Anthropic, PBC | United States | EU-US Data Privacy Framework + SCCs |
| Google LLC (Firebase + AdMob) | United States | EU-US Data Privacy Framework + SCCs |
| Cloudflare, Inc. (R2) | United States / global | Standard Contractual Clauses (SCCs) |
| Apple Distribution International Ltd. | Ireland | Intra-Apple SCCs (no third-country transfer) |
10.4 Retention Periods
| Data category | Maximum retention |
|---|
| Account, expenses, groups, payment-method handles | Until deletion request + 30 days backup purge |
| Receipt images in Cloudflare R2 | Up to 90 days (actually deleted shortly after OCR processing) |
| Firebase Analytics events | 14 months (GA4 maximum) |
| Crashlytics crash logs | 90 days |
| Support tickets | 24 months |
| Incident reports (in-app "Report an issue") | 12 months |
| Server access logs (IP, User-Agent) | 90 days |
10.5 Your Rights
Under GDPR / UK GDPR you have the right to: (1) access your personal data, (2) rectification of inaccurate data, (3) erasure ("right to be forgotten"), (4) restriction of processing, (5) data portability, (6) object to processing based on legitimate interest, (7) withdraw consent at any time without affecting the lawfulness of prior processing, and (8) the right not to be subject to solely automated decisions producing legal or significant effects. We respond to verified requests within 30 days.
10.6 Withdraw Consent
You can withdraw consent for OCR, Analytics, and Ads from the in-app Settings → Privacy screen. Some granular toggles will land in v1.2; until then you may also email support@oliksplit.app to revoke any consent immediately.
10.7 Right to Lodge a Complaint
EEA residents may lodge a complaint with their national data-protection authority — see the list at edpb.europa.eu/about-edpb/about-edpb/members_en. UK residents may contact the Information Commissioner's Office at ico.org.uk.
10.8 Automated Decision-Making
We do not engage in solely automated decision-making producing legal or similarly significant effects on you (GDPR Article 22). The AI Advisor produces written insights only; it does not make eligibility, pricing, or account-status decisions.
10.9 Children
See section 11.
10.10 Switzerland (FADP)
The rights above extend to Swiss residents under the Federal Act on Data Protection (revFADP). Complaints may be filed with the Federal Data Protection and Information Commissioner (FDPIC).
10b. United States (CCPA / CPRA / Multi-State)
If you reside in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Indiana, Tennessee, Florida, Delaware, New Jersey, or any other U.S. state with a comprehensive consumer-privacy law, you have the following rights:
- Right to Access / Know — the categories and specific pieces of personal information we have collected, the sources, purposes, and recipients (see sections 1 and 4).
- Right to Delete — request deletion of your personal information, exercised via the in-app "Delete Account" option or by emailing us.
- Right to Correct — request correction of inaccurate personal information.
- Right to Data Portability — export your expenses and balances in CSV / PDF; additional categories on request.
- Right to Opt-Out of Sale & Sharing — we do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. For California residents and any user whose browser asserts a Global Privacy Control signal, we configure AdMob in non-personalized mode so no targeting profile is built. Implementation pending — see Settings → Privacy → Limit Ad Tracking when available.
- Right to Limit Use of Sensitive Personal Information — we do not use payment-method handles, account credentials, or precise location to infer characteristics about you for advertising or profiling.
- Right to Non-Discrimination — you will not receive discriminatory pricing or service for exercising any of these rights.
- Right to Appeal — if we decline a request, you may appeal by replying to our decision email; we will respond to appeals within 45 days.
Minors. We do not knowingly sell or share the personal information of California consumers under 16 or Connecticut consumers under 18 without affirmative opt-in consent.
How to exercise your rights. Email support@oliksplit.app or use the in-app Settings → Privacy → Submit Privacy Request flow Pending in-app form.. We respond within 45 days (extendable by 45 days for complex requests, with notice). We may verify your identity by confirming control of the email on the account.
DNT / GPC. Our website honors Do Not Track and Global Privacy Control browser signals (see section 13). The mobile app does not contain a browser engine; the equivalent in-app control is the Limit Ad Tracking toggle in Settings → Privacy.
10c. Brazil (LGPD)
Esta política também é regida pela LGPD para usuários no Brasil. Versão em português brasileiro disponível.
The controller (controlador) under the Lei Geral de Proteção de Dados (Lei 13.709/2018) is olikbobik. Privacy contact: privacy@oliksplit.app.
Article 18 rights. Brazilian residents (titulares) have the right to: (1) confirmation of processing, (2) access, (3) correction of incomplete, inaccurate, or outdated data, (4) anonymization, blocking, or deletion of unnecessary or excessive data, (5) data portability, (6) deletion of personal data processed with consent, (7) information about public and private entities with which we shared data, (8) information about the possibility of refusing consent and its consequences, and (9) revocation of consent.
Article 7 legal bases. We process personal data under: execution of contract (Art. 7, V), consent (Art. 7, I) for OCR / Analytics / Ads, legitimate interest (Art. 7, IX) for fraud prevention and crash reporting, and compliance with legal obligations (Art. 7, II).
International transfers. Transfers to Anthropic (US), Google LLC (US), and Cloudflare (US/global) occur under Brazilian Standard Contractual Clauses adopted by ANPD Resolution CD/ANPD 19/2024.
Sensitive data. Biometric authentication (fingerprint, Face ID) is processed exclusively on-device by the operating system's secure enclave and never reaches our servers, so we do not process sensitive personal data under LGPD Article 11.
Minors. For users in Brazil specifically, Olik Split is restricted to users aged 18 or older. We do not knowingly process the personal data of children or adolescents in Brazil.
DPO / Encarregado. As a small processing agent, we rely on the exemption from formal DPO appointment provided by ANPD Resolution CD/ANPD 2/2022. Our designated communication channel for LGPD matters is privacy@oliksplit.app.
Complaints. You may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.
11. Children
Olik Split is intended for users aged 13 and older (16 in the European Economic Area where higher digital-consent ages apply; 18 in Brazil). By creating an account, you represent that you meet the applicable minimum age. We do not knowingly collect personal information from anyone below the applicable threshold. If you are a parent or guardian and believe a minor has created an account, contact support@oliksplit.app and we will delete the account and all associated data promptly upon verification. For California residents, we do not knowingly sell or share personal information of consumers under 16 without affirmative opt-in consent.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date.
13. Website Analytics
We run a small, self-hosted analytics pipeline for our marketing pages (the consumer landing, the developer landing, the pricing calculator, and the docs site). It exists so we can answer two questions: which docs work, and which links convert. No third-party processor ever sees this data — it lives in the same EU-hosted Postgres database as the rest of the product.
- No cookies. A random per-browser visitor id (
localStorage) and per-tab session id (sessionStorage) are generated client-side. Neither is a personal identifier; clearing site data resets them.
- Hashed IP, never stored raw. Each event's source IP is hashed server-side with a daily-rotating salt before it lands in storage. The raw IP is dropped at ingest. The daily salt rotation makes cross-day visitor stitching impossible.
- No third parties. No Google Analytics, no Plausible, no Mixpanel, no embedded pixels. Events go straight to our own ingest endpoint at
api.oliksplit.app.
- Retention: 90 days. Raw events are purged after 90 days. Aggregated daily counters (visitors, page views, CTA clicks per page) are retained longer for trend analysis.
- Do Not Track and Global Privacy Control honored. If your browser sends
DNT: 1 or Sec-GPC: 1, the analytics script no-ops and no events are sent.
- What we record. Page path, referrer host, the name of any CTA you click (e.g.
cta:sign_up), scroll-depth milestones (25/50/75/100%), pricing-calculator slider positions, and the visitor/session ids. We do not record form input values, mouse movement, or any field other than what is listed here.
14. Contact
If you have questions about this policy, contact us at support@oliksplit.app.