Privacy Policy

1. What we collect

Account information. Your name and email address, always. If you sign up with a password, we store only a securely hashed version of it, never the password itself. You can also choose to sign in with Google (more on that below).

Expense data. The groups you create or join, the expenses you log (amounts, descriptions, categories, dates, who paid and how it's split), settlements, and any notes or comments you add. This is the heart of the app. RainSplit can't work without it.

Activity logs. A short record of what happens inside your groups (like “X added an expense”), so everyone in the group can see what changed and when.

Profile and group photos. Only if you choose to add one. In the mobile app, tapping “change photo” opens your photo library and asks for permission. You pick a single picture, crop it, and we shrink it on your phone before uploading it. We only receive the photo you picked. We never browse, scan or upload the rest of your library, and we never use the camera or microphone. If you sign in with Google, we may also use your Google profile picture as your starting photo, and you can replace or remove it any time.

Contacts. The mobile app can help you add a friend to a group by picking them from your phone's address book. This is strictly opt-in: the app asks for permission the first time you tap “Pick from contacts”, and you choose one person at a time. We read the name and email address of the person you select and use them to add or invite that person to your group. We don't upload your address book, we don't keep a copy of the contacts you don't pick, and we never write to or change your contacts. If you'd rather not give permission, you can type a name and email instead and nothing is lost.

Push notification tokens. If you allow notifications in the mobile app, your phone gives us a device token (a long random string that identifies your phone for notifications) along with whether it's an iOS or Android device. We store that so we can tell you when something happens in your groups, such as a new expense or a recorded settlement. The token isn't linked to your advertising ID or your location, and we remove it when you log out, when the notification service tells us the device is no longer valid, or when your account is deleted. If you turn notifications off in your phone's settings, we stop sending them.

Information stored on your device. The mobile app keeps a login session in your phone's secure storage, and keeps a local copy of recent group data so the app still opens when you're offline. If you turn on Face ID or fingerprint unlock, your phone checks your biometrics itself. We never receive or store your fingerprint or face data.

What we don't collect. We don't use third-party analytics or advertising trackers, and we don't collect your location. We don't read your contacts or photos in the background; the only ones we ever see are the ones you pick.

2. Why we collect it

• To create and secure your account, and let you log in
• To calculate balances and show who owes who, across your groups and friends
• To make adding people easy, through contacts or email invitations
• To show your profile and group photos to the people you split with
• To send you push notifications about activity in your groups
• To send you account-related email (password resets, invitations to a group)
• To let you export your own data as CSV or PDF, whenever you want it

3. Sign in with Google

If you choose “Continue with Google” on the website or in the Android app, Google confirms your identity and shares your name, email address and profile picture with us. That is all we ask for. We never see your Google password, and we can't read your Gmail, Drive, Calendar, contacts or anything else in your Google account. We use this information only to create your RainSplit account and sign you in. You can also revoke RainSplit's access at any time from your Google Account settings. RainSplit's use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements.

4. Who sees your data

Expenses and balances within a group are visible to the members of that group. That's how splitting expenses works. Your name, email, profile photo and, if you've added one, your phone number are visible to people you share a group with, so they know who they're splitting with. Your data is never visible to people outside your groups, and we don't sell or rent it to anyone.

5. Who we share it with

A few services RainSplit relies on to actually run:

• Google. If you choose to sign in with Google, used for authentication only.
• Expo, Apple and Google (push delivery). To deliver a notification, we send your device token and the notification text (for example, a short line about a new expense in your group) through Expo's push service, which hands it to Apple's or Google's notification network to reach your phone. They only see what's needed to deliver the message.
• Resend. Delivers transactional emails (password resets, invites). They see the email content needed to send it, nothing more.
• Neon & Vercel. Our database and hosting providers. Your data is stored on their infrastructure, encrypted at rest and in transit.

None of these providers are permitted to use your data for their own purposes. We may also disclose information if the law genuinely requires it.

6. Cookies and local storage

On the website, RainSplit uses a single session cookie to keep you logged in. That's it. No tracking cookies, no cross-site advertising cookies. The mobile app uses secure on-device storage for the same purpose.

7. Permissions, and how to take them back

The mobile app only asks for permissions when you use the feature that needs them, and none of them are required to use RainSplit. You can change your mind at any time in your phone's Settings:

• Contacts: only used when you tap “Pick from contacts”.
• Photos: only used when you choose a profile or group picture.
• Notifications: turn them off and we stop sending, and you can log out to remove your device token straight away.
• Face ID / biometrics: optional app lock, handled entirely by your phone.

8. How long we keep it

We keep your data for as long as your account is active. You can delete your account yourself, from Profile in the app or on the website; see how to delete your account. Deleting removes your name, email, phone, address, UPI ID, photo, sign-in details, sessions, device tokens and comments straight away. Expenses and settlements you shared with other people are kept with your name replaced by “Deleted user”, so their balances stay correct. If you can't sign in, email hello@rainsplit.com and we'll delete it for you, usually within a few days.

9. Your rights

You can, at any time:

• Ask what data we hold about you
• Export your expense and group data (CSV/PDF, right from the app)
• Ask us to correct inaccurate information
• Ask us to delete your account and data

Just email hello@rainsplit.com. We aim to respond within a reasonable time, in line with applicable Indian data protection law.

10. Security

We use industry-standard practices to keep your data safe: encrypted connections, hashed passwords, secure on-device storage for your login, and access controls on our database. No system is 100% unbreakable, but we take this seriously. It's your financial data, shared with people you trust.

11. Children's privacy

RainSplit isn't directed at children, and we don't knowingly collect data from anyone under the age required by law to consent to this kind of service in their country.

12. Changes to this policy

If this policy changes in a meaningful way, we'll update the date at the top of this page. Big changes that affect how your data is used will be communicated more directly.

13. Contact

Questions, concerns, or a data request? Reach hello@rainsplit.com.