1. Introduction
Spliz, SASU ("we", "us", "our") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights regarding your personal information. The data controller is Spliz SASU, 20 Rue de Coeuilly, 77340 Pontault-Combault, France, reachable at privacy@spliz.app. Our other legal information is on our Legal Notice page. Spliz is ending its payment service. Once it ends, we no longer collect payment data, except the inbound deposits described in section 2; the data of payments made before then is kept as described in section 8.
2. Data we collect
We collect the minimum data needed to provide the service: Spliz account identifier, display name and avatar (if provided), device identifiers for push notifications and expense data entered in the app (descriptions, amounts, members). Names or nicknames you give to people who have no Spliz account are stored to keep the group’s accounts; these people can exercise their rights at privacy@spliz.app. Versions using Firebase Authentication support sign-in with Apple, Google or an email link. Firebase keeps the email address and sign-in provider information, including the name and profile photo URL supplied by Google; Spliz processes the sign-in proof, which may contain that address. In its database, Spliz stores the link to the Firebase identifier, the sign-in method and pseudonymous fingerprints of authorized methods, without copying the email address or raw social identifier into those records. Historical Privy account data, including its wallet address, remains necessary to support older versions and account recovery. If you subscribe to Spliz Premium, we receive the state of your subscription (product, plan, period, start and end dates, renewal, store of purchase, subscription identifier at RevenueCat) and we record a random billing identifier, separate from your account identifier. Your contact and payment details stay with Apple or Google. Receipt scanning (optional): the photo you choose to scan and the information extracted from it (see sections 4 and 8), a monthly scan counter and a technical log without the photo or its content. Only scan till receipts, never a prescription. You review the information before creating the expense. When receipt storage is available, a notice before capture explains that a recognized receipt photo will be attached to the expense and visible to its authorized readers. You can remove the photo without deleting the expense. Without this feature, Spliz does not keep the photo after reading it. For the security of your account, we record the IP address and a device identifier on sign-in and on sensitive operations. We do not collect or store your private keys. For payments made with Spliz before its payment service ends, we have also recorded their data: amounts, sender and recipient wallet addresses, signed authorizations, transaction identifiers, USDC purchases and withdrawals made with our partner, and sanctions screening results. Once the service ends, we no longer collect this data. One exception: a deposit received on a wallet address that was linked to a Spliz account stays recorded (date, amount, sending and receiving addresses) for your history and your export.
3. How we use your data
Your data is used solely to operate Spliz. Each processing activity has a legal basis. Contract performance (GDPR Art. 6(1)(b)): creating and signing in to your account (Firebase Authentication, and Privy for older versions), expense tracking and balance calculation, your display name and avatar if you provide them, push notifications, the Spliz Premium subscription, purchase verification, receipt scanning and its counter. Legitimate interest (Art. 6(1)(f)): account security and the prevention of fraud and abuse (security log, IP address and device identifier at sign-in and during sensitive operations, app integrity checks, a limit after several failed scans), error monitoring (Sentry), technical alerts for our team (Slack), app usage analytics and website audience measurement (PostHog), handling your feedback and claims (Tally, email), keeping the data of payments made before the payment service ends and of deposits received after it ends, for your history and as evidence in case of a dispute, and keeping proof of acceptance of the terms of service (section 8). Consent (Art. 6(1)(a)): signing up to the waitlist, which you can withdraw at any time at privacy@spliz.app. You can object to processing based on our legitimate interest (section 9). We do not sell, rent, or share your personal data with third parties for marketing purposes. Our accounting obligations cover Apple's and Google's aggregate statements, not data about you.
4. Sub-processors and third-party services
Spliz relies on the following sub-processors. Each operates under its own privacy policy and only receives the minimum data needed for its purpose. Google (Firebase Authentication, authentication, US): email address, Apple or Google sign-in identifiers, name and profile photo URL supplied by Google, technical client information and IP address for authentication and abuse prevention. Privy (older versions and account recovery, US, SCCs): historical account identifiers, wallet address, email and security factors already linked to the account. Privy remains in use for older sign-ins and web wallet recovery; it does not create a wallet in mobile versions using Firebase. Alchemy and the public Base endpoint operated by Coinbase remain in use for access to historical wallets. Expo (push notifications, US, SCCs): push token, notification metadata. Sentry (error monitoring, data hosted in Frankfurt by a US company, SCCs): hashed user identifier, error stack traces, breadcrumbs (no message bodies, no expense amounts beyond truncated metadata). Slack (technical alerts for our team, US): internal technical identifiers (for example of a Spliz, a transfer or an operation) and public transaction hashes. PostHog (product usage analytics, hosted in Germany, Frankfurt, by PostHog Cloud EU): from the app, a random identifier specific to the installation; from our servers, for a few events (install source), a pseudonym of your account, computed from its identifier with a secret key. Events sent by our servers are therefore linked to your account through this pseudonym, never to your name or email address. These events carry the sign-in method, interactions (for example creating a Spliz), the campaign or link that led to the install, the screen type viewed and errors. For payments made before the payment service ends, they have also carried signing and settlement, amounts in ranges and the stage of a deposit or withdrawal. No wallet address, pseudo or email is transmitted. For app analytics, PostHog uses the IP address received in transit to estimate an approximate location (country, region and city). This location is associated with events; the IP address is removed before they are stored. Your device’s precise location is not used. This data is pseudonymous: your rights of access, objection and erasure apply to it, on request at privacy@spliz.app. Enabled by default; you can opt out anytime in Settings → Privacy, which also stops the events sent by our servers (legal basis: legitimate interest, GDPR Art. 6(1)(f), audience measurement with no advertising and no cross-app linking). No session recording. Retention: events are no longer accessible after 12 months under the PostHog plan we use; PostHog does not specify when they are permanently deleted. On request at privacy@spliz.app, we ask PostHog to delete them. Apple (APNs) and Google (FCM) (push notification delivery, US, SCCs): device token, notification title and text, and technical identifiers that open the right screen (notification type, internal identifiers of the notification, of the Spliz concerned and of your account, expiry date). The title and text are deliberately generic: no group name, no person's name, no amount. Apple (App Attest) and Google (Play Integrity) (app integrity checks, US): for some actions, such as creating a Spliz, the app asks Apple or Google to attest that the request comes from a genuine copy of Spliz on a real device; to do so they receive technical information about the app and the device, without your name or email. Cloudflare (private avatar and receipt photo storage, immutable compliance log on R2, relay for PostHog analytics, US, SCCs): avatar and stored receipt photo bytes, hashed wallet addresses for audit, IP address in transit to PostHog. Railway (hosting of the API, database and cache, US company, servers in the European Union in the Netherlands, SCCs): all backend data. Vercel (website hosting, US, SCCs): visitors' IP addresses and, for the invitation, account deletion and key export pages, the Spliz name and its creator's pseudo shown in the invitation preview. Tally (feedback forms and waitlist, Tally BV, Ghent, Belgium, data stored in the European Union, intra-EU processing): your answers and, if you provide it, your email address, kept until you ask us to delete them at privacy@spliz.app. RevenueCat (Spliz Premium subscription management, US, SCCs): a random billing identifier, separate from your account identifier, the history and state of your purchases sent by the App Store or Google Play, the store country, your connection IP address and technical device information (operating system, app version, language). Collection of advertising and device identifiers is disabled. No email, phone number, name, pseudo or wallet address is transmitted. When your account is permanently erased, we request deletion of the subscriber at RevenueCat, with automatic then manual retries until confirmed. Anthropic (automated reading of receipt photos, US, SCCs): the photo you scan, with no data from your account; Anthropic returns the merchant, date, currency and total it read, and does not use this data to train its models. Apple and Google (purchase, payment, taxes and refunds for Spliz Premium): they act as separate controllers, under their own privacy policies; Spliz receives neither your card nor your billing address. For payments made before its payment service ends, Spliz has also relied on Coinbase (USDC purchases and withdrawals: wallet address, IP for identity checks and geo-fencing), Relay (routing of inbound deposits: wallet address, on-chain transaction data), Chainalysis Oracle (read-only sanctions screening: wallet address checked against the OFAC list) and the Base network (public blockchain, see section 6). Once the service ends, they no longer receive data from Spliz. We do not sell, rent, or share your data with third parties for advertising.
5. International transfers
Some of our service providers are based outside the European Economic Area, primarily in the United States (Google (Firebase Authentication), Privy, Alchemy, Expo, RevenueCat, Anthropic, Cloudflare, Vercel, Railway, Slack, and Apple and Google for push notification delivery). Sentry and PostHog host your data in the European Union, but they are US companies, so access from the United States remains possible. These transfers are governed by Standard Contractual Clauses (SCCs) issued by the European Commission and, where applicable, by certification under the Data Privacy Framework for sub-processors that hold this certification. A Transfer Impact Assessment (TIA) is available on request at privacy@spliz.app. For payments made before the payment service ends, these transfers have also covered Coinbase, for USDC purchases and withdrawals. On-chain transaction data is stored on a decentralized network accessible globally.
6. On-chain data
Payments made with Spliz before its payment service ends are recorded on the Base blockchain and are publicly visible: wallet addresses, USDC amounts, and timestamps. Once the service ends, Spliz records no more. On-chain data cannot be deleted as it is part of the public blockchain ledger.
7. Data storage & security
Off-chain data (account info, expense details) is stored on secure servers. We use encryption in transit (TLS) and at rest. Access to production data is restricted to authorized personnel only.
8. Data retention & deletion
Firebase account links and sign-in method fingerprints are deleted from Spliz when the account is permanently purged. We then request deletion of the Firebase identity; coordinates needed for retries remain until confirmation. Firebase states that it retains IP logs for a few weeks and removes other authentication data from its live systems and backups within 180 days after the deletion request. You can delete your account at any time from the app settings or via our public deletion page (https://spliz.app/account-deletion). We retain each data category only as long as necessary, with the following maximum durations: profile, Spliz and expenses: for as long as your account exists, then as described for deletion above; authentication tokens: 24 hours; active sessions: 90 days after revocation; account in soft-delete state: 30 days grace period before irreversible erasure; in-app notifications: 90 days after they are read; avatars and push tokens: deleted at the moment you delete your account; data of payments made before the payment service ends (settlements, transfers, inbound deposits, broadcast transactions, signed authorizations, reminders, shared addresses) and deposits received after it ends on a wallet address that was linked to a Spliz account (date, amount, addresses): 5 years from the operation, then deleted, as evidence in case of a dispute (general limitation period, Article 2224 of the French Civil Code; GDPR Art. 6(1)(f)); compliance logs of these payments (sanctions screening), in our database and in the archive: 5 years, then deleted; technical data of these payments (notification dedup, network fees, relayer journal): deleted when payments are technically removed, at the latest 5 years after the operation; waiver of the right of withdrawal, if you gave one: 5 years, linked to a non-reversible fingerprint of the account identifier once the account is erased; USDC purchases and withdrawals made with our partner: deleted with your account; proof of acceptance of the terms of service (version, text fingerprint, language, method and date, plus any change notices received), linked to a non-reversible fingerprint of the account identifier, with no direct identifier: 5 years after the account is erased, to establish, exercise or defend legal claims (GDPR Art. 6(1)(f) and 17(3)(e)), then deleted; payments recorded on-chain: permanent and outside our control. Spliz Premium: subscription state, billing identifier, scan counters and log: until your account is permanently erased; purchase notifications received from RevenueCat: 90 days after receipt, or until they are processed if they failed; account security log, Premium operations included: 180 days, with the IP address truncated after 90 days; subscriber at RevenueCat: deletion requested when your account is permanently erased, with retries until confirmed; receipt photo: without storage enabled, the photo is processed temporarily for reading; with storage enabled, an unattached photo expires after 24 hours and an attached photo follows the expense, regardless of Premium. Removing the photo, deleting the expense or Spliz, or deleting its owner's account makes it inaccessible; physical deletion is retried automatically after failure; at Anthropic, deleted within 30 days, or kept up to 2 years if its safety filters flag it; reading result: 2 minutes in our cache, to avoid reading the same receipt twice. Deleting your account does not cancel your subscription: cancel it in the App Store or Google Play. Apple and Google keep their own purchase history under their own rules. Guest mode: a technical identity lets you find your Spliz without a registered account. Settings → Erase my data removes this identity and your reports and blocks, without a grace period. Spliz with no other real member are deleted. In the others, your place is anonymized and keeps its shares to preserve the group's accounts. A revocation identifier is kept for 360 days to prevent an old session from recreating your data; pseudonymized acceptance records follow the 5-year period above. Shared expenses remain until the group is deleted. Your reports and blocks follow your account if you sign up.
9. Your rights (GDPR) and automated decisions
If you are in the European Economic Area, you have the right to: access your personal data, rectify inaccurate data, request deletion of your data, restrict processing, data portability, and withdraw at any time your consent to processing that relies on it (waitlist). To exercise these rights, contact us at privacy@spliz.app. Right to object: you can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (section 3), by emailing privacy@spliz.app; we then stop the processing unless we have compelling legitimate grounds or need it to establish, exercise or defend legal claims. For usage analytics, objecting is direct and needs no reason: Settings → Privacy in the app, or the “Turn off audience measurement” link on the website. Your Premium data (subscription, billing identifier, scan log and counters) is provided on request at privacy@spliz.app; we reply within one month. United States residents: Spliz does not sell your personal information and does not share it for targeted or cross-context behavioral advertising, as those terms are defined by US state privacy laws, including the California Consumer Privacy Act. You can request access to, correction of or deletion of your data at privacy@spliz.app, whatever your state of residence, and you will not be treated differently for doing so. You also have the right to lodge a complaint with your local supervisory authority (in France: CNIL, www.cnil.fr). Automated decision-making (Art. 22 GDPR): for payments made before its payment service ends, Spliz has applied automated controls. Wallet addresses were screened against the Chainalysis on-chain sanctions oracle and against per-user transfer limits; a payment involving a sanctioned address or exceeding the limit was automatically blocked. Once the service ends, Spliz makes no more automated decisions of this kind. For a decision made before then, you keep the right under Art. 22 GDPR to obtain human review, express your point of view, and contest it: email privacy@spliz.app and we will conduct a manual review within one month. Display name and avatar are optional.
10. Cookies, tracking & product analytics
The Spliz mobile app does not use cookies. Our website (spliz.app) uses only essential cookies required for functionality. They are exempt from consent: NEXT_LOCALE remembers the language you choose, for one year; spliz_analytics_disabled remembers your objection to audience measurement (value 1), for one year. The website also keeps in your browser, without sending them, the light or dark theme you chose (spliz:appearance, until you switch back to the system setting) and, for the lifetime of the tab, the state of the homepage demo and your reading position when you change language. The wallet recovery page uses the Privy session storage needed to sign in. We do not use advertising trackers. On the website, analytics identifiers remain in memory for the page and are not retained between visits. To object to audience measurement on the website, follow the “Turn off audience measurement” link at the bottom of any page, or add ?analytics=off to the address of a page. Recognized automated browsers are also excluded. We honor Do Not Track and Global Privacy Control signals (PostHog, hosted in Europe, Frankfurt; legal basis: legitimate interest, GDPR Art. 6(1)(f), anonymous first-party audience measurement). Product usage analytics: we use PostHog (hosted in Europe, Frankfurt) to measure app usage and improve it. These statistics are on by default and pseudonymous, with no wallet address, pseudo or email (details in section 4); you can opt out anytime in Settings → Privacy (legal basis: legitimate interest, GDPR Art. 6(1)(f), no advertising tracking). No session recording.
11. Changes to this policy
We may update this privacy policy from time to time. We will tell you in the app about any significant change before it takes effect.
12. Children’s privacy
Spliz is open from age 13 and is not directed to children under 13. We do not ask for your age. We do not run advertising or advertising profiling for anyone. If we learn that an account belongs to a child under 13, we delete it along with its data. A parent or legal guardian can ask us at privacy@spliz.app to access or delete their child’s data. If you were a minor when your data was collected, you can ask us to delete it at any time; we respond within one month. Spliz Premium purchases go through Apple or Google, which apply their own age and parental approval controls.
13. Contact
For privacy-related questions or requests, contact us at privacy@spliz.app.