Request Data Deletion

What gets deleted

A deletion request removes the following data tied to your SplitGrub account:

• Your account record (email, display name, sign-in identity, payment-rail handles).
• Bills and trips you scanned: the receipt image, parsed line items, claims, participants, payment-intent records, tip / tax / service-charge entries, and your share-math snapshots.
• Trip-host invitations you minted, and any co-host memberships you accepted.
• Authentication state: refresh tokens, device-attestation records (App Attest / Play Integrity tokens), saved payment-handle data.
• Your locally-curated lists on this device (saved parties, recent contacts) when you uninstall the app. The server-side copy of these lists is also removed by the deletion request.

Process

1. Email privacy@splitgrub.com from the address tied to your account. Subject: “Delete my account.”
2. We confirm receipt within 3 business days and may ask one or two clarifying questions to verify you're the account owner (this matters more if the account has co-hosts who share trips with you).
3. Once verified, we queue the deletion. Your data is purged from our operational database within 30 days.
4. You receive a confirmation email when deletion completes.

What we keep, and why

A small amount of data may be retained beyond account deletion when required for legitimate operational or legal purposes:

• Audit-log entries — pseudonymous records of security-relevant events (sign-in attempts, payment confirmations) where your identifiers have already been replaced with an HMAC hash. These exist for fraud investigation and are kept for up to 12 months.
• Backups — encrypted operational backups may contain your data until the backup rotates out of retention (currently 30 days). We don't actively read or restore from backups for deleted accounts; the data ages out.
• Aggregated metrics — non-identifying counts (e.g., “X receipts processed last month”) may include events from your past usage. These cannot be tied back to you.

The full retention table is in our Privacy Policy.

What about data others entered about me?

If you were a guest on someone else's bill (you tapped a magic link, picked items, paid), the host scanned and owns that receipt — not you. Deleting your own SplitGrub account doesn't remove their copy of the bill, because the bill is theirs. We hash your phone number on the host's side already, so what remains is a one-way hash plus the items you claimed, not personal data we can use to identify you.

If you want a host's copy of a bill removed, the host has to be the one to delete it — ask them. We can't override that on your behalf without their consent.

Partial deletion

You can also ask us to delete specific data without nuking the whole account — for example, a single bill, your saved payment handles, or your contacts list. Same email, just say what you'd like removed. We'll confirm scope before acting.

Questions

For anything not covered above, the canonical reference is our Privacy Policy. For questions specific to your request, reply to the confirmation email or write to privacy@splitgrub.com.