Privacy Policy

1. Data Controller

SplitFast ("we," "our," or "us") operates the SplitFast Telegram Mini-App. SplitFast is an independent project operated from the Czech Republic (European Union).

We aim to comply with applicable data protection laws including GDPR.

Contact: @splitfast

You may exercise any of your privacy rights by contacting us through the channel above.

This Policy is drafted in English. Translations are provided for convenience only; in case of any discrepancy, the English version prevails.

2. Personal Data We Collect

We collect the following categories of personal data:

2.1 Account Information (from Telegram)

When you use SplitFast, Telegram provides us with:

• Telegram user ID
• First name and last name
• Username (if set)
• Profile photo URL
• Language preference
• Telegram Premium status

2.2 Group Information

• Telegram group/chat ID
• Group name
• List of group members who use SplitFast
• Basic profile information (name, username, profile photo) of group members, provided by Telegram when members participate in a chat where the SplitFast bot has been added

2.3 Financial Data You Create

• Expense descriptions and amounts
• Split information (who owes what)
• Settlement records
• Currency preferences

2.4 Payment Methods (Optional)

If you add settlement methods, we store:

• Payment method type (bank, PayPal, Revolut, etc.)
• Account details you provide

Note: This information is shared with your group members when they settle debts with you.

2.5 Technical Data

We automatically collect certain technical information:

• IP addresses
• Request timestamps
• HTTP request data (headers, user agent)
• Error logs and diagnostic information

This data is used for security, debugging, and service improvement.

2.6 Receipt Images (Premium Feature)

If you use receipt scanning:

• Receipt images are stored on our servers
• Extracted data: store name, items, prices, totals
• Images remain accessible to view attached receipts
• Images are served via signed, time-limited links; only people who receive a valid link through the app (your group) can view the image

When you delete an expense, its receipt image is deleted from storage. You can also request removal of your receipt images at any time (see Section 10).

3. How We Use Your Data

Purpose	Legal Basis (GDPR)
Provide expense tracking and splitting services	Contract performance (Art. 6(1)(b))
Calculate balances between group members	Contract performance (Art. 6(1)(b))
Process receipt images to extract expense data	Contract performance (Art. 6(1)(b))
Send notifications about expenses (if enabled)	Legitimate interest (Art. 6(1)(f))
Process premium subscriptions via Telegram Stars	Contract performance (Art. 6(1)(b))
Improve our services and fix bugs	Legitimate interest (Art. 6(1)(f))
Security and abuse prevention	Legitimate interest (Art. 6(1)(f))
Comply with legal obligations	Legal obligation (Art. 6(1)(c))
Analyze how the app is used to improve the Service (analytics)	Legitimate interest (Art. 6(1)(f))

4. Cookies, Local Storage and Analytics

SplitFast does not use:

• Browser cookies
• Third-party advertising or cross-site tracking pixels

We use browser local storage for functional purposes only — for example, to remember your language preference on our website and to keep you signed in inside the mini-app. This information stays on your device and is not used for tracking.

4.1 Usage Analytics (Mini-App)

The SplitFast mini-app uses Telegram Mini Apps Analytics, an analytics service for Telegram mini-apps, to collect usage events (such as app opens, feature usage, purchases and errors) together with your Telegram user ID, platform, language and app version. Some events include details of the action performed (for example, the amount and currency of an expense you create). We use this data solely to understand how SplitFast is used and to improve it. It is not used for advertising and is never sold.

If we implement additional tracking technologies in the future, we will update this policy and obtain consent where required by law.

5. Third-Party Services

We use the following third-party services to provide our functionality:

5.1 Telegram

SplitFast operates as a Telegram Mini-App. All authentication is handled by Telegram. See Telegram's Privacy Policy.

5.2 Image Processing (Receipt Scanning)

When you scan a receipt, the image is processed by Google's AI services. See Google's Privacy Policy.

5.3 Exchange Rate APIs

We use third-party APIs to obtain currency exchange rates. These requests do not include personal data.

5.4 Cloud Storage

Receipt images and application data are stored on DigitalOcean infrastructure in the European Union (Frankfurt, Germany).

5.5 Telegram Mini Apps Analytics

The mini-app sends the usage events described in Section 4.1 to Telegram Mini Apps Analytics, an analytics service operated within the Telegram/TON ecosystem.

5.6 Website Hosting and Content Delivery

Our website (splitfast.io) is served via Cloudflare. Website pages load open-source JavaScript libraries from the unpkg.com CDN and display partner badges hosted by third parties. When a page loads, these providers receive standard technical data such as your IP address and browser information.

6. Data Retention

Data Type	Retention Period
Account data	Retained while your account is active
Expenses and settlements	Retained until you delete them or delete your account
Receipt images	Deleted together with the associated expense, or upon your request (see Section 10)
Technical logs	Retained for a reasonable period for security and debugging
Deleted account data	Permanently removed within 30 days of deletion request

7. Data Sharing

We share your data only in these circumstances:

• With group members: Expenses, splits, and balances are visible to members of the same group
• Settlement methods: Your payment details are shown to group members who owe you money
• Infrastructure providers: Our hosting and cloud service providers process data under contract
• Service providers: As described in Section 5 (third-party services)
• Legal requirements: If required by law, valid legal process, or to protect our rights

We do not sell your personal data.

8. International Data Transfers

Our primary data storage is in the European Union (Frankfurt, Germany). However, your data may be transferred to:

• European Union: Primary data storage (DigitalOcean Frankfurt)
• United States: Google Cloud services for image processing
• Other locations: Service providers listed in Section 5 (such as Telegram and analytics) may process technical and usage data outside the EU/EEA

For transfers outside the EU/EEA, we rely on appropriate safeguards including EU Standard Contractual Clauses (SCCs).

9. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

• Access (Art. 15): Request a copy of your personal data
• Rectification (Art. 16): Request correction of inaccurate data
• Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Restriction (Art. 18): Request limitation of processing
• Portability (Art. 20): Receive your data in a structured, machine-readable format
• Object (Art. 21): Object to processing based on legitimate interests
• Withdraw consent (Art. 7): Where processing is based on consent, you may withdraw at any time

To exercise these rights, contact us at @splitfast on Telegram.

10. Account Deletion

You can request deletion of your account and associated data at any time:

• Contact us at @splitfast on Telegram
• Specify that you want your account and data deleted
• We will process your request within 30 days
• Some data may be retained if required by law

Note: Deleting your account will remove your personal data but may not remove you from group expense records where other users have recorded expenses involving you.

11. Right to Complain

If you believe we have not handled your data correctly, you have the right to lodge a complaint with a supervisory authority.

Our lead supervisory authority is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ). You may also lodge a complaint with the supervisory authority in your country of residence.

12. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption of data in transit (HTTPS/TLS)
• Secure database storage with access controls
• Security updates applied on an ongoing basis
• Limited access to production data
• Secure authentication via Telegram's verification mechanism

While we take reasonable precautions, no method of transmission or storage is 100% secure.

13. Children's Privacy

SplitFast is not intended for children under 16. We do not knowingly collect personal data from children under 16.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or website.

Continued use of SplitFast after changes constitutes acceptance of the updated policy.

15. Contact Us

For questions about this Privacy Policy or to exercise your data rights:

Telegram: @splitfast