EachSplit
Split a bill

Security

Is it safe to upload a receipt?

Short answer: yes, and the reason is worth more than the answer. A receipt you upload is never published on the web — there is no address that reaches one on its own, and it is shown only to people the app has confirmed are on that bill. EachSplit also has no connection to any bank or card, so there is no payment credential for anyone to steal.

The safest thing about it is what it cannot do

Most of the risk in a money app comes from the money moving through it. EachSplit has none of that surface, on purpose:

No bank connection

It never links to an account, never reads a transaction feed, and never asks for online banking credentials. There is nothing to phish out of it.

No card details

Nothing is ever charged, because there is no paid tier. No card number is collected, stored or passed to a processor.

No balance held

It is not an escrow or a wallet. Money you owe is a note between you and your friends; it never sits anywhere we control.

No money movement

You settle up however you already do — cash, a transfer, a payment app — and mark it settled here. It cannot send your money to the wrong person because it cannot send your money anywhere.

Where a receipt actually goes

A receipt is more revealing than people expect. It records where you were, at what time, what you ate, how many of you there were, and sometimes the last four digits of a card. It is treated accordingly.

  1. 1It is never published on the web. An upload does not land anywhere the site hands out on its own. No address reaches a receipt directly, so there is nothing to be found by guessing at one.
  2. 2It is shown only to people on that bill. Every request for a receipt goes through the same permission check the rest of the app uses — one check, not a copy pasted into each screen, where one copy eventually drifts out of step with the others.
  3. 3Everybody else is simply turned away. A refusal that says "you may not see this" has already confirmed that "this" exists. Somebody who is not on the bill gets an answer that confirms nothing either way.
  4. 4It is scanned, not sold. The image goes to the OCR vendor to be read into line items and nowhere else. It is not fed to an ad network and there is no analytics pipeline reading it.
  5. 5Removing it is something you ask for — and it happens. Deleting a bill takes it out of the app for everyone on it straight away, and its receipt stops being reachable. The stored file comes off the server when you ask: nothing here expires on a timer, so removal is a request rather than a background job. Ask and it goes; the privacy page sets out exactly what that covers.

What a share link does, and what it does not

The claim link is the feature that makes splitting work without accounts, and it is the one worth understanding properly. It is a capability: whoever holds it can open that bill. That is the trade that removes the sign-up, and it is the same trade a shared document link makes.

What limits the blast radius is what a link-holder is allowed to do. Somebody arriving from a link can claim their own items and leave a comment. They cannot rewrite the receipt, change what somebody else claimed, see any other bill, or reach your account. And the owner can revoke the link at any point, which stops it working for everyone at once.

Practical advice: a claim link belongs in the group chat with the people on the bill, not on a public timeline. If one does escape, revoke it — the bill and everything already claimed on it survive.

Accounts and sessions

Your bills are not searchable

Shared bills, receipt files and everything behind a sign-in are kept out of search engines twice over: once by the list crawlers read before they visit, and again by an instruction carried on the pages themselves. Belt and braces, because the first of those is only a request. A claim link pasted somewhere public still will not turn up in a search result. Only the marketing pages are crawlable at all.

What we do not claim

EachSplit is an independently run app on a small server, not a bank. It has not been through a SOC 2 audit or a formal penetration test, and it would be dishonest to imply otherwise. Receipts are stored so that they can be shown back to you, which means they are not end-to-end encrypted — an operator with server access could read them, exactly as with every other bill-splitting app that displays your receipt.

If that is more trust than a particular receipt deserves, do not upload it. The tip calculator works entirely in your browser and sends nothing to us at all, and typing a few lines in by hand never puts an image on our server. Note that the quick split is not that option — it skips the sign-up, not the storage.

Reporting a vulnerability

If you have found something, write to eachsplit.support@gmail.com with enough detail to reproduce it, and please give us a reasonable window to fix it before publishing. There is no bounty programme — it is one developer — but reports are read quickly and taken seriously, and you will be credited if you want to be.

Read the rest of it

The privacy page lists every field that is stored and for how long. The about page explains who runs this and how it pays for itself.

Split a bill

Security questions

Is it safe to upload a receipt?

Receipt images are never published on the web: there is no address that reaches one on its own, and nothing to find by guessing at one. A receipt is shown only once the app has confirmed you are on that bill, and anybody else is turned away without being told whether it exists at all. They are never handed to an advertising network or a third-party analytics service.

Can EachSplit take money from me?

No. It has no connection to any bank, card network or payment processor, holds no balance, and moves no money between anybody. It works out who owes what and stops there. You settle up directly with each other and mark it done here. There is no payment credential for anyone to steal because none is ever collected.

Who can see a bill I share a link to?

Anybody holding that link. A share link is a capability, like a door key — that is what makes it work without accounts. What a link-holder can change is deliberately narrow: they can claim their own items and comment, but they cannot rewrite the receipt, reassign somebody else's dinner, or reach any other bill. The owner can revoke the link at any point, which invalidates it for everyone.

How are passwords stored?

Your password is not stored. What is kept is a one-way scramble of it — enough to check a login, and impossible to turn back into the password itself, by us or by anybody who got hold of the database. It is also why a lost password cannot be recovered, only replaced.

Is a shared bill going to show up in Google?

No. Shared bills, receipt files and everything behind a sign-in are kept out of search engines twice over — by the list crawlers read before they visit, and again by an instruction carried on the pages themselves. A link pasted somewhere public still will not be indexed. Only the public marketing pages are crawlable.

Does the quick split store less than a normal bill?

No — and an earlier version of this page wrongly said it stored nothing. The quick split saves the bill and any receipt exactly as a normal bill does; what it skips is the sign-up, by creating a guest account tied to a cookie in your browser instead of an email and password. Closing the tab deletes nothing. The one thing on this site that genuinely stores nothing is the tip calculator, which does its arithmetic in your browser and sends nothing to us.

Can I have everything deleted?

Write to eachsplit.support@gmail.com from the address on your account. There is no button for it in the app — it is done by hand, within 30 days. What comes off is everything that identifies you: name, email, password, Google connection, sessions and stored IP addresses. A bill several people contributed to stays, with your name replaced, because it is equally their record and removing it would break their splits; a bill that was only ever yours can go entirely if you say so. Backups roll off after seven days, so a deleted thing can persist in one for up to a week.