Privacy Policy

What we collect

• What your group enters: group and member names (real or nicknames), expenses, and recorded settlements.
• Payment details members choose to add: an IBAN, payment link or note. These are visible to everyone in the group, since that's their purpose, so only add what you're happy to share.
• Purchases: if you unlock a group, Stripe collects your payment details directly (we never see your card). We receive your email address and confirmation of payment. If you unlock a group with a coupon code instead, we record which code was used, for which group, and the name of the member who used it.
• Email address (optional): if you enter one when creating a group, we use it once to email you the group link. We don't store the address itself; to limit abuse we briefly keep a one-way hash of it, with the sender's IP address, for 24 hours.
• Technical data: our host processes standard server logs (such as IP address) to keep the service running and secure.

Who can see a group

Groups are protected by their link, not a login. Anyone with a group's link can see and edit it. Treat the link like a password and share it only with your group.

How we use it

To run the service, process purchases and keep records the law requires, keep things secure, and answer your messages. Our legal bases are performing our agreement with you, our legal obligations (accounting and tax), and our legitimate interest in a safe, working service. We don't use your data for advertising or profiling, and we don't sell it.

Cookies

One functional cookie per group (identity_<group-id>) remembers which member you are. It's HttpOnly, only sent to our site, and expires after a year. We use no analytics, advertising or tracking cookies, so there's no cookie banner.

Who we share it with

Only the providers that run the service for us: Stripe (payments, as merchant of record), Resend (sending the group-link email) and our hosting and database providers. Some may process data outside the EEA, under safeguards such as standard contractual clauses. We may also disclose data if the law requires it.

How long we keep it

Group data is kept while the group exists and we run the service; nothing is deleted automatically. Anyone can remove their own saved payment details in the app, and we'll delete a whole group on request. Purchase records are kept as long as tax law requires.

Your rights

You can ask us to access, correct, delete, restrict or export your data, or object to how we use it, and you can complain to your data protection authority (in Lithuania, the State Data Protection Inspectorate). Email elonas.meskis@gmail.com — since there are no accounts, we may ask for the group link and your name in it to find your data. Oxisplit isn't meant for children under 16.

Changes and contact

If this policy changes, the date above changes with it. Questions: elonas.meskis@gmail.com.