Privacy Policy

Who operates SplitStream

SplitStream is personally operated by Bashar Majed Ramadan, an individual developer based in the United Arab Emirates. Pixel Forge Dev is the public developer name and is not a separate company or legal entity. In this policy, “SplitStream,” “we,” and “us” refer to Bashar Majed Ramadan as the operator of the SplitStream mobile app and website.

The official website is https://splitstream.pixelforge.ae. Privacy questions can be sent to pixelforge991@gmail.com.

Information we collect

We collect only the information needed to provide a shared expense ledger.

• Account information: your display name, email address, profile photo, sign-in method (Google, Apple, or email and password), and internal account identifier.
• Email sign-in: if you choose email and password, Google Firebase Authentication keeps your email and a protected (hashed) form of your password; we never see your password. We email you a link to confirm your address and, when you ask, a link to reset your password. We do not send marketing email.
• Sign in with Apple: if you choose Apple, Apple shares your name and an email address with us. That address may be a private relay address that forwards to your own email.
• Photos and receipts: profile photos, group photos, and receipt pictures you choose to add, taken with your camera or picked from your photos. SplitStream uses the camera and photo library only when you choose to add a picture.
• Number claims: if you claim a phone number already used by another account, your reason, messages, and any proof you upload, and the other account's reply.
• Contact information: a phone number required to finish setup and published privately so contacts can find your account. It is not verified by SMS and may be changed or removed later.
• Contacts: after you allow access, SplitStream reads contact names and phone numbers on your device. Normalized phone numbers are sent to our trusted service only for temporary matching; the submitted list is not stored as an address book.
• Group information: group names, members, roles, invitations, and membership history.
• Shared ledger information: expenses, descriptions, categories, amounts, payers, participants—including selected names for people without an account—splits, settlements, reactions, and timestamps.
• Preferences: language, appearance, default currency, default split method, and custom categories.
• Technical information: installation identifiers, notification tokens, and security, synchronization, and operation records needed for account recovery and reliable delivery of activity notifications.

Contacts and people without an account

Contacts access is optional and can be revoked at any time in your phone’s settings, on Android or iPhone. It helps show which phone contacts use SplitStream and lets you choose people faster. Contact names, photos, notes, addresses, and the contact graph stay on your device unless you deliberately select a name for a group.

When you select a person who has no SplitStream account, their selected display name becomes a group-visible participant and may remain with shared ledger history. Their phone number and device contact ID are not shared with the group. A person may contact support to request correction or deletion of their name, subject to retaining anonymized shared-ledger facts needed to keep balances accurate.

A discoverable phone is required to finish setup. It stays private and unverified, and you may change or remove it later in Profile. Removing it deletes its private directory entry so people with that number can no longer find you.

Phone number claims

Each phone number can be found on only one account. If you claim a number another account already uses, that account is told straight away, without details on the lock screen, and may reply. We review each claim privately and may accept, ask for more, or reject it. If a claim is accepted, the number is removed from the other account and people who have it find the claimant instead. Accounts, groups, balances, and history never move.

Uploaded proof is deleted 30 days after the decision; only a minimal record of the decision remains. Deleting the claimant's account removes their uploaded proof straight away.

Safety reports and operator access

If you report a person or an expense, we review the report privately. To decide, we see the reported item in full, including an expense's amount and receipt or a person's profile photo, and the name and members of the group it belongs to.

For safety and support, the operator can look up an account's details (name, email, phone, sign-in method and account dates), the names of its groups, its role in each, and those groups' members. This lookup does not show expense titles, amounts, or activity. It is opened only when needed.

To protect people using SplitStream, we may sign an account out, suspend it, or delete it through the normal account deletion process. A suspended account sees a notice with the reason and our support email; other members, groups, and balances are not changed. Each of these actions is recorded in a private log with the account identifier, the action, the reason, and the time, kept for 90 days.

How we use information

We use this information to:

• create and secure your account;
• find phone contacts who use SplitStream and let you choose group participants;
• synchronize groups and shared expenses across members and devices;
• calculate balances and show who owes whom;
• deliver expense and payment alerts without showing amounts, names, or groups on the lock screen; an alert that someone added you to a group includes that person's name and the group name;
• send account emails such as email confirmation and password reset;
• review phone number claims and safety reports;
• prevent abuse, investigate errors, and keep the service reliable;
• process account deletion and respond to support requests.

Why processing is permitted

Depending on the feature and the law that applies, we process information to provide the service you request, with your consent, to protect legitimate interests such as security and reliability, or to meet a legal obligation. Where processing relies on consent, you may withdraw it, but this does not affect earlier lawful processing.

What other group members can see

SplitStream is collaborative. Active members of a group can see the shared profile name and photo used in that group, selected names for people without an account, its members, expenses, splits, reactions, settlements, and related history. Contact phone numbers are not shown to the group. Do not add information you do not want those group members to see.

Receipts are visible to current group members only. A group photo is also shown to anyone holding a valid invite link to that group, and to a person the group has invited by phone while that invitation is valid. Your profile photo is shown to people in your groups, or also to people who have your number if you choose that in Settings.

Your private settings, sign-in credentials, and private account data are not shared with group members.

Service providers

We use Google Firebase services for authentication, data synchronization, and related app infrastructure. Google processes information under its own privacy terms as our service provider. Google Sign-In and Sign in with Apple are used only when you choose them, and Google and Apple process that sign-in under their own privacy terms. If you choose email and password, Firebase Authentication also sends your confirmation and password-reset emails.

The public website, including its account deletion request page, uses Vercel. In the app, contacts, invitation acceptance, phone number claims, group and account deletion, activity alerts, safety reports, and private receipt and photo storage use Supabase. We do not sell personal information and we do not use it for targeted advertising.

Storage, security, and international processing

Information may be processed in countries where our service providers operate. Receipts, profile photos, group photos, and claim proof are stored privately with Supabase in Mumbai, India, outside the UAE. Accounts and the shared ledger are stored with Google Firebase. We use access controls, encrypted network connections, and group-scoped permissions designed to prevent access outside the groups you belong to.

No online service can promise absolute security. Protect your device, your Google account, and your SplitStream password if you use one, and contact us if you believe your account has been compromised.

Retention and account deletion

You can request deletion inside SplitStream Settings or through the public Delete account page. We aim to complete identity removal and anonymization within 30 days.

Email-and-password accounts confirm their password in the app before deleting. The public Delete account page verifies Google and email-and-password accounts. If you signed in with Apple and cannot use the app, email us from your account’s email address and we will verify and process your request.

Your private profile, email, password, photo, phone number, preferences, and login access are removed. Your profile photo is deleted straight away. Shared ledger entries may remain so other members’ balances and history stay accurate, but your identity is replaced with a stable group-local “Deleted member” label. Solo private groups are deleted. Shared groups you own must be transferred to another active member.

Receipts are removed for good 7 days after their expense is deleted. Receipts you added to a shared expense stay with that expense, anonymized, after you delete your account.

Security and operation records are retained for no more than 90 days unless a longer period is required by law or needed for an active legal claim or investigation.

Your choices

You may update your profile and preferences, remove your discoverable phone, clear saved contact matches from this phone, and revoke Contacts, camera, or photo access in your phone’s settings. You may also contact us to request access, correction, deletion, restriction, objection, or a portable copy where that right applies. You may withdraw consent where processing relies on consent and may complain to the relevant data-protection authority.

Age requirement

SplitStream is intended for people aged 13 and older and is not designed for children under 13. If you believe a child under 13 has provided personal information, contact us so we can investigate and remove it.

Changes and contact

We may update this policy as SplitStream changes. We will update the date above and provide additional notice when a change materially affects your rights.

Privacy questions: pixelforge991@gmail.com