The short version: a trip you keep to yourself stays on your iPhone. Splitnik has no account for it, and nothing about it is sent anywhere. Only when you share a trip online (part of Splitnik Premium) or join someone else's does that trip go to Splitnik's own server, so that everyone in it stays in sync. It's used for nothing else: no ads, no analytics, no tracking, and your data is never sold.
This policy covers the Splitnik app for iPhone, the Splitnik server it syncs shared trips with, and this website. Splitnik is made by Ilya Voloshin, who is responsible for it under data protection law ("I" below). Contact: splitnik@ilyav.net.
Trips you keep to yourself
Everything you put in a trip that isn't shared (people, their weights, emails, phone numbers and payback details, expenses, transfers, currencies and rates, photos and the trip's cover) is stored only on your iPhone. It's included in your iPhone's own backups (iCloud or your computer) under your settings, like any app's data. I never receive any of it, and you don't need an account.
On your iPhone
- Receipt scanning reads the photo with Apple's on-device text recognition and, on iPhones with Apple Intelligence, Apple's on-device language model. The photo and its text never leave the iPhone to be read.
- Image Playground trip covers are made on the iPhone by Apple's on-device image model.
- Camera and photos: the app asks for the camera or your photo library only when you add a photo, and only uses the photo you choose.
- Trip reports are written by the app and sent through the app you pick (Messages, Mail…), to the people you choose. Splitnik doesn't send them.
- Widgets read a summary the app writes for them on your iPhone (trip names, totals, balances and who pays next).
Shared trips
Sharing a trip online needs Splitnik Premium (yours, or a member's), and you sign in with Apple the first time you share or join a trip. From then on, the server stores the following, only for trips that are shared:
| Your account | Apple's identifier for your Apple Account in Splitnik; the name the trip's members see (Apple suggests your name, or the app uses the name of the person you are in the trip); and a token from Apple, encrypted, that lets me end the link to your Apple Account when you delete your account. Splitnik doesn't ask Apple for your email address. Also your sign-in sessions, stored as hashes. |
|---|---|
| The shared trip | Its name, dates, home currency, other currencies and their rates, payback settings and cover picture. Its people, as the members typed them in: names, weights, email addresses, phone numbers and payback details (a bank account, a payment app handle or whatever was entered), and which person each member is. Its expenses and transfers: what, how much, which currency, when, who paid, who it was for and their weights or receipt lines. |
| Photos | The receipt, transfer, people and cover photos of a shared trip, so the members can see them. Only the trip's members can download them. |
| Membership | Which shared trips you're in, whether you started the trip, when you joined, and whether you turned the trip's notifications off. |
| Premium | If you bought Splitnik Premium and shared or joined a trip: the App Store transaction id and its date, as signed by Apple, so every trip you're in is Premium for its members. |
| Notifications | If you allow notifications: your device's push token from Apple, so the server can tell you about changes to your shared trips. |
| Server logs | Requests (time, address, path and result) are logged to run and secure the service, and kept for a short time. |
Everyone in a shared trip can see everything in it, including the contact and payback details of its people. The trip's sharing code lets anyone who has it ask to join, so send it only to the people on the trip; whoever started the trip can make a new code at any time.
People who don't use Splitnik. A trip can include people who never install the app, with details someone else typed in. Add only details they're happy for the group to see. Anyone can ask a member to change or remove their details, or write to me.
Where it's stored
The server is my own, running on a virtual private server rented from RackNerd in Atlanta, in the United States, so if you live elsewhere your shared trips are transferred there. The database is backed up every night, and backups are kept for 14 days.
Services that help
Apple
- Sign in with Apple confirms it's you and tells Splitnik an identifier for your Apple Account and, the first time, the name you choose to share. Apple doesn't tell Splitnik your password. You can stop using Sign in with Apple for Splitnik in your iPhone's Settings → your name → Sign in with Apple.
- Apple Push Notification service delivers notifications about shared trips, such as who added which expense, its amount and your share, or who paid whom back. Your own changes never notify you. Turn a trip's notifications off in Share Trip, or all of them in your iPhone's Settings → Notifications → Splitnik.
- The App Store handles the purchase of Splitnik Premium. Apple processes the payment; I receive no payment details.
Exchange rates
Download Rates (Premium) asks Splitnik's server for the day's rates. The server fetches public reference rates once a day (the European Central Bank's, and an open currency dataset for the currencies it doesn't cover) and sends nothing about you or your trips to get them.
No ads, analytics or tracking
The app contains no advertising, analytics or crash-reporting code, and doesn't track you across apps or websites. If you've chosen in iOS to share analytics with app developers, Apple may send me anonymous crash reports, under Apple's terms.
This website
This site has no cookies, no analytics and nothing loaded from other servers. The web server keeps standard access logs (address, time, page) for a short time to keep it running and secure. An invite link (/join/…) shows its code on the page; the code is read in your browser and not stored.
How long data is kept
- A shared trip stays on the server while it's shared. When whoever started it taps Stop Sharing, the server copy, its photos and its code are deleted; every member keeps their own copy on their iPhone, which no longer syncs. When the last member leaves, the trip is deleted the same way.
- When you leave a trip, your membership is deleted and the person you were is freed. What you added stays in the trip, because it's part of the group's book.
- Deleted expenses, transfers and people leave a small marker so every phone learns they're gone.
- Your account is kept until you delete it.
- Backups roll off after 14 days, and server logs after a short time.
Deleting your account
In the app, go to Settings → Delete Account and sign in with Apple once more to confirm. Splitnik deletes your account, sessions and push tokens right away, ends the link to your Apple Account, and takes you out of every shared trip: a trip you started passes to the next member, or is deleted with its photos if nobody else is in it. Trips on your iPhone stay there. Backups containing your data roll off within 14 days. You can also email splitnik@ilyav.net and I'll delete it for you.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your data, and to object to or restrict how it's used. Write to splitnik@ilyav.net; I'll answer within 30 days. You can also complain to your data protection authority. The legal basis for storing a shared trip is providing the service you asked for (performance of a contract).
Children
Splitnik isn't directed at children under 13, and I don't knowingly collect data from them. A child can be a name on a family trip that a parent keeps.
Changes
If this policy changes, the new version will be posted here with a new date. Significant changes will be announced in the app.