Privacy

One person, as a personal side project. There is no company behind it, no registered business, and no data protection officer — just an individual paying for a server.

You can reach me at eachsplit.support@gmail.com. That address is the whole support department.

If you make an account

Your display name, your email address, and your password. The password itself is never stored: what is kept is a one-way scramble of it, enough to check a login and impossible to turn back into the password — not by me, and not by anybody who got hold of the database.

Also recorded: the date you ticked the box accepting this policy, and which version of it you accepted. That is kept so that if this page changes later, it is clear what you actually agreed to.

If you use Continue with Google instead, Google hands over your Google account ID, your email, your name, and a link to your profile picture. The picture link is stored but never displayed anywhere in the app, so your browser never requests anything from Google while you use the site.

If you don't make an account

Guests get a real but nameless account behind the scenes, holding only the name you typed. People who open a share link and claim their items are lighter still: a first name, and a cookie so the same browser is recognised next time. No account is created for them.

Your bills

Everything the receipt says — the merchant, its location, the date, every line item and amount, the tax and tip — plus anything you add yourself: notes, comments, who paid, and who owes whom. Records of repayments you mark as settled are kept too. EachSplit never moves money and has no connection to your bank or card; a settlement here is a note that says someone paid you back, nothing more.

Receipt files

The photo or PDF you upload is kept. Photos are converted to a single JPEG, and the hidden EXIF data that phones attach — which can include the GPS location where the photo was taken — is stripped in the process. PDFs are stored exactly as you uploaded them, so if a PDF carries metadata of its own, that metadata is kept.

Technical bits

Your IP address and which browser you used are recorded with each sign-in, and your IP is recorded when you watch an ad for a scan stamp. There is also a plain event log — “a bill was created”, “a receipt was scanned” — that I use to see whether the app is working. It records no IP addresses and no receipt contents.

Only the ones the site cannot work without. No tracking cookies, no analytics SDK, no third-party scripts of any kind.

• ss_session · 30 days

  Keeps you signed in.

• ss_claim · 400 days

  Remembers a browser that has claimed items on a share link, so that if you ever make an account, the bills you were part of come with you. It is long-lived on purpose — someone who claimed the onion rings six months ago should still get that bill.

• ss_oauth_state / ss_oauth_verifier · a few minutes

  Used only during Google sign-in, to make sure the reply coming back is really from Google.

• ss_signup_pending · 20 minutes

  Set only if you press Continue with Google from the sign-in page and turn out not to have an account yet. It holds your place while you read this page, so that ticking the box finishes the sign-in you started instead of sending you back to an empty form. It is deleted the moment your account is made, and expires on its own if you change your mind.

• ss_privacy_accept · a few minutes

  Set only if you tick the box below the signup form and then choose Google. It carries that tick across the trip to Google and back, so your acceptance can be recorded against the new account. It is deleted the moment you land back here.

Your browser also remembers whether you muted the sound effects and how you like lists sorted. And while you are filling in the signup form, it holds on to the name and email you have typed so far — not your password — so that going off to read this page doesn't make you start again; it is discarded when you finish signing up or close the tab. All of that stays in your browser and is never sent anywhere.

On a server rented from OVHcloud, in the United States. Your bills and your receipt files stay there — they are not copied out to a cloud storage bucket, a content delivery network, or a third-party backup service.

Receipt files are never published on the web. There is no address that reaches one on its own; a receipt is shown only once the app has confirmed you are on that bill. So it cannot be stumbled across, and it will not turn up in a search engine.

The database is backed up daily and only the last week of backups is kept. That means something removed can still exist in a backup copy for up to seven days before it ages out.

LlamaIndex — reads your receipts

When you scan a receipt, the image or PDF is uploaded to LlamaIndex (LlamaCloud) so their system can read the text off it. This is the only time your data leaves the server, and it only happens for receipts you actually scan — typing a bill in by hand sends nothing anywhere.

LlamaIndex's published documentation states that uploaded files are cached for 48 hours and then permanently deleted from their servers, and that customer data is “kept private to you only and is used only to return your results, never for model training”. Those are their commitments rather than mine — you can read them in their FAQ. I have no separate contract with them beyond the standard terms accepted when signing up.

Google — only if you choose it

If you sign in with Google, Google necessarily knows you did. If you sign up with an email and password instead, Google is not involved at all.

OVHcloud — hosts the server

As the hosting provider they have the physical access to the machine that any hosting provider has.

Me

I run the server, so I can see what is on it — including bills, comments, and receipt images — through the admin panel or the database directly. I look when something is broken or is being abused, not for entertainment, but you should know the access exists. It is worth assuming this is true of every small self-hosted app you use, whether or not its privacy page admits it.

Nobody else

Your data is not sold, rented, or shared with advertisers, data brokers, or anyone else. There is nothing else in the request path — no CDN, no error tracking service, no analytics company.

EachSplit is free and is meant to stay free, with short optional ads paying for receipt scans. Right now there is no real ad network — what you see is a built-in placeholder that runs for two seconds. Nothing about you is sent to an advertiser, because there is no advertiser yet.

At some point that will likely change, most probably to Google's ad platform, though nothing is decided. An ad network would be able to set its own cookies and see your IP address, which is a real change to this page rather than a footnote. So: this page will be updated before any ad network goes live, and a cookie notice will appear at that point. Until you see that, there is nothing tracking you here.

For as long as they are useful to you, and no longer than you want them. Nothing is on a timer: a split from two years ago is still there when you go looking for it, which is most of the point of keeping the account. The other half of that is the section below — anything here comes off when you ask for it to.

Because nothing expires on its own, removal is something you ask for rather than something that quietly happens in the background. Deleting a bill takes it out of the app for everyone on it straight away and its receipt stops being reachable; the stored copy of that file comes off the server when you ask. Deactivating an account works the same way — it stops working and is signed out everywhere, and the record behind it is cleared on request.

That is deliberate rather than lazy. A bill is rarely only yours — four other people may be relying on the same receipt — so removing rows the moment one person taps delete would rewrite the arithmetic on their bills too. Asking first is what stops that happening by accident.

Expired sign-in sessions clear themselves, and backups roll off after seven days.

Email eachsplit.support@gmail.com from the address on your account and say what you want. There is no button for this in the app — I do it by hand — and I'll aim to have it done within 30 days. It is an ordinary request, not a special case: this is simply how data comes off the site.

For deletion, what I can do is remove the things that identify you: your name, email, password, Google connection, sessions and stored IP addresses. Bills you shared with other people stay, with your name replaced, because those records are equally theirs and deleting them would break their splits. If a bill was only ever yours, it can go entirely — just say so.

EachSplitis not for anyone under 16. If you are under 16, please don't use it. If you believe a child has been using it, email me and I will remove the account.

The sensible things are done: passwords and sign-in tokens are kept only in a form that cannot be turned back into the original, so a copy of the database would not hand anybody a working login; the whole site runs over HTTPS; and receipt files are never published on the web. Beyond that I would rather tell you what holds than publish an inventory of how — a list of the defences is of more use to somebody attacking the site than it is to you.

But this is one person's side project on one server, not a company with a security team. I can't promise you the kind of guarantee a business would put in writing, and I would rather say so here than imply otherwise. Weigh that when you decide what to upload.

If what the app does with your data changes, this page changes with it, and the date at the top moves. The significant one to watch for is ads — see above.