Privacy

Last updated: September 2026

What we store

A group stores exactly what you type into it: the group name, member names (first names or nicknames are fine — we never ask for emails, phone numbers, or real identities), expense descriptions, amounts, and dates. We also store three coarse facts when a group is created: how it was created (for example, manually or from an import), the broad source that led to it (for example, Google, AlternativeTo, a shared group link, or direct), and the public landing-page path. We never store the search query, full referring URL, or a private group link for attribution. There are no accounts, so there is no profile, no password, and no persistent visitor identity.

Where it lives

Group data is stored in a Cloudflare D1 database so everyone with the link sees the same up-to-date balances. Access to a group is controlled by its unguessable link — anyone you share the link with can read and edit the group, so share it like you'd share a house key.

You can optionally add a PIN to a group, which anyone opening the link then has to enter once per device. We store only a salted hash of it, never the PIN itself, and repeated wrong guesses lock the group briefly. It's a second lock on the same door — send it through a different channel than the link, and note that we can't recover a forgotten PIN, only someone already in the group can change it.

Splitpond is operated from Canada, and we host on Cloudflare's global network, so your group data may be stored on and processed by servers outside Canada — including in the United States. While it is held in another country it is subject to that country's laws, which can include lawful access requests by its courts and government agencies. We keep what we store deliberately minimal (see above) so there is very little to disclose.

Receipt scanning

When you scan a receipt, the photo is sent to Anthropic's Claude API to extract the line items, then discarded — we do not store receipt images. Don't scan documents containing information you wouldn't want processed this way.

To prevent automated scanning from running up provider costs, scans count against daily safety limits. The raw network address is not stored in our database. Instead, it is converted to a keyed, day-specific value that cannot be linked across days; old daily address buckets are removed when a later day's scanning starts. Aggregate daily scan counts are retained briefly for operating the safety limit.

Payments

If Pro purchases open, Lemon Squeezy will process them; we will not see your card details. Any license key you enter is validated against Lemon Squeezy and kept in your browser's local storage. Pro is not currently on sale.

Analytics

We use Cloudflare Web Analytics, which is cookieless and does not track you across sites. For group attribution, this tab temporarily keeps only the broad source and public landing-page path in session storage, then attaches them to a group if you create one. Allowed campaign tags are classified and then discarded; the query string itself is not saved. No advertising trackers, ever.

Deleting your data

Every group has a delete button. It permanently removes the group, its members, and every expense from the database — no grace period, no soft delete, no email required. Export your JSON first if you want a copy.

Anything Splitpond remembers about you specifically — your recent groups and which member you are in each — is stored only in your own browser, never on our servers. Clearing your browser data removes it, and there's a "forget" control on each entry in the recent-groups list.

If you import a CSV, this tab also keeps the import report long enough to show it on the new group page. Dismissing the report or closing the tab removes that session-only copy.

Questions

Splitpond is run from Canada and handles personal information under PIPEDA. If you have a privacy question or want data removed, use the group's delete button for immediate removal, or contact us (address in the footer once we're out of preview).