Privacy Policy

Last updated: 14 October 2026

This Privacy Policy explains how Group Expense with Ease ("the Service", "we", "us") collects, uses and protects your personal data, and the rights you have in relation to that data. We take a data-minimisation approach: we only collect what the Service needs to let you split expenses with your friends.

1. Who is responsible for your data

The data controller for the purposes of the EU General Data Protection Regulation (GDPR) is:

2. What data we collect

We collect only the data you provide to us or that is required to operate the Service:

• Email address. Used to sign you in (via a one-time code), to identify your account, and to send you the notifications you have enabled.
• Display name. A name of your choosing shown to the members of your groups.
• Payment information (optional). Free-text details you choose to add (for example an IBAN) so that friends can pay you back. This is shown to members of your groups when they settle up with you. You decide whether to provide it and can remove it at any time.
• Group and expense data. The groups you create or join, the expenses you add (amount, description, who paid, who the expense is split with) and the resulting debts.
• Notification preferences. The categories of email you have chosen to receive.

We do not process payments, hold funds, or ask for card or bank credentials. All real-world payments happen directly between you and your friends, outside the Service. We do not use advertising, we do not run third-party trackers, and we do not sell your data.

3. Why we use your data and our legal basis

• To provide the Service (managing your account, groups, expenses and debts) - legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To authenticate you by sending one-time sign-in codes - legal basis: performance of a contract and our legitimate interest in securing accounts (Art. 6(1)(b) and (f) GDPR).
• To send the notifications you enabled (for example when an expense is added or a group is settled) - legal basis: performance of a contract; you can disable each category in your settings at any time.
• To keep the Service secure and running - legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

4. Who your data is shared with

Your data is shared only with:

• Other members of your groups, who can see your display name, the expenses you are part of, and (if you added it) your payment information.
• Amazon Web Services (AWS), our infrastructure provider, acting as a data processor. We use AWS for compute, storage (DynamoDB and S3), content delivery (CloudFront), queues (SQS) and sending email (SES). AWS may process data in EU regions as configured for the Service.
• Ko-fi, only if you voluntarily choose to make a donation through their platform. In that case your interaction is governed by Ko-fi's own privacy policy. Donating is entirely optional and is not required to use the Service.

We do not transfer your personal data to any other third parties, and we do not share it for advertising or marketing purposes.

5. International transfers

We aim to keep personal data within the European Union. Where a sub-processor (such as AWS) processes data outside the EU, that transfer is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

6. How long we keep your data

• Active account data is kept for as long as your account exists.
• Archived groups. When you archive a group, a snapshot of its data is stored so you can download it, and it is then automatically deleted after approximately three months.
• Account deletion. You can ask us to delete your account and associated personal data; see "Your rights" below.

7. Your rights under the GDPR

As a data subject in the EU you have the right to:

• access the personal data we hold about you;
• rectify inaccurate data (you can edit your name and payment info directly in settings);
• erase your data ("right to be forgotten");
• restrict or object to certain processing;
• data portability - you can download the data of any archived group at any time from the Service;
• withdraw consent where processing is based on consent;
• lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us using the details in section 1. We will respond within the time limits required by the GDPR.

8. Cookies

We use a small number of first-party cookies that are strictly necessary to operate the Service. We do not use cookies for advertising, analytics or third-party tracking, so no cookie-consent banner is required.

• Session cookie (__Host-SID) - keeps you signed in after you authenticate. It is HttpOnly, Secure and SameSite=Strict, so it is only sent over HTTPS, cannot be read by client-side scripts, and is not sent on cross-site requests.
• Sign-in indicator (aSID) - a non-sensitive flag that lets the app tell whether you are signed in. It contains no personal data.
• Temporary sign-in token - a short-lived, HttpOnly cookie used only during the one-time-code sign-in flow.

These cookies are set by us (via our authentication service) and are required for the Service to function. You can block or delete them in your browser, but you will not be able to sign in or use the Service.

9. Data security

We use managed, access-controlled AWS services and sign-in by one-time email code rather than stored passwords. While no online service can be guaranteed to be perfectly secure, we take reasonable technical and organisational measures to protect your data.

10. Children

The Service is not directed at children and is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be communicated through the Service where appropriate.