Back to Home

Privacy Policy

Last updated: July 25, 2026

1. Data Controller

SplitFast ("we," "our," or "us") operates the SplitFast Telegram Mini-App. SplitFast is an independent project operated from the Czech Republic (European Union).

We aim to comply with applicable data protection laws including GDPR.

Contact: @splitfast

You may exercise any of your privacy rights by contacting us through the channel above.

This Policy is drafted in English. Translations are provided for convenience only; in case of any discrepancy, the English version prevails.

2. Personal Data We Collect

We collect the following categories of personal data:

2.1 Account Information (from Telegram)

When you use SplitFast, Telegram provides us with:

  • Telegram user ID
  • First name and last name
  • Username (if set)
  • Profile photo URL
  • Language preference
  • Telegram Premium status

2.2 Group Information

  • Telegram group/chat ID
  • Group name
  • List of group members who use SplitFast
  • Basic profile information (name, username, profile photo) of group members, provided by Telegram when members participate in a chat where the SplitFast bot has been added

2.3 Financial Data You Create

  • Expense descriptions and amounts
  • Split information (who owes what)
  • Settlement records
  • Currency preferences

2.4 Payment Methods (Optional)

If you add settlement methods, we store:

  • Payment method type (bank, PayPal, Revolut, etc.)
  • Account details you provide

Note: This information is shared with your group members when they settle debts with you.

2.5 Technical Data

We automatically collect certain technical information:

  • IP addresses
  • Request timestamps
  • HTTP request data (headers, user agent)
  • Error logs and diagnostic information

This data is used for security, debugging, and service improvement.

2.6 Receipt Images (Premium Feature)

If you use receipt scanning:

  • Receipt images are stored on our servers
  • Extracted data: store name, items, prices, totals
  • Images remain accessible to view attached receipts
  • Images are served via signed, time-limited links; only people who receive a valid link through the app (your group) can view the image

When you delete an expense, its receipt image is deleted from storage. You can also request removal of your receipt images at any time (see Section 10).

3. How We Use Your Data

Purpose Legal Basis (GDPR)
Provide expense tracking and splitting services Contract performance (Art. 6(1)(b))
Calculate balances between group members Contract performance (Art. 6(1)(b))
Process receipt images to extract expense data Contract performance (Art. 6(1)(b))
Send notifications about expenses (if enabled) Legitimate interest (Art. 6(1)(f))
Process premium subscriptions via Telegram Stars, or by card via Stripe where offered Contract performance (Art. 6(1)(b))
Improve our services and fix bugs Legitimate interest (Art. 6(1)(f))
Security and abuse prevention Legitimate interest (Art. 6(1)(f))
Comply with legal obligations Legal obligation (Art. 6(1)(c))
Analyze how the app is used to improve the Service (analytics) Legitimate interest (Art. 6(1)(f))

4. Cookies, Local Storage and Analytics

SplitFast does not use:

  • Browser cookies
  • Cross-site tracking pixels, or any advertising technology without your prior consent (see 4.2)

We use browser local storage for strictly necessary and functional purposes only — to keep you signed in inside the mini-app, and to remember your language preference on our website. We do not store analytics data on your device: the analytics keys previously written by the mini-app have been removed and are deleted from your device the next time you open it.

4.1 Usage Analytics (Mini-App)

The mini-app records usage events (app opens, feature usage, errors, and steps of the purchase flow) on our own servers, linked to your SplitFast user ID. Nothing is written to or read from your device for this purpose, and nothing is sent to anyone else. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in understanding how the product is used and detecting faults. This data is first-party only, is never sold, is never shared with advertisers, and is not used to profile you for advertising.

You have the right to object at any time (Art. 21 GDPR). Open your profile in the mini-app and turn off "Usage statistics"; from that moment your product-usage events are discarded on our servers. Records relating to rewarded ads you chose to watch are kept regardless, because they are needed to deliver the reward you requested and to prevent abuse.

4.2 Advertising (Mini-App)

If you choose to watch a rewarded ad instead of purchasing Premium, we load the Monetag advertising SDK. This requires your prior consent, which we ask for the first time you are offered an ad, and which you can withdraw at any time in your profile. Without that consent the SDK is not loaded at all. Monetag receives the fact that an ad was shown and a single-use identifier for that view; it does not receive your name, your Telegram ID, your expenses or your groups. Legal basis: consent (Art. 6(1)(a) GDPR and §89 of Act No. 127/2005 Coll.).

If we implement additional tracking technologies in the future, we will update this policy and obtain consent where required by law.

5. Third-Party Services

We use the following third-party services to provide our functionality:

5.1 Telegram

SplitFast operates as a Telegram Mini-App. All authentication is handled by Telegram. See Telegram's Privacy Policy.

5.2 Image Processing (Receipt Scanning)

When you scan a receipt, the image is processed by Google's AI services. See Google's Privacy Policy.

5.3 Exchange Rate APIs

We use third-party APIs to obtain currency exchange rates. These requests do not include personal data.

5.4 Cloud Storage

Receipt images and application data are stored on DigitalOcean infrastructure in the European Union (Frankfurt, Germany).

5.6 Website Hosting and Content Delivery

Our website (splitfast.io) is served via Cloudflare. Website pages load open-source JavaScript libraries from the unpkg.com CDN and display partner badges hosted by third parties. When a page loads, these providers receive standard technical data such as your IP address and browser information.

5.7 Monetag (Rewarded Advertising)

If you consent to rewarded ads, the Monetag SDK is loaded to display them. Monetag acts as an independent controller for the advertising data it collects and receives the fact of an ad view plus a single-use view identifier. The SDK is not loaded unless you have consented, and gambling, cryptocurrency and dating categories are blocked in our account settings.

5.8 Stripe (Card Payments)

Where card payment is offered, it is processed by Stripe. For those transactions Stripe acts as merchant of record in the countries covered by Stripe Managed Payments and receives the payment data you enter directly — we never see or store your card details.

6. Data Retention

Data Type Retention Period
Account data Retained while your account is active
Expenses and settlements Retained until you delete them or delete your account
Receipt images Deleted together with the associated expense, or upon your request (see Section 10)
Technical logs Retained for a reasonable period for security and debugging
Deleted account data Permanently removed within 30 days of deletion request

7. Data Sharing

We share your data only in these circumstances:

  • With group members: Expenses, splits, and balances are visible to members of the same group
  • Settlement methods: Your payment details are shown to group members who owe you money
  • Infrastructure providers: Our hosting and cloud service providers process data under contract
  • Service providers: As described in Section 5 (third-party services)
  • Legal requirements: If required by law, valid legal process, or to protect our rights

We do not sell your personal data.

8. International Data Transfers

Our primary data storage is in the European Union (Frankfurt, Germany). However, your data may be transferred to:

  • European Union: Primary data storage (DigitalOcean Frankfurt)
  • United States: Google Cloud services for image processing
  • Other locations: Service providers listed in Section 5 (such as Telegram and analytics) may process technical and usage data outside the EU/EEA

For transfers outside the EU/EEA, we rely on appropriate safeguards including EU Standard Contractual Clauses (SCCs).

9. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

  • Access (Art. 15): Request a copy of your personal data
  • Rectification (Art. 16): Request correction of inaccurate data
  • Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
  • Restriction (Art. 18): Request limitation of processing
  • Portability (Art. 20): Receive your data in a structured, machine-readable format
  • Object (Art. 21): Object to processing based on legitimate interests
  • Withdraw consent (Art. 7): Where processing is based on consent, you may withdraw at any time

To exercise these rights, contact us at @splitfast on Telegram.

10. Account Deletion

You can request deletion of your account and associated data at any time:

  • Contact us at @splitfast on Telegram
  • Specify that you want your account and data deleted
  • We will process your request within 30 days
  • Some data may be retained if required by law

Note: Deleting your account will remove your personal data but may not remove you from group expense records where other users have recorded expenses involving you.

11. Right to Complain

If you believe we have not handled your data correctly, you have the right to lodge a complaint with a supervisory authority.

Our lead supervisory authority is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ). You may also lodge a complaint with the supervisory authority in your country of residence.

12. Data Security

We implement appropriate technical and organizational measures to protect your data:

  • Encryption of data in transit (HTTPS/TLS)
  • Secure database storage with access controls
  • Security updates applied on an ongoing basis
  • Limited access to production data
  • Secure authentication via Telegram's verification mechanism

While we take reasonable precautions, no method of transmission or storage is 100% secure.

13. Children's Privacy

SplitFast is not intended for children under 16. We do not knowingly collect personal data from children under 16.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or website.

Continued use of SplitFast after changes constitutes acceptance of the updated policy.

15. Contact Us

For questions about this Privacy Policy or to exercise your data rights:

Telegram: @splitfast

16. Consent Records and Policy Versions

When you grant or withdraw consent we store a record of it: the purpose, the decision, the version of this Policy in force at that moment, and the time. Records are appended, never overwritten, so the history of your choices remains reconstructable — this is how we demonstrate consent as required by Art. 7(1) GDPR.

When this Policy changes materially we publish a new version and ask again. Consent given under an earlier version is not treated as consent to the new one.

Current version: 2026-08-17. You can review and change your choices at any time in your profile inside the mini-app.