Privacy Policy

The short version

SplitGrub helps a group settle a bill at the end of a meal. We built it because we think handling money between friends should be ten seconds of work, not ten minutes of awkward math. Privacy is a first-order concern in how we built it, not a footnote.

• We collect only the data we need to make the product work — mainly the receipt, who claimed which items, and your account and contact details. Sections 2 and 4 below list every category in full, including the guest names, activity records, and analytics we keep.
• We don't store raw phone numbers. A guest's number becomes a one-way hash as soon as it reaches us, so the same person can be recognized on a future receipt without us keeping the number itself.
• We don't process payments. When your friends pay you, the money moves through Venmo, Cash App, Zelle, PayPal, Apple Cash, or cash. We never touch it.
• We don't sell your data. We don't run ads. We don't share your data with brokers.
• You can delete your account at any time, either in the app (Settings → Manage my data, then “Delete my account”) or by emailing privacy@splitgrub.com. You do not need to contact us first.

The longer version below covers the formal details: what specifically we collect, who processes it on our behalf, your rights, and how to exercise them.

1. Who we are

“SplitGrub,” “we,” and “us” refer to the team building SplitGrub. The marketing website lives at splitgrub.app; the host app ships on iOS and Android in 2026.

This policy covers both the marketing site (where you may join the waitlist) and the SplitGrub app and guest-claim web experience (when the product launches).

2. What we collect

Marketing site & waitlist (today)

• Email address, when you submit the waitlist form. We use it to send product updates, the launch announcement, and a beta invite if you opted in. If you click a link in one of our emails, we also collect the email client you read it in.
• Beta-tester opt-in, the boolean toggle on the waitlist form.
• Usage analytics:page views, click events, referrer, device type, country (from IP geolocation only, and we never store your IP after this), and your browsing history on this site. Collected via PostHog. Your keystrokes in the email field are masked and never captured — but if you submit the waitlist form, we associate that email with your analytics profile, including pages you viewed before submitting.
• Feedback submissions:anything you type into the optional pricing/feedback form. The form doesn't ask for your email — though if you've joined the waitlist, the analytics profile described above may associate the submission with you.

SplitGrub app (post-launch)

• Account identity: your email, optional display name, and an opaque token from Apple Sign In or Google Sign In if you chose either of those over email-code sign-in.
• Receipts you scan: the photo plus the machine-extracted line items, prices, taxes, tip, total, and merchant name. Stored as long as the session is active plus a 12-month archival window.
• Claims: which guest claimed which item, and the resulting amounts owed.
• Payment metadata: which payment rail (Venmo, Cash App, Zelle, PayPal, Apple Cash, or cash) each guest used, whether the payment was confirmed, and your saved rail handles (so we can deep-link payments correctly). We do not store account credentials, card numbers, or balances for any rail.
• Guest names and hashed phone numbers:when you add someone to a bill — by typing them in, or by choosing them from your device's contacts — we receive that person's name and, if you provide one, their phone number. We store the name as you entered it, and turn the phone number into a one-way hash so the same person can be recognized on a future receipt without us keeping the number. Choosing someone from your contacts opens a picker in the app, which reads your address book on your device to show you the list. Only the people you actually select are sent to us — your address book as a whole never leaves your device.
• Device telemetry: App and OS version, and a server-side record of the actions you take in the app (which we use to understand how the product is used). These records are tied to your account and carry the IP address and user-agent of the request. We do not collect crash reports. When the app checks for an over-the-air update, it also reports the runtime version it is running and an identifier for your installation of the app.
• Approximate location (country only):once the paid tier ships, our subscription provider records the country associated with your account. Where a purchase doesn't supply one, it's derived from your IP address — the address is discarded and only the country is kept. We don't collect your precise location, and the app never asks for location permission.

3. How we use it

• To make the product work: run the OCR, render the live session, route a payment-rail deep-link to the right URL.
• To send transactional emails (sign-in codes and waitlist updates). Guest claim links are sent from the host's own device as a text message — we don't send them, and we don't collect guests' email addresses.
• To improve the product. The activity records described above tell us which features people actually use and where the experience breaks down.
• To debug and prevent abuse. Server logs and audit-log entries let us trace problems and refuse suspicious requests.

We will not use your data to train large language models or other AI systems for our own purposes, and we will not provide your data to third parties for them to train AI systems on.

4. Who else processes your data

We use third-party services to operate SplitGrub. Each has its own privacy practices. The list below is the complete set of processors we send data to directly. Each uses its own sub-processors, named in their respective data-processing agreements.

• Amazon Web Services (AWS): hosts our servers, databases, and storage. Data is held in US data centers, encrypted at rest with AES-256 and in transit with TLS 1.2+.
• Resend:sends transactional email (sign-in codes, waitlist updates, beta invites) and stores your email address as a contact so we can send waitlist and launch updates. We use Resend's click tracking, which rewrites the links in our emails — when you click one, Resend records your IP address, approximate location, device, and email client. We do not use open tracking.
• PostHog (US Cloud):product analytics and session replay. Inputs masked. We don't pipe payment handles or raw email content through events.
• Azure Document Intelligence:receipt OCR processing. Receives the photo and returns extracted text. Per Microsoft's documented service behavior, the submitted image and analysis result are retained by the service for up to 24 hours before deletion; we do not send Azure anything that ties the image to your account.
• Anthropic: language model that cleans up OCR output (merging line breaks, normalizing item descriptions), and a lightweight pre-flight that checks the uploaded image is actually a receipt before we send it to Azure. Receives the receipt image and the extracted text, but not your email and nothing that ties the receipt to a specific user, under commercial terms that do not permit training on the data.
• RevenueCat:subscription entitlement management on our behalf, once the paid tier ships. Receives the store-issued subscription receipt and the per-account identifier we assign so we can check whether your account has an active Premium entitlement. Apple or Google handles billing; RevenueCat never sees card details. RevenueCat also records the country associated with your account; where a purchase doesn't supply one, it derives the country from your IP address, discards the address, and keeps only the country.
• Expo (EAS Update): delivers over-the-air updates to the app. Receives your IP address, device platform, runtime version, and an install identifier when the app checks for an update.
• Apple & Google:when you sign in with Apple or Google, the platform handles the authentication and hands us a signed token containing your email and an opaque user ID. We don't see anything else from your Apple ID or Google Account. The app also proves it is a genuine, unmodified copy of SplitGrub running on a real device. On iOS this uses Apple's App Attest: your device asks Apple to vouch for it, and repeats that check about once a month when its device token needs renewing. Apple's response is anonymous — it carries no hardware identifiers and doesn't tell Apple who you are or what you are doing. We check that response on our own servers without contacting Apple again. On Android this uses Google Play Integrity: we send Google a device integrity token, and Google tells us whether the app and the device look genuine. Neither check carries your name, email, or account.

5. How long we keep it

• Active session data(receipt, claims, payments): kept while the session is open, plus a 12-month archival window after settlement. That window lets you look back at last month's dinner; everything older gets purged.
• Guest phone-number hashes:kept for the same duration as the receipt data they're tied to. Deleted when the receipt archive expires.
• Account data (email, display name, payment rails): kept until you delete your account or stay inactive for 24 months. At that point we send a heads-up and then deactivate.
• Audit logs:kept for 12 months, then aggregated. The per-request rows are deleted. While they are held, entries carry the IP address and the user-agent string a request came from, and entries written before an account is deleted may carry that account's identifier.
• Waitlist email: kept until you unsubscribe or we delete your account.

6. Your rights

Deleting your account. You can do this yourself in the app, without contacting us first: open Settings → Manage my dataand choose “Delete my account.” You can also request it by email, at the address below. Either way the account stops working immediately and deletion of the data begins 30 days later, with those 30 days available to undo it. Our data-deletion page sets out both routes and what each one removes.

You can email privacy@splitgrub.com to request:

• A copy of everything we hold about you, in machine-readable form.
• Correction of anything that's wrong.
• Deletion of your account and the data tied to it.
• An opt-out of any future analytics tracking on the marketing site.

California residents have additional rights under the CCPA and CPRA, including the right to know what categories of data we hold, the right to know which third-party processors we share data with, and the right to opt out of any sale or sharing of personal information. We don't sell or share personal information, but the right exists. Residents of other US states with comparable laws (Virginia, Colorado, Connecticut, Utah, and others as those laws come into effect) have parallel rights. Email the same address to exercise any of them.

7. Cookies & similar technologies

The marketing site sets a small number of cookies to support PostHog analytics. The app and guest claim experience use short-lived JSON Web Tokens stored locally on your device to keep you signed in. Neither is shared with any third party beyond the processors listed in section 4.

We respect the “Do Not Track” signal. If your browser sends one, we skip analytics for that visit.

8. Age requirement

SplitGrub is intended for adults. The minimum age to use the app is 18, matching the minimum age of the payment services (Venmo, Cash App, PayPal, Zelle, Apple Cash) the app deep-links to. The bar-tab use case also assumes the legal drinking age in the United States.

If we discover that someone under 18 has created an account, we'll delete it. Please email privacy@splitgrub.com if you believe an underage user has signed up.

The service is not directed to children, and we never knowingly collect personal information from anyone under 13 (the threshold the U.S. Children's Online Privacy Protection Act applies to).

9. Where we operate

SplitGrub is offered in the United States only. Our processors hold data in US data centers; we do not offer the service to users outside the US.

10. Security

We encrypt everything we store at rest and everything we send in transit. Authentication uses signed tokens with limited lifetimes and a rotation chain for refresh. Production system access is gated by AWS Identity Center single sign-on with multi-factor authentication and short-lived session tokens, and every server-side data mutation is recorded in a written audit log.

That said, no security model is perfect. If you discover what looks like a vulnerability or any behavior that suggests a security issue, please email security@splitgrub.com. We'll respond within one business day and we'll treat the report as confidential while we investigate.

11. Changes to this policy

When we change anything material, we'll update the effective date at the top of this page and email everyone on the waitlist or with an active account. The previous version stays available on request.

12. Contact

Privacy questions, requests, or complaints: privacy@splitgrub.com.

Security reports (suspected vulnerabilities or anything that looks like a breach): security@splitgrub.com.

For everything else (product help, billing, feedback), see splitgrub.app/support.