Privacy Policy – Expense Split
App cz.pkomarek.expensesplit · Last updated: 6 November 2026
Who processes the data
Petr Komárek (individual, Czech Republic), contact: info@optador.com.
What the app is and where your data lives
Expense Split records shared expenses in groups. The content of a group (group name, members' names, expenses, amounts, payments, notes) is stored on your phone in an encrypted database (key in the Android Keystore) and, so that the other members can see it, on a server of Google Firebase in the EU (Frankfurt).
The content is encrypted between the phones of the group members. The key is held only by the members. I as the operator and Google cannot read it.
What the server sees
Because the content is encrypted, the server sees only what it needs to work:
- the Google account identifier of each member and author (not the content of your Google account),
- the display name you set,
- the role of each member (reader, writer, administrator) and when they joined or were removed,
- when each record was written and by whom, how many records a group has, the kind of record and operation (for example expense, payment, a payment marked as wrong, a payment confirmation),
- the technical data any server sees (IP address in the server's log).
Bank account for settling up
If you add a bank account so that others can pay you, it is stored on your phone. In a group it is stored only encrypted, but every member of the group can read it and it cannot be taken back once it was shared. Share it only with people you trust. The app generates the payment QR code on your phone; nothing is sent to a bank.
Sign-in
You sign in with your Google account (Google Sign-In). The app does not receive your password. It uses the account identifier, your name and e-mail address as Google provides them, to recognize you in the groups.
Your profile and settings
When you are signed in, the app also stores your profile and settings in your account on the same server: the display name, a photo (up to 40 KB), the theme, font, language and units you chose. They follow you to a new phone. These are not encrypted between phones. Only you can read them through the app, but the operator and Google can technically read them. Deleting your account deletes them.
Inviting people
An invitation is a link you share yourself through any app you choose (e-mail, SMS, messenger). The secret that opens
the invitation is in the part of the link after the #, which is never sent to a server by the browser. The server
stores only a technical identifier derived from it and the group key wrapped with the secret. You choose the role of
the invited person. Anyone who has the link can join until it is used or revoked, so share it only with the person
you mean.
Leaving, removing and deleting
- A removed member keeps what they had already read before the removal; it cannot be taken back.
- A deleted group disappears for all members. The encrypted data of the group stay on the server for at most 30 days and are then deleted automatically.
- Deleting your account deletes all your data from the server, except what the statement below says.
When you delete your account, we delete all your data. We keep only a record of what you gave or withdrew consent to (which consent, version of the text, yes or no, when), without content and only with an anonymous account number, for 3 years as proof of consent (Art. 7(1) and Art. 17(3)(e) GDPR); then we delete it.
You can also export all your data (Settings → Export my data) as a file saved to a place you choose, optionally protected by a password.
What stays on your phone only
- Settings (language, colour scheme, etc.). If Android backup is on, the system may back them up to your Google account; the local copy of the groups and the encrypted secret store are excluded from backup. After you sign in on a new phone, the groups download again from the server; records you made offline and had not yet sent are lost with the phone.
- Fingerprint and face are verified by Android itself. The app receives only "verified / not verified".
- An unsent bug report is stored encrypted on the phone and is excluded from backup.
What else leaves your phone, and when
Automatic crash reports (only with your consent)
Nothing is sent without your consent. The app asks on first launch; you can change the choice any time in Settings → Diagnostics. With consent, a crash sends the stack trace, a few technical events before the crash, the app version, phone model, Android version, the technical state of the phone (language, time zone, memory, battery, screen size) and an installation code (a random number created on the phone, not linked to you). The content of the groups (names, descriptions, amounts, bank accounts, payment references) is hidden in the reports. Screenshots and personal details are never sent automatically.
Bug reports you send yourself
You start a report by shaking the phone or from Settings. Before sending, the app shows you everything that will go, including a screenshot which you can remove. The group content and secret codes are covered with a dark box, and no screenshot is ever attached from a protected screen. The report is sent only when crash reporting is on.
Where reports go
Crash and user reports are processed by Sentry (Functional Software, Inc.) solely on my instructions, stored in Sentry's EU region (Germany) and deleted automatically after 30 days. The legal basis is your consent (Art. 6(1)(a) GDPR).
AI help (optional, with your own key)
It is off by default and the app has no AI key of its own. If you turn it on and enter your own key, each help question sends the screen description, the question text and a few chapters of the manual to the service you chose (Google Gemini, Groq or OpenRouter) directly from your phone, under your own agreement with it. The content of your groups is not sent. AI answers are marked "Answer generated by AI" and can be reported with the Report answer button (the report goes to Sentry with the same consent as bug reports).
Dictation
When you dictate a question, Android's speech recognition (usually Google) converts the speech. The app receives only the text.
Update check (only the version downloaded outside Google Play)
The version from the website fetches a small file with the latest version number once a day; the server sees an IP address as with any web page. The Google Play version does not do this.
Permissions
| Permission | Purpose |
|---|---|
| Internet, network state | synchronization of groups, sign-in, reports (with consent only), AI help (only if you enable it), update check in the non-Play version |
| Notifications | progress and result of a data export; the app works without it |
| Foreground service (data sync) | the export of your data keeps running when you leave the app |
| Biometrics | unlocking the app with fingerprint or face, if you enable it |
| Run at startup | scheduling background work again after the phone restarts |
| Install apps | non-Play version only: installing a downloaded update, always confirmed by you |
The app does not read your contacts or location.
How to exercise your rights and request deletion
Delete your account in the app (it deletes your data on the server, see above), or write to info@optador.com. Reports sent to Sentry are found by the installation code: Settings → Diagnostics → Request deletion of my reports; I delete them within 30 days.
Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and to object, and you can withdraw consent any time. You may lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).
Children
The app is not intended for children under 18 and does not knowingly collect data from them.
Changes
Changes will be published on this page with an updated date above. Significant changes will also be announced in the app.