Privacy Policy
SubSplit ("we", "us", or "our") built the SubSplit app as a commercial service. This Privacy Policy explains how we collect, use, protect, and delete information when you use SubSplit.
Last updated: September 22, 2026
1. Information We Collect
When you create an account or use Google Sign-In, we collect your email address and account identifiers. Google Sign-In may also provide your Google account name and profile image URL; we store them with your account for identity and in-app display. If you choose a built-in SubSplit avatar, its selection key is stored with your account and on your device. Optional analytics links events only to a pseudonymous account ID.
We store subscription information you add, including service names, costs, billing cycles, renewal dates, categories, notification settings, and currency preferences. We also store expenses after you review and confirm them, including merchant, amount, date, and category.
Payment Capture is optional and off unless you turn it on. It uses Android's SMS permission to receive new incoming text messages on your device; it does not read your existing inbox and cannot send SMS. SubSplit checks only messages from registered business senders and parses them on your device to recognise a completed UPI debit from your bank, creating a local draft. Not every payment produces a text, so some payments will be missed. Message text is never stored, logged or sent to our servers. A draft counts towards no total, and no expense is saved to your account until you review and confirm it. When you confirm, only the expense fields (merchant, amount, currency, category, date and source) are synced; the message text, bank or sender, account digits, UPI IDs and bank reference numbers are not uploaded.
Gmail Scan is retired and does not collect new inbox data. Historical account-linked records may remain while your account is active, including scan job status, timestamps and counts; discovered service and candidate fields; Gmail message identifiers and processing status; diagnostic reason codes and candidate metadata; and correction history. Confirmed subscriptions created from a scan are stored as normal subscription data. Raw email bodies and OAuth tokens are not retained.
- PostHog product analytics is optional and off by default. If enabled, it can collect a pseudonymous account ID, app lifecycle and screen views, feature events, sign-in method, onboarding and notification choices, device/app details, and subscription source, billing cycle, and currency.
- Firebase Crashlytics collects crash diagnostics so we can identify and fix failures. Crash reporting is always on.
- If you enable reminders, we store a Firebase Cloud Messaging token to deliver notifications.
Diagnostic data may include app version, device model, operating system, crash time, stack traces, installation identifiers, network state, and server-side error logs. We do not use subscription, expense, or payment message content for advertising.
2. How We Use Your Information
| Data | Purpose |
|---|---|
| Email, name, Google profile image URL, avatar choice, and account identifiers | Authentication, account support, in-app display, and linking optional analytics events to a pseudonymous account ID |
| Subscription data | Recurring-charge totals, tracking, and renewal reminders |
| Confirmed expense data | Expense history, totals, and categories |
| Historical Gmail Scan metadata and candidates | Prior scan status, candidate review history, and confirmed subscription provenance while your account remains active |
| Local Payment Capture drafts | Reviewing a parsed payment before saving it |
| FCM token | Enabled reminders and service notifications |
| Optional PostHog analytics | Understanding feature usage and app performance |
| Crashlytics diagnostics and server logs | Fixing crashes, reliability problems, and abuse |
We do not sell your personal data, use it for third-party advertising, or share it for third-party marketing.
3. Third-Party Services
SubSplit uses processors for storage, authentication, notifications, diagnostics, optional analytics, logos, and currency conversion.
| Service | Purpose |
|---|---|
| Supabase | Database, authentication, and backend functions |
| Google Sign-In | Authentication and basic account identity (email, name, and profile image URL) |
| Firebase Cloud Messaging | Push notifications |
| Firebase Crashlytics | Always-on crash diagnostics and reliability monitoring |
| PostHog | Optional, default-off product usage, pseudonymous account ID, subscription metadata, and device/app analytics |
| Brandfetch | Subscription brand logos and icons |
| Exchange-rate service | Currency conversion rates |
4. Payment Capture and Device Permissions
Payment Capture requires Android's SMS permission (RECEIVE_SMS) and is disabled unless you turn it on. Android offers no narrower permission, so it grants technical access to every new incoming text. SubSplit ignores messages that are not from a registered business sender and processes matching bank messages locally to suggest an expense draft. It supports English UPI debit messages in rupees in supported bank formats, so some payments will not be captured. Android asks separately for notification permission so SubSplit can tell you when it finds a payment.
- Message text is processed in memory only and is never stored, logged or uploaded.
- The parsed draft remains on your device until you confirm or dismiss it. An unreviewed draft becomes eligible for deletion after 30 days and is removed during the next spending-data refresh or background expense sync.
- A draft counts towards no total in the app until you confirm it.
- Pausing capture in SubSplit stops it reading any messages; the SMS permission itself can be revoked in Android settings. Signing out deletes drafts.
5. Data Retention and Account Deletion
| Data | Retention |
|---|---|
| Account, subscription, and confirmed expense data | While your account is active or until you delete it |
| Raw SMS message content | Not retained; processed in memory on your device |
| Local Payment Capture drafts | On your device until you confirm or dismiss them. Unreviewed drafts become eligible for deletion after 30 days and are removed during the next spending-data refresh or background expense sync |
| FCM device tokens | Until replaced, disabled, or your account is deleted |
| Historical Gmail Scan metadata and candidates | While your account is active; removed on account deletion. Confirmed subscriptions created from a scan follow subscription-data retention. Raw email bodies and OAuth tokens are not retained |
| Legacy shared split-ledger records | Shared group, expense, participant, settlement, and activity history may remain for other group members after account deletion. Your direct phone identifier is replaced with a one-way deletion pseudonym, and your member name and photo are removed. Shared descriptions, categories, notes, amounts, and timestamps remain |
| Optional analytics and crash diagnostics | Under the applicable provider settings and policies; previously uploaded records are not automatically erased by an in-app opt-out or account deletion |
| Account deletion record | The deletion flow may retain a deleted authentication UUID and one-way email hash in a service-role-only churn record. When present, no automatic deletion period is configured; contact us to request deletion |
Account deletion removes your authentication account, profile, subscriptions, personal confirmed expenses, historical Gmail Scan jobs/candidates/metadata, FCM token, and other account-linked service data. If you previously participated in a shared split ledger, direct phone identifiers are replaced with a one-way deletion pseudonym and your member name and photo are removed; shared financial history remains so deletion does not erase or change other members' records. The deletion flow may retain a deleted authentication UUID and one-way email hash in a restricted churn record. When present, no automatic deletion period is configured for it. Email inbox@subsplit.space to request its deletion. Previously uploaded PostHog and Crashlytics records follow those providers' retention controls and are not automatically erased by the in-app deletion flow. See our account deletion page.
6. Data Security
- Data in transit is protected by TLS/HTTPS.
- Supabase Row-Level Security policies restrict account-owned data to its owner and shared split-ledger data to authorized group members.
- Optional biometric app lock is available in Privacy & Security settings.
- Expired or revoked authenticated sessions are rejected server-side.
- Account deletion is rate-limited and session-bound.
7. Your Rights and Choices
- Access your subscriptions and confirmed expenses inside the app.
- Delete your account from Settings, Privacy & Security, Delete Account.
- Request deletion from our public account deletion page.
- Keep optional PostHog analytics off or change your analytics choice in the app.
- Pause Payment Capture in SubSplit, or revoke SubSplit's SMS permission in Android settings.
- Disable notifications in SubSplit or Android settings.
- Request data access or export by contacting us.
Depending on where you live, you may have additional privacy rights. Contact us to exercise them.
8. Children's Privacy
SubSplit is not directed to children under 13. We do not knowingly collect personal information from children under 13. Contact us if you believe a child provided personal information so we can investigate and remove it.
9. Changes to This Policy
We may update this Privacy Policy. We will take reasonable steps to notify you of material changes through the app, website, or account email. The Last updated date reflects the current revision.
10. Contact Us
For privacy questions or data requests, email inbox@subsplit.space.
SubSplit is not affiliated with the subscription or payment services it helps you record. Brand logos belong to their respective owners.