Splitaway Privacy Policy

Deutsche Fassung

Summary

Splitaway is an app for splitting expenses within a group – on trips, in a shared flat or among friends. So that every member of a group sees the same numbers, groups and expenses are stored with your account on Google Firebase.

• No ads, no analytics, no tracking.
• We only store what the group needs: your name, optionally a profile picture, your groups and your expenses.
• Expenses are visible only to you and the members of that group.

This policy covers the iOS app. The website maxmuhr.com has its own privacy policy (in German).

1. Controller

Max Muhr
Paul-Schallück-Straße 5
50939 Köln
Germany
Email: app@maxmuhr.com

We are not required by law to appoint a data protection officer.

2. Account and sign-in

To use the app you create an account. Sign-in is handled by Firebase Authentication, a service of Google Ireland Limited:

• Sign in with Apple: Apple provides a user identifier and – if you agree – your name and email address. With “Hide My Email” you can have your address replaced.
• Sign in with Google: Google provides the name, email address and user identifier of your Google account.
• Email and password: We store your email address; Firebase stores your password only as an encrypted hash.

Legal basis is Article 6(1)(b) GDPR (performance of the user agreement).

3. Profile, groups and expenses

The following is stored with your account in Cloud Firestore, the database of Google Firebase:

• your display name and – if you choose one – your profile picture
• the groups you belong to, with name, colour, icon and currency
• the members of a group; people without an account only with the name you enter for them
• expenses with amount, currency, purpose, date, payer and split

All members of a group see your display name, your profile picture and the expenses of that group – that is the purpose of the app. Members of other groups see none of it. Data is transmitted encrypted; a cache is kept on your device so the app also works offline. Legal basis is Article 6(1)(b) GDPR.

Invitations

Invite codes are created and checked via Firebase Cloud Functions. A code contains no personal data.

Shared data with the app “Abos”

Splitaway uses the same database as our app “Abos”. With the same account you see your groups in both apps; members who use Abos see the group there. Splitaway does not read any other data from Abos, such as your subscriptions or assets.

4. Exchange rates

To convert foreign currencies, the app loads the reference rates of the European Central Bank from the public service frankfurter.dev at most twice a day. No information about you or your expenses is sent; as with any request on the internet, the service only receives your device’s IP address. Legal basis is Article 6(1)(f) GDPR; our legitimate interest is correct currency conversion.

5. Photos

For a profile picture you pick a single image using the iOS photo picker. The app only receives that image, scales it down and stores it with your profile. It has no access to your photo library.

6. Purchase

You buy Splitaway once on the App Store. Payment is handled solely by Apple; we receive no payment data and no personal information about you. There are no further purchases inside the app.

7. What Splitaway does not do

• no usage analytics, no tracking, no advertising identifier
• no ads and no sharing of data for advertising
• no access to contacts, location, camera or bank accounts – the invite QR code is only displayed, never scanned

8. Contact

If you email us, we store your address and message to handle your request. Legal basis is Article 6(1)(b) or (f) GDPR.

9. Recipients and transfers to third countries

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Firebase: sign-in, database, Cloud Functions) – as processor
• Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland (App Store, purchase, Sign in with Apple)
• frankfurter.dev (exchange rates, see section 4)

Processing in the USA cannot be ruled out for Google and Apple. It is covered by the EU-US Data Privacy Framework, under which both companies are certified, and by EU Standard Contractual Clauses.

10. Retention and deletion

We keep your data as long as your account exists. Signing out deletes nothing – your groups are back after your next sign-in.

You can delete your account yourself in the app: Profile (top right) → “Delete account”. This deletes your sign-in account, your name and your profile picture. Expenses in shared groups remain available to the other members so their balances stay correct. On request we also remove any remaining information completely – an email to app@maxmuhr.com is enough.

11. Your rights

You have the right to

• access your stored data (Article 15 GDPR)
• rectification of inaccurate data (Article 16 GDPR)
• erasure (Article 17 GDPR)
• restriction of processing (Article 18 GDPR)
• data portability (Article 20 GDPR)
• object to processing based on Article 6(1)(f) GDPR (Article 21 GDPR)

An informal message to app@maxmuhr.com is sufficient.

You may also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

12. No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Article 22 GDPR.

13. Changes

We update this policy whenever the app changes. The version published here applies. If the German and English versions differ, the German version prevails.

Terms of use (EULA)

Use of the app is governed by Apple’s standard Licensed Application End User License Agreement: Apple Standard EULA.

Provider

Max Muhr, Paul-Schallück-Straße 5, 50939 Köln, Germany
Email: app@maxmuhr.com · VAT ID: DE348601719

Full provider information is in the Impressum (in German). Help for the app: Help & support.