1. Who we are
FamSplit ("FamSplit", "we", "our", or "us") is a mobile application developed and operated for personal use. The FamSplit app is available on iOS (Apple App Store) and Android (Google Play Store and direct APK download).
This Privacy Policy explains how FamSplit collects, uses, stores, and shares personal information when you use the FamSplit mobile application and associated services ("Service").
By using FamSplit, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.
Contact: abrar.md27@gmail.com
2. Data we collect
We collect only the information necessary to provide the FamSplit service. We do not collect data for advertising or profiling purposes.
Information you provide directly
| Category | Data points | Why we need it |
|---|---|---|
| Account | Phone number, full name, password (hashed) | Authentication, account identification |
| Financial profile | Monthly income / salary | Pro-rata bill splitting calculation |
| Expense data | Amount, category, date, note, expense type (personal/family) | Tracking, splitting, and settlement features |
| Family groups | Group name, icon, member list, split settings | Managing shared expense groups |
| AI conversations (Premium) | Questions and messages sent to the AI advisor | Generating personalised financial insights |
Information collected automatically
- Session tokens: JWT access tokens (15-minute expiry) and refresh tokens (30-day expiry), stored securely on device.
- Error logs: Crash reports and technical errors (no personal financial data included).
- App usage signals: Feature interactions used to improve reliability (not linked to personal identity).
Information we do NOT collect
- Email address
- Device location or GPS data
- Contacts, camera, or microphone access
- Bank account numbers or payment card details
- Government identity documents (Aadhaar, PAN, etc.)
- Device advertising identifiers (IDFA / GAID)
3. How we use your data
We use your information solely to provide and improve the FamSplit service:
| Purpose | Legal basis |
|---|---|
| Create and authenticate your account | Contract performance |
| Calculate pro-rata expense splits | Contract performance |
| Generate monthly settlements | Contract performance |
| Provide personal expense tracking and insights | Contract performance |
| Power AI-based financial advice (Premium) | Consent (opt-in Premium feature) |
| Send push notifications (expense reminders, settlements) | Consent (permission requested at app install) |
| Diagnose technical errors and improve reliability | Legitimate interest |
| Comply with applicable law | Legal obligation |
We do not use your data for behavioural advertising, selling to third parties, or building advertising profiles.
4. Third-party services
FamSplit uses a small number of trusted third-party providers. Each receives only the minimum data required for the function it performs.
| Service | Provider | Purpose | Data shared |
|---|---|---|---|
| Cloud hosting & database | Railway (US) | Hosting the backend API and PostgreSQL database | All app data (encrypted at rest) |
| Cache layer | Redis / Railway | Session caching, performance | Session tokens only |
| AI advisor (Premium only) | OpenAI (US) | Generating personalised financial insights | Your expense summaries & AI chat messages (no name, phone, or full transaction history) |
| Push notifications | Expo / FCM / APNS | Sending in-app notifications | Device push token |
OpenAI processes data under its Privacy Policy. When you use the AI Advisor (Premium), anonymised spending summaries are sent to OpenAI. We do not send your name, phone number, or complete transaction history to OpenAI.
Railway processes data under its Privacy Policy and applicable data protection standards. Data is stored in US-based data centres.
5. Data storage and security
Encryption
- All data is transmitted over HTTPS (TLS 1.2+).
- Passwords are hashed with bcrypt before storage — they are never stored in plain text.
- Database data is encrypted at rest using Railway's managed encryption.
- JWT tokens use HS256 signing with server-side secrets.
Access controls
- Database access is restricted to the application backend; no direct external access.
- API endpoints are authenticated — you can only access your own data.
- Family group data is access-controlled — only group members can view shared expenses.
Breach response
In the event of a data breach that affects your personal data, we will notify affected users within 72 hours of becoming aware, as required by applicable law, and describe the nature of the breach, data affected, and remediation steps.
6. Data retention
| Data type | Retention period |
|---|---|
| Account data (name, phone) | Until account deletion |
| Expense and transaction data | Until account deletion |
| Family group data | Until group dissolution or account deletion |
| AI chat history (Premium) | Until account deletion (not retained by OpenAI beyond their policy) |
| Refresh tokens | 30 days, or until revoked by logout |
| Anonymised error logs | 90 days |
When you delete your account, all personal data — account details, expense history, family group memberships, and AI conversations — is permanently deleted from our systems within 30 days, except where retention is required by applicable law.
7. Your rights
Under India's Digital Personal Data Protection Act 2023 (DPDP Act) and other applicable law, you have the following rights regarding your personal data:
| Right | What it means | How to exercise |
|---|---|---|
| Access | Request a copy of the personal data we hold about you | Email abrar.md27@gmail.com |
| Correction | Update inaccurate personal data | In-app profile settings, or email us |
| Deletion | Delete your account and all associated data | Profile → Delete Account (in-app), or email us |
| Withdraw consent | Withdraw consent for AI advisor processing | Cancel Premium subscription; disable AI features |
| Grievance | Raise a privacy grievance | Email abrar.md27@gmail.com with "Privacy Grievance" in the subject |
We will respond to rights requests within 30 days. If we are unable to fulfil a request, we will explain why.
Grievance Officer (India DPDP Act)
In accordance with the Information Technology Act 2000 and DPDP Act 2023, a Grievance Officer is available:
Name: FamSplit Support Team
Email: abrar.md27@gmail.com
Response time: Within 30 days
8. Children's privacy
FamSplit is rated 4+ on the App Store and Everyone on Google Play, and is not directed at children under the age of 13 (or under 18 for financial data processing).
We do not knowingly collect personal data from users under the age of 13. If you believe a child under 13 has created an account, please contact us at abrar.md27@gmail.com and we will promptly delete the data.
Users between 13 and 17 may use the app with parental consent. FamSplit's salary and income features are intended for adults with independent income.
9. International data transfers
FamSplit is built for users in India. Our backend infrastructure is hosted on Railway in the United States. By using FamSplit, you consent to your personal data being processed and stored in the United States.
When data is transferred outside India, we take appropriate measures to ensure it receives an equivalent level of protection, including:
- Using service providers that comply with applicable data protection standards.
- Limiting data shared with US providers to what is strictly necessary for the function.
- Ensuring OpenAI's data use is governed by their API data processing terms (no training on your data through the API).
10. Cookies and tracking
FamSplit is a mobile application and does not use browser cookies.
The app stores the following data locally on your device:
- JWT access token (in secure storage, for authentication)
- Refresh token (in secure storage, valid for 30 days)
- User preferences and cached UI state (in AsyncStorage)
We do not use third-party analytics SDKs (such as Firebase Analytics, Mixpanel, or Amplitude) that track user behaviour across sessions.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will:
- Update the "Last updated" date at the top of this page.
- Send a push notification to all users summarising material changes.
- For significant changes (e.g., new data categories, new third parties), request fresh consent where required by law.
Continued use of FamSplit after a policy update constitutes your acceptance of the revised policy.
12. Contact us
For privacy queries, data requests, or to report a privacy concern:
Email: abrar.md27@gmail.com
Subject line: "Privacy" for data requests, "Privacy Grievance" for complaints
Response time: Within 30 days
This policy is governed by the laws of India. Disputes shall be subject to the exclusive jurisdiction of the courts in Bengaluru, Karnataka, India.