Privacy Policy

Money Split ("we", "our", or "us") operates the Money Split web application. This Privacy Policy explains what personal data we collect, how we use it, and the rights you have over it.

By creating an account or using our service, you agree to the collection and use of information as described in this policy.

Account information: When you register, we collect your display name, email address, and a bcrypt-hashed version of your password. We never store your password in plaintext.

Financial data: Expense amounts, descriptions, split allocations, and settlement records you create within groups. All monetary values are stored as integers in cents.

Usage data: We may collect aggregate, anonymised analytics about how features are used to improve the product. No individual browsing history is sold or shared.

Cookies and tokens: We use HttpOnly cookies to store your JWT access token and refresh token. These are inaccessible to JavaScript and cannot be read by third-party scripts.

We use the information we collect to:

• Provide, maintain, and improve the Money Split service.
• Authenticate your identity and protect your account.
• Send transactional emails (email verification, password resets, group invitations).
• Respond to support requests.
• Comply with legal obligations.

We do not use your financial data for advertising or sell it to third parties.

We do not sell, trade, or rent your personal data to third parties.

We may share data with service providers who assist in operating our service (e.g., database hosting, email delivery). These providers are contractually obligated to keep your data confidential and use it only to perform services for us.

We may disclose your information if required by law, court order, or other governmental authority.

We retain your personal data for as long as your account is active. If you delete your account, all personal data is permanently deleted within 30 days, except where we are required by law to retain it longer.

Group expense records are retained as long as any member of that group maintains an active account.

If you are located in the European Economic Area, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your personal data ("right to be forgotten") — available via account deletion.
• Restrict or object to processing of your data.
• Portability of your data in a machine-readable format.

To exercise any of these rights, contact us at privacy@moneysplit.app.

We implement industry-standard security measures including HTTPS/TLS in transit, bcrypt password hashing, HttpOnly cookies, rate limiting on all API endpoints, and OWASP-compliant input validation.

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Money Split is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or via a notice in the application. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or how your data is handled, please contact us at privacy@moneysplit.app.