Privacy Policy

Effective October 25, 2026 · Version 2026-10-25

Split Guru is an iPhone app for splitting a restaurant bill with friends: scan the receipt, pick what you had, see what everyone owes and chat about it. It is made by Ruslan Butov (“we”, “us”). This policy explains what the app keeps on your iPhone, what reaches our server, who else handles it, and how to delete it. It also covers this website. Ruslan Butov is responsible for these processing decisions (the data controller where that term applies). Questions and privacy requests go to [email protected].

What stays on your iPhone

• Bills. Receipt photos, what the app read from them, the items, the people at the table and everyone’s share are saved on your iPhone. Our server keeps no copy of your saved bills; only a live table you share passes through it (below). Bills are not restored when you sign in on another iPhone, so deleting the app deletes them. Your iPhone’s own backups may include them, as with any app.
• Reading receipts. Receipts are read on your iPhone with Apple’s text recognition. New reading rules download from our server. The request carries ordinary connection information, such as your IP address, but no receipt or account data.
• Your profile photo stays on your iPhone. Friends see your initials.
• Camera, photos and contacts. The camera is used to scan receipts and take photos for chats. If you allow it, the app shows your photo library on your iPhone so you can pick receipt photos, chat photos and your profile photo; you can allow all your photos, only some, or none and pick photos in iOS’s own picker instead. Your library is not uploaded: only the photos you pick are used, and they leave your iPhone only when you send them in a chat, or as a receipt’s photos through scan sharing or AI reading as described below. When you pick a contact card, iOS gives the app only the card you picked. Split Guru does not read your contacts.
• Face ID, if you use it to lock your past bills, is handled by iOS. We never see your face data.

Your account

To use chats and tables over the internet you sign in with your phone number. We keep:

• your phone number, to sign you in and keep your account yours;
• the name you choose, which friends see in chats and at tables;
• account and device identifiers created by the app, so the server knows which iPhone is which and that a message really comes from you.

To sign you in, we text a six-digit code to your phone number. Your number and the code go to Twilio, which sends the text message (SMS) for us. Text messages below says more.

Text messages (SMS)

Split Guru sends text messages only to sign you in: one message with a six-digit code each time you ask for one in the app, such as “Your Split Guru code is 123456. Don’t share it with anyone.” We never send marketing or promotional texts. You agree to get these texts when you type your mobile number in the app and tap Continue. Message frequency varies with how often you sign in. Standard message and data rates may apply. Reply HELP for help or STOP to stop the texts; the SMS Terms explain both.

We use your phone number only to sign you in and keep your account yours. We do not sell or share your personal information with third parties for marketing purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

Chats and tables

• Chats. Messages and photos you send are stored on our server so they reach your friends and come back when you sign in on another iPhone. They are encrypted on the way and stored encrypted by our hosting provider, but they are not end-to-end encrypted: the server, and we as its operator, can read them. We look at chats only to handle a report, to keep the service working, or when the law requires it.
• Live tables. When you host or join a table over the internet, the bill’s items, the names of the people at the table and who had what go through our server so every phone shows the same bill. A closed table is deleted from the server about 30 days after it closes.
• Nearby. Without the internet, phones at the same table talk to each other directly over Wi-Fi and Bluetooth. That traffic does not pass through our server.

Message notifications

If you allow notifications, our server keeps the Apple push token for this installation, the chats muted on this iPhone, and your notification, preview and badge preferences so it knows where and when to send an alert and what it shows. Apple’s push notification service receives the device token, a chat identifier and, if enabled, a badge count. With Message Preview on (the default) for a kind of chat, the alert also shows the sender’s name, the chat’s name and up to the first 100 characters of the message, or that a photo or question was sent, so Apple’s service carries them to your iPhone; it never contains the photo itself or a receipt. With Message Preview off, the alert says only “New message”. iOS can hide previews on the lock screen (Settings → Notifications → Show Previews). Tap the alert to open the chat, whose content is fetched through the app’s authorized connection.

Change alert, preview and badge settings in You → Notifications or iOS Settings. Turning off a chat category in the app updates delivery preferences and retains the registration. After you disable notifications in iOS Settings, the app asks the server to remove the registration when it next checks the permission. Signing out also requests removal; network failures can delay these requests. Account deletion removes the associated registration. This information is used for service notifications, not advertising.

Reports and blocks

• When you report a message or a person, we receive the reason, the text you saw, which chat and message it was, and who reported it. We use reports to remove content and accounts that break our terms, and delete each report about 180 days after we have dealt with it.
• When you block someone, the block is saved with your account and we are told about it, so we can look into that person. They are not told.

Better receipt reading

Scan sharing and AI reading are both on unless you turn them off. If you ask the app to check a receipt’s prices while AI reading is off, it asks first. You can change each option independently at any time in You → Privacy and Security. Turning one off stops new sharing or requests for that option and discards its queued work. It does not recall data already sent. A choice you made before this version, including Not Now, which then turned both options off, stays as you made it.

Share scans to improve reading

After a scan, the app sends us the receipt photos (without location or other photo metadata), the text your iPhone read, how the app read the receipt and, once you confirm the bill, the confirmed amounts. It never sends who was at the table or who had what. We store these scans and use them to test, train and improve receipt reading and our models, to find and fix problems, to improve the quality of Split Guru and to develop new features. People working on Split Guru may look at them for these purposes. A receipt can show what is printed on it, such as the place, the time, the server’s name or the last digits of a card.

Improve receipt reading with AI

AI reading uses AI models run by our AI provider, named under Who else handles your data, and works in two steps, each only when it is needed. When a receipt is hard to read, its recognized text, layout and existing amounts go through our server to the provider, which suggests a reading. When the bill still doesn’t add up, or you ask, the receipt’s photos (without location or other photo metadata) and the text your iPhone read go through our server to the provider, whose model reads the prices. The app then shows what it suggests, and nothing changes unless you choose to use it. Our server keeps each request with the bill’s amounts as they were and the reading, to measure and improve how well AI reading works, and does not send the amounts on. When scan sharing is on, the receipt’s photos are also kept with its scan. We do not send table participants or who had what. The text and photos can show personal details printed on the receipt. Our AI provider processes this data for us and does not use it for model training by default. It normally deletes inputs and outputs within 30 days, with exceptions for legal and usage-policy enforcement, under its data policy. AI readings can be wrong, so check them before you rely on them. Turning AI reading off stops new AI requests; scan sharing is controlled separately.

Crash reports and server errors

We use Sentry to diagnose app crashes and server errors. App reports contain technical details such as the app version, operating system, device model, error type and code locations involved in a failure. They do not contain your receipt photos or text, bill amounts, chats, name, phone number, account identifiers or sign-in credentials. We do not record your screen or use these reports to track how you use the app.

In builds with crash reporting configured, Send crash reports is on until you turn it off in You → Privacy and Security. Turning it off stops reports from this iPhone and removes reports waiting to be sent; it cannot recall reports already received. This choice is separate from scan sharing and AI reading, and from Apple’s own crash-sharing setting. Our server continues to report technical failures needed to operate the service, without sending request contents or your account identity to Sentry.

Sentry receives the connection’s IP address when a report is sent. We remove user identifiers from report contents and do not associate reports with your account. Diagnostic events are kept for no longer than 90 days. You can contact us about reports or other privacy questions at [email protected].

Who else handles your data

We use a few service providers, each only for the job below:

• Supabase runs our server: database, sign-in, file storage and server functions. It is hosted on Amazon Web Services in the United States.
• Twilio sends sign-in codes by text message, on our behalf.
• Anthropic is our AI provider. It runs the AI models that read hard receipts and the prices on receipt photos, unless you turn AI reading off.
• Apple distributes the app through the App Store and TestFlight, delivers the message notifications described above, and shares crash reports with us only if you agreed to that in iOS.
• Vercel serves this website.
• Sentry processes the technical crash and server-error reports described above to help us diagnose failures.

We do not sell or share your personal information with third parties for marketing purposes. We do not rent personal data, show ads, track people for advertising, or give personal data to data brokers. The de-identified data described under Selling and licensing de-identified data is not personal information. We would disclose data to authorities only when the law requires it.

Why we process data

We use account and device information, chats and live-table content to deliver the features you request; connection records, reports and blocks to prevent abuse and investigate failures; shared scans and AI reading records to improve receipt reading, our models and Split Guru; and de-identified data as described below. Access is limited to the people and providers who need it for those purposes. Necessary processing supports our service agreement; security, scan sharing and AI reading support our legitimate interests in a safe service, in reading receipts accurately and in improving it, and you can object to scan sharing or AI reading at any time by turning it off; and legally required records rely on legal obligations. Where the law requires consent for a use, we ask for it.

Website visits

This site provides information and support links. Vercel receives ordinary request information, including IP address, browser or device information, requested pages and request times, to serve and protect it. We have not added advertising cookies, tracking pixels or third-party analytics. Clicking an external link takes you to another service with its own privacy policy. If you email us, we process your address, message and attachments to answer your request; please send only the details needed and never a sign-in code or full card number.

Selling and licensing de-identified data

We may create de-identified and aggregated data from the information we collect, such as the items and prices on receipts, places, times and spending trends, and use, share, license or sell it, including to partners who pay for it. This data does not identify you or anyone else. We remove account and device identifiers, names and other details that could identify a person, combine records so that no one stands out, and take reasonable technical and organizational measures so that it cannot reasonably be linked to a person or household. We keep and use it only in de-identified form, we do not try to re-identify it, and we contractually require anyone who receives it not to try either. We do not sell receipt photos, chats, phone numbers or anything else that identifies you.

We do not sell your personal information or share it for cross-context behavioral advertising. If that ever changes, we will update this policy and tell you in the app before it starts, describe the data, purposes and recipients, and give you the choices the law requires, such as an opt-out of sale or sharing, honoring opt-out signals such as Global Privacy Control, and asking for consent where it is required. We will never sell or share sign-in phone numbers, mobile information, or text messaging opt-in data and consent, and we will not sell personal information of anyone under 16. Information collected under an earlier version of this policy stays under the promises made when it was collected.

Future ads

There are no ads in Split Guru today. We may introduce paid plans, clearly labeled contextual ads, sponsored placements or affiliate offers. Before any ads use your personal information for targeting or tracking, we will tell you and ask for any permission the law or Apple requires, including Apple’s tracking permission where it applies. Refusing optional processing will not remove access to features you already bought.

Future payments and business transfers

If paid plans are introduced, the checkout and updated notice will identify the payment provider and necessary transaction, entitlement and fraud-prevention data. The subscription terms describe the framework; we do not collect payment-card details for a current subscription because none is offered. If the business is incorporated, reorganized, financed or transferred, necessary information may be disclosed under appropriate confidentiality and purpose restrictions and legal requirements. Any successor must respect existing privacy commitments; materially different uses require the applicable notice, choice and lawful basis first.

Ruslan Butov is the current individual operator. If a company becomes responsible for the service and your data, we will identify that company, its contact details, when responsibility changes and any effect on your rights through the notices required by law. The operator transition terms describe the contractual transfer. Existing permissions do not become broader merely because the operator changes, and any required consent must be obtained before the relevant transfer or new processing.

How long we keep it

• Your phone number, name and identifiers: until you delete your account.
• Chats: messages stay while the chat is in use. We may delete chat photos older than a year.
• Sign-in code requests (the number, when, and whether the text was sent): about 30 days. Deleting your account deletes them sooner.
• Live tables: about 30 days after the table closes.
• Push registrations and notification preferences: until removed, replaced, retired as invalid or deleted with the account. Pending notification jobs older than an hour are discarded when the queue is processed.
• Reports: about 180 days after we have dealt with them.
• AI reading requests (the scanned text, the bill’s amounts and the reading): about seven days, then only a record that the request was made, until you delete your account.
• Shared scans, including their photos: on our server until you delete your account, and we may delete them sooner. Some are copied into a private receipt test set without account or device identifiers. A receipt identifier lets us find and remove those copies after account deletion; the removal from downloaded copies requires an operator to run the cleanup.
• De-identified and aggregated data: as long as it is useful, since it no longer identifies anyone.
• Our providers keep short-lived technical logs, such as IP addresses and request times, for security and troubleshooting.

Deleting your account

Go to You → Privacy and Security → Delete Account. This removes your phone number, name, account and blocks, your hosted chat message content and photos, and the photos and records of the receipts you shared. It removes you from chats and tables. If uploaded files cannot be removed yet, deletion stays pending and the app asks you to try again; it does not report completion before hosted cleanup succeeds.

Message deletion markers remain so other phones remove your messages when they next sync. We cannot erase screenshots, exported copies or copies on phones that stay offline. Bills saved on your iPhone stay until you delete them or the app. Limited report records, with names and reported text removed, are retained for the time above. A retired device identifier prevents another account from taking over that device identity.

Deletion also records the receipt identifiers needed to mark exported scans for removal from our private test set. An operator must run that cleanup; you do not need to submit another request. Backup copies may remain until they are deleted or expire under the applicable retention settings. Deletions must be reapplied before a backup is put back into service. Contact [email protected] to check the status of exported-copy cleanup.

Your rights

You can ask us for a copy of your data, to correct it, or to delete it, by writing to [email protected] with the phone number on your account. We may ask you to confirm the number before we act. Depending on where you live, for example in the European Union, the United Kingdom or California, you may have further rights, such as to object to or restrict how we use your data, and to complain to your data protection authority.

We handle your account, chats and tables because you asked us to provide the app. AI reading serves our legitimate interest in reading receipts accurately, and shared scans our legitimate interest in improving receipt reading and Split Guru; you can object to either at any time by turning it off in the app. Reports, blocks and technical logs serve our legitimate interest in keeping Split Guru safe. Your data is processed in the United States.

Depending on applicable law, you may also request access, portability, correction, deletion, restriction, objection to legitimate-interest processing, or appeal of a denied request. You may use an authorized agent where allowed. We may reasonably verify requests involving access or deletion, but will not require identity documents or account creation for a sale/sharing opt-out where the law prohibits that. We will respond within applicable legal deadlines, explain any permitted extension or denial, and tell you how to appeal or complain. We will not unlawfully discriminate against you for exercising a privacy right. Your Privacy Choices provides the request channel and withdrawal steps.

United States privacy protections may differ from those where you live. International transfers must meet applicable legal requirements. Contact us for information about the locations and transfer safeguards relevant to your data. Necessary, limited records may be retained for a legal obligation or to establish or defend claims; this is not permission to keep all content indefinitely or to use retained records for unrelated marketing.

Security

Everything between the app and our server travels over encrypted connections. Your sign-in stays in the iPhone’s Keychain. The server checks every request against your account and device, so people see only the chats and tables they belong to.

Children

Split Guru is not made for children under 13 or a higher local minimum age, and we do not knowingly collect their data. Where a young person’s use requires a parent or guardian’s authorization, that authorization is required. If you believe a child has given us data without the required authorization, write to us so we can investigate and delete it as required. A receipt uploaded by an adult may also contain another person’s details; please avoid unnecessary sensitive information.

Changes

We will publish a dated version when this policy changes. For material changes, we will give a prominent notice before the new practice begins, through the app or another appropriate channel, and obtain fresh consent when required. For material contractual changes, the Terms’ notice rules also apply. A new version does not retroactively authorize a new use of data collected under an earlier promise. Continued use or silence is not consent to a use that requires consent.

Contact

Ruslan Butov, developer of Split Guru: [email protected]