Plain English Summary: Xpensplit collects only what is necessary to run the app. We never sell your personal data. You can export or delete your data at any time from within the app. Ads on the free tier are served by Google AdMob using contextual signals; you can opt out via your device settings.
1 Information We Collect
1.1 Information You Provide
- Account Information: Name, email address, profile photo (optional), and default currency when you register.
- Authentication Data: If you sign in with Google or Apple, we receive your name and email from those providers. We do not receive your password.
- Expense Data: Descriptions, amounts, currencies, categories, payer information, and split configurations you enter.
- Receipt Images: Photos you take or upload for receipt scanning. Stored in Firebase Storage.
- Group & Member Data: Group names, cover photos, and member lists including guest/placeholder profiles (name only, no account required).
- Settlement Records: Payment notes and settlement confirmations between group members.
- Communications: If you contact us for support, we retain that correspondence.
1.2 Information Collected Automatically
- Usage Analytics: App screens visited, features used, session duration — collected via Firebase Analytics (anonymised and aggregated).
- Crash Reports: Device model, OS version, app version, and stack traces collected via Firebase Crashlytics when the app crashes.
- Device Token: Firebase Cloud Messaging token for delivering push notifications to your device.
- Subscription Status: Purchase history and entitlement status via Adapty (anonymised user ID).
- Ad Identifiers: If you use the free tier, Google AdMob may collect your device advertising identifier (IDFA on iOS, GAID on Android) unless you have opted out at the OS level.
1.3 Information We Do NOT Collect
- Bank account or payment card details (we do not process payments)
- Precise GPS location
- Contacts list (group invites use shareable links, not contact scanning)
- Biometric data (Face ID / fingerprint authentication is handled entirely by your device OS)
2 How We Use Your Information
| Purpose |
Data Used |
Basis |
| Provide and operate the Xpensplit service |
Account info, expense data, group data |
Contract performance |
| Real-time sync of expenses across group members |
Expense and settlement data |
Contract performance |
| Send push notifications for new expenses and settlements |
FCM token, group membership |
Consent (opt-in) |
| Process and manage subscriptions |
User ID, purchase receipt |
Contract performance |
| Display contextual ads on the free tier |
Device ad identifier, usage context |
Consent / Legitimate interest |
| Improve the app via anonymised usage analytics |
Aggregated usage data |
Legitimate interest |
| Diagnose crashes and fix bugs |
Crash reports, device info |
Legitimate interest |
| Respond to support requests |
Email, support correspondence |
Legitimate interest / Contract |
| Comply with legal obligations |
As required by applicable law |
Legal obligation |
3 Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:
- Contract Performance (Art. 6(1)(b)): Processing necessary to provide the Xpensplit service you have signed up for.
- Consent (Art. 6(1)(a)): Push notifications, marketing analytics, and advertising identifiers. You may withdraw consent at any time via app Settings.
- Legitimate Interests (Art. 6(1)(f)): App improvement analytics, fraud prevention, and crash diagnostics, where these interests are not overridden by your rights.
- Legal Obligation (Art. 6(1)(c)): Where we are required to process data to comply with applicable law.
You have the right to object to processing based on legitimate interests at any time by contacting us at apps@appaspecttechnologies.com.
4 Data Sharing & Third Parties
We do not sell, rent, or trade your personal data. We share data only with the following trusted service providers who process data on our behalf:
| Provider |
Purpose |
Data Shared |
Location |
| Google Firebase |
Authentication, database, storage, notifications, analytics, crash reporting |
Account data, usage data, crash data |
USA (SCCs in place) |
| Google AdMob |
Advertising (free tier only) |
Device ad identifier, contextual signals |
USA (SCCs in place) |
| Adapty |
Subscription & in-app purchase management |
Anonymised user ID, purchase receipt |
USA / EU |
| Open Exchange Rates |
Live currency conversion (Pro tier) |
No personal data — API request only |
USA |
4.1 Group Data Visibility
Expense and balance data within a group is visible to all members of that group, including guest/placeholder profiles created by group organisers. Please only add expenses and notes you are comfortable sharing with your group.
4.2 Legal Disclosures
We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that such action is necessary to protect the rights or safety of AppAspect Technologies, our users, or the public.
5 Data Retention
- Active Account: We retain your data for as long as your account is active.
- Deleted Account: Upon account deletion, your personal profile data is removed within 30 days. Expense records in shared groups are anonymised (your name replaced with “Deleted User”) to preserve the financial integrity of other group members’ records.
- Receipt Images: Deleted within 30 days of account deletion.
- Crash Logs: Retained for 90 days by Firebase Crashlytics.
- Analytics: Aggregated and anonymised; retained for up to 14 months per Firebase Analytics defaults.
- Support Correspondence: Retained for 2 years from the date of last contact.
7 Children’s Privacy
Xpensplit is not directed at children under the age of 13 (or 16 in the EEA where applicable). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately and we will take steps to delete it.
8 Security
- All data is transmitted over TLS 1.2 or higher.
- Data stored in Firebase Firestore and Firebase Storage is encrypted at rest using AES-256.
- Firebase Security Rules enforce that only authenticated, authorised group members can access group data.
- Firebase App Check is enabled to prevent unauthorised API access.
- Biometric app lock (Face ID / fingerprint) is available as an optional in-app setting.
- We conduct periodic reviews of our security practices.
No method of transmission or storage is 100% secure. While we use industry-standard measures, we cannot guarantee absolute security. If you discover a security vulnerability, please disclose it responsibly to apps@appaspecttechnologies.com.
9 International Data Transfers
Xpensplit is operated by AppAspect Technologies, based in India. Our infrastructure providers (Google Firebase, AdMob, Adapty) process data in the United States and other countries.
For transfers from the EEA or UK to the USA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure an adequate level of data protection.
For Indian users, data processing complies with the India Digital Personal Data Protection Act, 2023 as detailed in Section 10.
10 India — DPDP Act 2023
AppAspect Technologies complies with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India. As a Data Fiduciary, we:
- Collect personal data only for lawful, specified purposes with your explicit consent.
- Provide you with a clear and accessible mechanism to withdraw consent at any time via the app’s Privacy Controls settings.
- Honour your right to access, correct, and erase your personal data.
- Ensure that data processors (Firebase, AdMob, Adapty) are contractually bound to equivalent protection standards.
11 Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Update the “Effective Date” at the top of this page.
- Send a push notification or in-app alert for significant changes.
- Where required by law, obtain fresh consent.
Your continued use of Xpensplit after the effective date of any changes constitutes your acceptance of the updated policy.
12 Contact
For any questions, data requests, or concerns about this Privacy Policy, please contact us: