Privacy Policy

This policy explains what happens to your information when you use Chit, the receipt-splitting app, and this website. Chit is made by Xxxxxxx Systems, an independent software studio run by a small group of enthusiasts (“we”, “us”). For the online parts of Chit (accounts, syncing and sharing), we are the controller of your personal data under UK data protection law.

Questions or requests: privacy@chitsplit.app.

1. The short version

• You can use Chit without an account. Then your receipts, photos and contacts stay on your phone.
• Receipts are read on your phone. Photos are never uploaded to be recognised.
• With an account, the receipts, contacts and repayments you create are stored on our server in London, so you can share them and use more than one device. A receipt’s photos are uploaded only when you send that receipt to other people.
• We don’t sell your data, show ads, or use analytics or tracking, in the app or on this website.
• The AI assistant is optional. Before anything is sent to the AI provider, people’s names are replaced with codes.
• You can delete your account at any time, in the app or by email.

2. Using Chit without an account

Without an account, everything you put into Chit is stored only on your phone: receipts, their photos, the lines read from them, the people you add, how you split things, repayments, the item names you correct, and any payment details you type for share images.

Text recognition runs on the phone itself, using Apple’s Vision framework on iOS and Google’s ML Kit (with its model built into the app) on Android. We cannot see any of this data. It stays until you delete it or the app. Your phone’s own backups (for example iCloud or Google backups) are handled by Apple or Google under their terms.

3. What we store when you have an account

An account is optional. It is needed for sharing receipts with other people, confirming them together and using more than one device. With an account, we store:

• Sign-in details: your email address. If you use Sign in with Apple, we also store Apple’s identifier for you, the email Apple gives us (which may be a private relay address) and, if you choose to share it, your name. If you use Google, we store Google’s identifier for you, your email address and the basic profile details Google provides (name and profile picture link).
• Your profile: display name, username, colour and default currency.
• Friends: friend requests and connections between accounts.
• Your contacts in Chit: the names you give people, their colour, any rules you set (such as “doesn’t share alcohol”) and, if they have an account, the link to it. Chit never reads your phone’s address book.
• Receipts: shop, date and time, currency, total, and each line (the printed text, the readable name, amount, category, its position on the photo and how sure the recognition was). Also who took part, who paid, how lines are split, edit permissions, status, confirmations, comments, and a history of changes (who changed what, and when). Card numbers are cut down to their last four digits in the recognised text.
• Repayments: amount, who paid whom, an optional note, and whether it was confirmed.
• Photos of receipts you send to others, compressed on your phone first. Photos of receipts you keep to yourself are not uploaded. The photo itself is not edited, so anything printed on it, such as a partial card number, is visible to the people you send it to.
• Technical data: our hosting provider keeps short-lived logs of requests (such as IP address, time and the app’s requests) for security and to fix problems.

The following stay on your phone even with an account: the item names you correct, and the payment details you type for share images.

4. Information about other people

When you add people to a receipt, you record things about them: their name as you type it, what they had and what they owe. Please only add people who would expect it, and keep what you write about them fair. A person you add as a contact can see the receipts they are on only once they have an account and you have connected it, and only after you send the receipt.

If someone else has added you, your name as they typed it stays in their contacts. That is their record, and it remains theirs if you delete your account; it just stops being linked to you.

5. Sharing receipts: who can see what

• A new receipt is visible only to you.
• When you send it, the participants who have an account connected to you can see the receipt, its photos, every line, everyone’s shares, comments and the change history. Our database enforces these rules for every request.
• What participants can change depends on the permission you choose for that receipt.
• Share images are made on your phone. You choose where to send them; we never receive them. Once sent, they are outside Chit, and the people who receive them can keep or forward them.

6. The AI assistant

The assistant is optional. It is off until you choose to use it and agree to its terms in the app, and you can withdraw that agreement at any time.

• What is sent: your question, and the receipt details needed to answer it, such as shop names, item names, amounts, dates and categories.
• What is not sent: the names of the people in your contacts are replaced with codes on our server (for example “[P1]”), including where you type them in your question. Email addresses, photos and card numbers are not sent. The assistant can read only what you yourself can see.
• Provider: we haven’t chosen the AI provider yet. The assistant will not be available until we have. We will name the provider and where it processes data here and in the app’s AI terms before then, and only use a provider whose terms don’t allow it to train its models on your data.
• Changes need your tap: the assistant can only propose changes. Nothing changes until you tap “Apply”.
• Retention: conversations are deleted after 30 days. We don’t store the provider’s raw responses.

7. Subscriptions

Paid plans are bought through the App Store or Google Play. Apple or Google handles the payment; we never see your card or bank details. We use RevenueCat to check whether you have an active subscription. RevenueCat receives an identifier for your Chit account, the purchase details from the store (product, price, currency, dates and renewal status) and basic device details. We store your current plan and its status with your account.

8. Sign-in emails

If you sign in with your email address, we send you a one-time code. The email is sent through Resend from servers in Ireland, and contains only the code and a short message. The code expires after 15 minutes. We don’t send marketing email.

9. Who processes your data for us

We use a small number of providers to run Chit. They process data only on our instructions and only to provide their service:

Apple and Google provide Sign in with Apple, Google sign-in and in-app purchases under their own privacy policies, as separate controllers.

Where data goes outside the UK, we rely on UK adequacy regulations (for example for the EU, or for US companies certified under the UK Extension to the EU–US Data Privacy Framework) or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

People who work on Chit, including in the United States, may access data where needed to run and support Chit. The same safeguards and access rules apply.

10. Why we use your data (legal bases)

• To provide Chit to you (contract): your account, syncing, sharing, confirmations, comments and subscriptions.
• With your consent: the AI assistant. You can withdraw consent at any time; this doesn’t affect what was done before.
• Legitimate interests: keeping Chit secure, preventing abuse, fixing problems and answering your messages.
• Legal obligations: where the law requires us to keep or disclose information.

11. How long we keep data

• On your phone: until you delete it. The app never deletes your receipts or photos by itself.
• Your account and what it owns (profile, contacts, receipts, repayments, comments): until you delete them or your account.
• Receipts you send to others, with their photos, are kept in the cloud until the receipt’s owner deletes the receipt or their account, or until the cloud expiry period the owner chose when sending it ends, where that option is offered. When a sent receipt is deleted, it is also removed from the participants’ apps the next time they sync.
• AI assistant: conversations 30 days; proposed changes 30 days after they are applied or dismissed; monthly usage counts 13 months.
• Sign-in codes: expire after 15 minutes.
• Request logs: kept by our providers for a short period, typically days.
• Emails you send us: as long as needed to deal with them, and up to 12 months after.

Deleted data may remain in our providers’ backups for a limited period before it is overwritten.

12. Deleting your account

You can delete your account in the app or by email. Deleting it removes your account and everything it owns from our server, and, if you used Sign in with Apple, revokes Chit’s access to your Apple ID. See Delete your account for the steps and exactly what is removed.

13. Your rights

Under UK data protection law you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or give it to you in a portable format, and you can withdraw consent. Most of this you can do directly in the app. Otherwise write to privacy@chitsplit.app; we answer within one month.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

14. Children

Chit is not meant for children under 13, and they should not create an account. If you believe a child under 13 has given us personal data, contact us and we will delete it.

15. Security

Connections to our server are encrypted. Access rules are enforced by the database itself, so the app can only reach what you are allowed to see. Secret keys stay on the server. No system is perfectly secure, though, so please keep your phone and email account protected.

16. This website

chitsplit.app is a static website hosted by Cloudflare. It sets no cookies and has no analytics or tracking. Cloudflare processes your IP address to deliver the pages and protect the site. The language of the page is chosen from your browser’s language setting, which is not stored.

17. Changes to this policy

We will update this policy when Chit changes, for example when the AI provider is chosen. The date at the top shows the latest version. If a change matters for how your data is used, we will tell you in the app, and ask again where your consent is needed.