Privacy Policy
In effect from 2026-09-01
This page explains which data Split Bill processes, where it goes and how long it is kept. It was written by reading the application's source code; every duration claimed here comes from a constant in that code.
Controller and contact
Split Bill is a personal project and is not operated by a company. The controller is the individual who runs it.
For any privacy request or question: [email protected]
In short
- No advertising, no analytics, no profiling.
- No data is ever sold or shared for marketing.
- Receipt images are not stored on the server.
- Your wallet's private key or recovery phrase is never requested and never seen.
- The network is Arc Testnet, and the test USDC on it has no monetary value.
Data processed
| Data | Why | Legal basis | How long |
|---|---|---|---|
| From your Google account: account id, verified email address, display name, profile picture URL | Signing you in and linking the bills you create to you | Performance of a contract — KVKK art. 5/2-c, GDPR art. 6(1)(b) | Until you ask for deletion |
| The receipt image, and the item names and amounts read from it | Reading the receipt and listing its items | Performance of a contract — KVKK art. 5/2-c, GDPR art. 6(1)(b) | The image is not stored; the extracted list stays in your browser only |
| Shared bill: recipient and debtor wallet addresses, the labels you type, TRY amounts, signatures, payment transaction hashes | Showing each person who opens the link only their own share | Performance of a contract — KVKK art. 5/2-c, GDPR art. 6(1)(b) | Becomes unreachable after 7 days; deleted after 37 days in total |
| Saved people: the name you give and the wallet address | So you do not have to type the same person again | Performance of a contract — KVKK art. 5/2-c, GDPR art. 6(1)(b) | Until you delete them; each can be deleted from within the app |
| One-time authentication codes and the debtor session | Proving that whoever opened the link controls the address | Legitimate interest (preventing misuse) — KVKK art. 5/2-f, GDPR art. 6(1)(f) | The code STOPS WORKING after 5 minutes and the session after 15; the row itself is removed by a later cleanup |
| Rate quotes and payment offers | Proving the amount was derived from a market rate | Legitimate interest (integrity) — KVKK art. 5/2-f, GDPR art. 6(1)(f) | A quote is valid for 5 minutes. An UNUSED quote is removed by a later cleanup; a USED one is kept as proof of payment for as long as the bill is kept |
| Daily analysis counter: your account id, the day, and how many analyses you ran that day | Enforcing the daily analysis limit, so one person cannot use up everyone else's allowance | Legitimate interest (abuse prevention and cost control) — KVKK art. 5/2-f, GDPR art. 6(1)(f) | Becomes eligible for deletion after 7 days and goes in the daily cleanup; these rows are DELETED immediately when you delete your account |
Expired shared bills are deleted automatically. But there are THREE DISTINCT MOMENTS here and they should not be confused: when a record STOPS WORKING, when it becomes ELIGIBLE FOR DELETION, and when a cleanup ACTUALLY REMOVES it. After 7 days a shared bill can no longer be opened or paid; the record is kept for a further 30 days and is then removed from the database, together with its debt rows, by a daily cleanup. Analysis counters become eligible for deletion after 7 days and go in the same cleanup. Access codes, debtor sessions and unused payment quotes STOP WORKING the moment they expire; from then on they are good for nothing. The rows themselves are cleared during a later request, a limited number at a time — so "expired" and "deleted" are not the same moment. A used payment quote is kept as proof of payment for as long as the bill is kept. If you want something gone sooner, you can write to the address above.
Who receives data
No data goes anywhere other than the parties below. A new outbound connection cannot be added to the application without adding the party to this list; a test enforces that.
| Party | What goes there | Why |
|---|---|---|
| Sign-in; email, name and profile picture URL come back | Sign in with Google | |
| OpenAI | The receipt image itself | Reading the receipt. The request asks OpenAI not to retain it (store: false) |
| CoinGecko | Nothing about you; only a rate query | Fetching the USDC/TRY rate |
| The WalletConnect relay | Pairing traffic with a mobile wallet | Connecting the wallet on your phone. Only used if you take that route |
| The Arc Testnet network and its RPC servers | Wallet addresses and the transactions you send | Making the transfer happen. This data is PUBLIC. Your browser reaches MORE THAN ONE RPC server: the one the app picks and the one the wallet kit uses. The server also asks the official RPC providers when it verifies a receipt, moving on to the next one if one does not answer |
| Neon (database) and Vercel (hosting) | The records listed above | Running the application |
The blockchain is public and permanent
Your wallet address and the transfers you make sit on Arc Testnet in public view, permanently. Neither we nor anyone else can delete them; a deletion right does not reach them. Everything that links an address to a person — including the labels you type — lives in our database and can be deleted, but the chain itself cannot.
Test network
The application runs only on Arc Testnet. The USDC there is a TEST token with no monetary value. The application does not move real money.
Stored on your device
| What | Why | How long |
|---|---|---|
| Language cookie | Opening the page in the language you chose | 365 days |
| Session cookies | Keeping you signed in and your debtor check alive | For the session |
| Theme preference | Remembering light or dark | Until you clear it |
| Submission record | Stopping you from sending the same payment twice in the same browser | Until you clear it |
The submission record holds only the chain id, the request id, the kind of outcome and, if there is one, the transaction hash. Addresses, amounts, labels and signatures are NOT stored.
None of these are advertising or tracking cookies, and no third-party cookies are used.
What we do not do
- We never ask for your private key, recovery phrase or wallet password, and we cannot see them.
- We never send a transaction for you; you sign every transfer in your own wallet.
- We use no advertising network, tracking script or third-party cookie.
- We do not sell, rent or share data for marketing.
- We do not carry out automated decision-making or profiling.
Your rights
Under KVKK art. 11 and GDPR arts. 15–22 you have the right to:
- Learn whether your data is processed and request a copy of it
- Have it corrected if it is incomplete or wrong
- Have it erased
- Restrict processing and object to it
- Receive your data in a portable form
- Claim compensation if you suffer damage
If you signed in with Google you can delete your account FROM INSIDE THE APP: the "Delete my account" section on /account removes your record and your saved people. The same address opens in a browser too. For anything else, or if you cannot reach the app, writing to [email protected] is enough.
You may also complain to a supervisory authority: in Türkiye the Personal Data Protection Authority, and in the European Union the authority in your country.
Transfers abroad
Some of the providers listed above (OpenAI, Google, Neon, Vercel, CoinGecko, WalletConnect) run on servers outside Türkiye, mostly in the United States. Using the application therefore involves transferring that data to servers abroad. The transfer is necessary to provide the service and is limited to what the table above describes.
Security
- All connections are encrypted (HTTPS/TLS).
- Server secrets are read only on the server and never enter the browser bundle.
- Debtor access is verified by a wallet signature; no debt is shown without one.
- The amount in a payment request is re-derived from the debt and the rate before it is accepted.
Even so, no system is perfect. This is a personal project and has not been through a formal security audit.
Children
The application is not aimed at children and does not knowingly collect data from them.
Changes
If this text changes, the effective date above is updated. When the data the application processes changes, this text has to change too; tests in the source code enforce that.