Splendo · last updated 1 November 2026
Splendo lets a group of people record shared expenses and see who owes whom. This policy describes exactly what the app stores, why, and who else sees it. It covers the iOS app, the Android app and the service behind them. Where the two apps differ, it says which one it means.
| Data | Why |
|---|---|
| Display name | So the people in your groups can tell who added an expense. Chosen by you; it does not have to be your legal name. |
| Email address (optional) | Only if you sign in by email. It is used to send you a one-time sign-in code, to recognise you when you sign in again, and — if somebody adds you to a group by that address — to tell you so, once per group, and to send you one reminder if a group you started is still waiting for its first member. If you continue as a guest, or sign in with Apple using Hide My Email, we never hold your real address. |
| Profile picture (optional) | Shown to the members of your groups. You can pick one of our built-in characters instead of uploading a photo. |
| Groups, expenses, settlements and comments | The content of the app. Visible to the members of the group the entry belongs to, and to nobody else. |
| Receipt and expense photos (optional) | Attached to an expense so the group can check it. See “Scanning a receipt” below. |
| A device identifier | Sent on every sign-in, whichever way you sign in, so that a session can be tied to the device it was issued to — which is what lets us notice a stolen token being replayed somewhere else. It also lets a guest account survive being closed and reopened. On iOS it is Apple's per-vendor identifier; on Android it is a random identifier the app creates when it is installed, not a hardware identifier. Neither is an advertising identifier, and it is not shared with anyone. |
| Contacts' email addresses (optional) | Only if you grant contacts access, and only to check which of them already have an account. iOS app only, for now. See “Finding people you know” below. |
| How the app is used | Counts and timings — which screens open, which steps finish, which failures people meet. See “How we count usage” below. |
| Whether an Apple Ads ad brought the install (iOS only) | Once, on first launch, counted as usage and not tied to your account. See “How we count usage” below. |
| Payment details (optional) | Only if you add them in Settings: an IBAN, a PIX key or a UPI ID, and the account holder's name. Shown to the members of your groups so they know where to pay you back. The app never moves money. Deleted when you remove them or delete your account. |
| A notification token (optional) | Only if you allow notifications. It lets us send the notifications you chose. On iPhone it comes from Apple; on Android, from Google's Firebase Cloud Messaging. Removed when you sign out or delete your account. |
This is only in the iOS app for now; the Android app does not ask for your contacts.
If you tap “Find contacts on Splendo” and allow access, the app sends us the email addresses from your contacts — nothing else. Not names, not phone numbers, not anything else on the card. We compare them against the accounts we hold and answer, for each one, whether it has an account.
Nothing about a non-match is kept. No table is written, addresses are never logged at any level, and the answer carries back only the addresses you sent us. An address with no account leaves no trace of having been asked about.
The feature is an accelerator, never a requirement: everything on that screen works without it, and declining costs you nothing. Most address-book entries have no email saved, so this finds only a fraction of the people you know — the app says so on the screen rather than letting a thin result read as a small user base.
When a member of a group adds you by typing your email address, we send that address at most one email per group, ever: who added you and to which group, and — if you have no account — the group's invite link. It is never marketing, and nothing in it reports whether you opened it.
So that it goes only once, we keep a keyed hash of the address beside the group — not the address. It cannot be turned back into the address without a secret key that never leaves our server. If you have no account, your address is not stored anywhere else.
If you start a group, nobody else has joined it, and we cannot reach you with a notification, we may send your account's email address one email: the group's name and its invite link, so you can send it to your friends. It goes at most once to each person, ever. It is never marketing, and nothing in it reports whether you opened it.
Every such email carries a link that stops it for good, with one click and no sign-in. To honour that, we keep a record that your account asked not to get it.
The app reports what people do with it, so we can see which parts work and which fail. These reports carry no account identifier — not your user id, not your email, nothing that joins a row back to you. They are grouped by a session, which is a fresh random value each time the app starts.
An event cannot contain free text, and that is a property of how it is built rather than a promise to remember: a group's name, an expense description, a merchant, a note and an amount are all impossible to put in one. What an event can carry is a count, a duration, a yes/no, and a word from a fixed list we wrote in advance.
The honest cost of that choice: because no row names an account, we cannot delete one person's usage records on request. There is nothing to find. We think rows nobody can attribute to a person are the better position, and we would rather say so than leave it out.
The iOS app, on its first launch, asks Apple whether an Apple Ads ad brought the install. The answer — campaign, ad group, keyword, country and whether it is a first download — is recorded once, as one of these usage counts, with no account attached. We do not use the advertising identifier, there is no permission prompt, and the answer is shared with no one. If you have turned usage reports off, the app does not ask.
These reports are kept for 90 days and then removed.
The gift draw on our website (Secret Santa, /c/new) needs no account, no email address and no app. Whoever makes a draw types it in; we store only what the draw needs:
Whoever made the draw sees every person's link on their own page, so they could open any of them. Their page itself never shows who drew whom; a person's link shows only that person's result. Our logs never carry a link's code.
A draw is deleted, with every name and link in it, 30 days after its date, or 60 days after it was made if it has no date. The deletion runs once a day, so it happens within a day of that time. A deleted link cannot be opened again.
Separately, we keep a daily count of draws made, people in them, links opened, results shown and taps on the Splendo line. Each count holds only a day, a language, which of these it counts, and a number — no name, link, address or draw.
So the app opens and works without a connection, some of what you have already seen is kept on the device itself:
| What | Why |
|---|---|
| Your own name, photo and account id | So the app can open while you are offline instead of asking you to sign in again. Your sign-in tokens are kept separately: in the iOS Keychain on iPhone, and on Android in encrypted storage whose key is held by the Android Keystore. |
| Expenses you enter with no connection | Held on the phone until there is a signal, then sent. Until then they exist nowhere else — not on our servers, and not for anyone else in the group. |
| A copy of what you last loaded | Your groups and their expenses, so those screens still work with no signal. It is a copy of what the app had already shown you. |
None of this is sent anywhere; it is on your phone. It is removed when you sign out, and it goes with the app if you delete it.
Both apps, on iPhone and on Android, can read a receipt. You take a photo or choose one, and the image is sent to Anthropic, which reads the amount, the merchant and the date and sends them back. The result is filled into the form as a draft for you to check — nothing is saved until you confirm it.
The image is sent for that one request and is not used to train models. If you never use the scan button, no image ever leaves your device for this purpose.
Each of these acts on our instructions and for no other purpose.
You can join a group from its invite link in a browser with only a
name. The browser then keeps you signed in with one cookie,
__Host-splendo_session, for 30 days; it is needed for the
service to work and is not used for anything else. The name you type is
shown only to the members of that group. Without an e-mail, the account
lives in that browser alone: add an e-mail to keep it, or delete it from
the group's page in the browser.
Your account and its content are kept until you delete them. Sign-in codes expire within minutes. An account made in a browser without an e-mail, not used for 30 days, is deleted automatically if its balance is zero in every group; one with money on it stays, because it is part of other people's balances.
In the iOS app: Profile → Settings → Delete Account. In the Android app: Settings → Advanced → Delete Account. This removes your account and your personal details. If you cannot open the app, this page says how to ask us instead, and lists exactly what is deleted and what stays.
One thing it cannot remove: expenses you added to a group stay in that group's history, because they are part of other people's balances. An expense you paid for is also a record of what everyone else owes, and erasing it would silently change what they owe. Your name is removed from those entries.
Splendo is not directed at children under 13, and we do not knowingly collect their data.
If this policy changes, the date at the top changes with it. The last change, on 1 November 2026, added payment details, notifications and receipt scanning on Android, joining a group from a browser without an account, and the one reminder email about a group nobody has joined.
Questions, or a request to see or delete your data: info@splendo.app.