Your data, plainly explained

Effective 9 August 2026 · Last updated 9 August 2026

Splimo is a shared expense ledger. What you record — expenses, settlements, group names, comments — is visible to the members of the group or friendship it belongs to; that is the point of the app. We collect only what the service needs, store it in India, never sell it, and let you delete your account and data at any time.

1. Who we are

Splimo ("we", "us") is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"). This policy covers the Splimo mobile app and the splimo.app website.

2. Data we collect

Account data — your email address and, if you sign in with Google, your Google account name and email. Passwords are stored only as salted hashes by our authentication provider; we never see them.
Profile data — the display name you choose, and optionally a mobile number if you add one.
Expense data — expenses, amounts, splits, settlements, groups, comments and notes you record.
Friends you add — the name and, optionally, phone number you enter for a friend, so balances can be tracked.
Contacts (only with your permission) — if you use "Pick from contacts", your phone book is read on your device so you can choose a person. Only the single contact you select is saved. We never upload your full contact list and never use contacts for marketing.
Technical data — device type, app version, and crash and error logs, used only to keep the app working.

We do not collect or store your UPI ID, bank account details, card numbers or UPI PIN. We have no way to see them.

3. How we use your data

Each purpose is tied to the data it needs:

Providing the service — storing and syncing your ledger, showing balances to you and your group members.
Authentication — verifying your identity by email and password, or by Google sign-in, through Supabase Auth.
Transactional email — password resets, email confirmation and security notices, delivered by our email provider.
Notifications — telling group members about expenses and settlements that involve them, through Firebase Cloud Messaging.
Safety and improvement — fixing crashes and preventing abuse.

We do not sell personal data, and we do not share it with third parties for their own marketing.

4. Consent, and how to withdraw it

We process your data on the basis of your consent under the DPDP Act. Withdrawing it is as easy as giving it: revoke the contacts permission in your system settings at any time, and delete your account (Account → Delete account) to withdraw consent for the service as a whole. You may also write to support@splimo.app to exercise any right or raise a complaint, and escalate to the Data Protection Board of India if you remain unsatisfied.

5. Where your data lives, and who processes it

Your ledger is stored in a Supabase (PostgreSQL) database hosted on AWS in Mumbai, India (ap-south-1). Your data stays in India. These processors act on our behalf under their own security commitments:

Supabase — database, authentication and file storage.
Google Firebase — push notifications only. Firebase is no longer used for sign-in.
Resend — delivery of transactional email (password resets, security notices). Your address and the message are processed abroad by this provider.
Google Sign-In — if you choose it, Google confirms your identity to us. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

6. Payments

Splimo never holds, transfers or processes money, and it does not store anyone's UPI ID or bank account details. You pay a friend in whatever app you already use (such as Google Pay, PhonePe or Paytm), then record that payment in Splimo. The payment itself — and any data collected during it — is governed entirely by that app and your bank. Marking a settlement in Splimo is a record you create, not proof that a payment happened.

7. What other users can see

Shared ledger data — expenses, settlements, comments, group membership — is visible to the other members of that group or friendship, including after you delete your account, because their ledgers must stay correct. In that case your entries remain in de-identified form. Beyond this, we disclose data only to the processors listed above, when the law requires it, or in a business transfer (with notice to you).

8. Retention and deletion

We keep your data while your account is active. Deleting your account schedules erasure after a 24-hour grace window, during which signing back in cancels it. After that, your profile and personal identifiers are removed; shared expense records are retained in other users' ledgers in de-identified form. You can also request deletion without the app by emailing support@splimo.app.

9. Security

Data travels encrypted over TLS and is protected server-side by row-level security — every request is checked so you can only reach the groups and friends you belong to. Passwords are hashed, never stored in readable form. Changing your password signs out every other device. If a breach affecting your personal data occurs, we will notify you and the Data Protection Board of India as the DPDP Act requires.

10. Your rights

Under the DPDP Act you may access a summary of your personal data and how it is processed; correct, complete, update or erase it; have grievances redressed; and nominate someone to exercise these rights if you are unable to. Use the in-app Account screen or email support@splimo.app. We acknowledge within 72 hours and aim to resolve within 30 days.

11. Children

Splimo is for users aged 18 and above. We do not knowingly collect data from anyone under 18. If you believe a minor is using the service, contact us and we will remove the account.

12. Advertising and subscriptions (not yet live)

If advertising is introduced, it will be served by Google AdMob, which may use your device's advertising ID; you can reset it or opt out of ad personalisation in your device settings. This policy will be updated before any ads go live. Premium subscriptions, if introduced, will be billed by Google Play — we receive your subscription status, never your card details.

13. Grievance Officer

Grievance Officer, Splimo
Email: support@splimo.app

Complaints are acknowledged within 72 hours and resolved within 30 days. If you remain unsatisfied, you may complain to the Data Protection Board of India.

14. Changes to this policy

We may update this policy as the app evolves. Material changes will be announced in the app before they take effect. Continued use after the stated effective date means the updated policy applies.