Privacy Policy

Who runs this

Divide It is an independent app built and operated by a single developer, not a company. If you have a question, a concern, or a request about your data, email support@divideit.io.

What Divide It is

Divide It is a shared expense tracker. You create groups, log expenses, and see who owes who. It records what you tell it — it does not move money, hold a balance, or connect to a bank account.

What we collect

Account and profile

• Email address, used for sign-in and account notices
• Password, if you sign up that way (stored hashed by our auth provider, Supabase — we never see it in plain text). If you sign in with Google or Apple instead, we don't hold a password for you at all
• Display name and username
• Avatar — a preset illustration and background you pick from a fixed set. Divide It does not support photo uploads, so there is no image of you stored anywhere
• Default currency and notification preferences

Group and expense data

• Groups you create or join, and their members
• Expenses: description, amount, currency, category, who paid, and how it's split
• Settlements — payments you record between group members
• An activity log of group events (expense added, member joined, settlement recorded, and similar) so the group has a shared history
• Friends — connections formed by adding someone directly or through a shared group

Device and diagnostics

• A push notification token for your device, so we can send you alerts about expenses, reminders, and group activity. You can turn these off in settings
• Error and crash reports, handled through Sentry. These reports are limited to identifiers and shapes of data — things like an operation name, an error code, or a count — never expense amounts, descriptions, names, or email addresses

Why we collect it

Every field above exists to make the app work: authenticating you, showing your groups and balances, syncing changes to other members in real time, and notifying you when something happens that involves you. We don't collect anything for advertising, and we don't sell your data. There are no ads in Divide It.

Signing in with Google

Google Sign-In is one of three ways to get into Divide It — alongside email and password, and Apple Sign-In. It's entirely optional; nothing in the app requires it.

When you sign in with Google, we ask for the standard, default sign-in scopes: email and profile. We don't request any sensitive or restricted Google API scopes — no Drive, no Contacts, no Calendar, nothing beyond basic sign-in.

Through those scopes, the Google user data we receive is your email address, your name, and your profile picture URL. That's it. We use this Google user data to create your account and to identify you to your groupmates, the same way we'd use a name and email if you signed up manually.

This Google user data is stored and protected the same way as the rest of your account data — see "Security" below. It's retained for as long as your account is active, and handled the same way as the rest of your profile if you delete your account — see "Deleting your account" below. We don't share it with anyone outside the processors listed below that run the app on our behalf.

To be explicit: Google user data is never sold, never shared with data brokers, never used for advertising or ad targeting, never used for credit assessment, and never used to train AI or machine learning models. The only thing it does is make your Divide It account work.

Who can see what

Expenses, settlements, and activity in a group are visible to the members of that group — that's the point of a shared ledger. Your profile (display name, username, avatar) is visible to other authenticated users so they can find and add you. Nobody outside your groups sees your financial activity.

Who else touches this data

We use a small number of processors to run the app, and none of them get to use your data for their own purposes:

• Supabase — our database, authentication, file storage, and backend functions. This is where all of the data above actually lives
• Google Sign-In and Apple Sign-In — optional ways to authenticate without a password. Google user data received this way is limited to what's described in "Signing in with Google" above
• Sentry — error monitoring, scoped to identifiers and error shapes as described above
• Resend — sends account emails: sign-up confirmation, password reset, and address verification
• Apple Push Notification service (APNs) and Expo's push service — deliver push notifications to your device using your push token

Data retention

We keep your account data for as long as your account is active. Group and expense records stick around as long as the group exists, because they're shared history that other members depend on, not just yours.

Deleting your account

You can delete your account from the app at any time. Here's exactly what happens:

• Your profile is anonymized immediately: your name becomes "Deleted User", and your avatar, username, and contact email are cleared
• Personal data that's only yours is deleted: your friend connections, pending invitations, invite links, push tokens, and your own notification feed. Your avatar image is removed from storage
• We keep your expenses, expense splits, settlements, group memberships, and entries in the group activity log. These belong to other people's shared ledgers too — deleting them would silently change what your former groupmates are owed, so they stay, attached to the anonymized "Deleted User" profile instead of your name
• For 30 days after deletion, signing back in with your original email or OAuth account restores you to your profile and history. After that window, the account is permanently locked

When you delete your account, we ask a short, optional exit survey question about why you're leaving. Answering is entirely optional.

To request deletion outside the app, or to ask about data we hold on you, email support@divideit.io.

Security

Data is stored with Supabase (PostgreSQL) behind row-level security policies that restrict each table to the people who should actually see it — group members for group data, and you alone for your own account settings. There is no password-based two-factor step-up on top of sign-in; if you use a password, standard sign-in plus Google or Apple OAuth are the account protections available today.

Children

Divide It is not directed at children, and we don't knowingly collect data from anyone under 13. If you believe a child has created an account, email us and we'll remove it.

Changes to this policy

If this policy changes in a meaningful way, we'll update the date at the top of this page. Continued use of Divide It after a change means you accept the updated policy.

Contact

Questions, requests, or concerns about this policy: support@divideit.io.