Privacy Policy

Halv is a bill-splitting app. This policy explains what data we handle, why, who else sees it, how long we keep it, and what your rights are.

Who we are

Halv is run by Rafał Małczyński, doing business as MobileBay Rafał Małczyński, Olesińska 11, 05-831 Parole, Poland · NIP 5272961897 · REGON 389234038. We are the controller of your personal data under the GDPR.

For anything privacy-related, including the requests described under Your rights, write to hello@halv.money. We haven't appointed a data protection officer.

What we collect

• Your account. Your email address, display name and default currency. If you sign in with Apple or Google, we get the email address they give us (with Apple, possibly a private relay address).
• Your profile photo, if you add one.
• Payment details you choose to share so friends can pay you: a Revolut tag, a BLIK phone number, or an IBAN.
• What you record. Groups, expenses, items, who paid, who took part, settlements, and any descriptions or notes you type.
• People you add who aren't on Halv. When you add someone to a split who has no account, we store the name you type for them — nothing else.
• Receipt scans. The photo of the receipt and what we read from it: merchant, line items, totals.
• Expense photos you attach to an expense.
• Invites and share links you create, including any label you give a link.
• Purchases. Which upgrade you bought, when, the store transaction id and the price. Payment itself is handled by Apple or Google.
• Technical data. Your device's push-notification token; the IP address and device type recorded with each sign-in session; a scrambled (hashed) IP address when we limit repeated sign-up checks; and a record of receipt scans used, so we can apply scan limits.
• Usage analytics, and crash reports from the Android app — see Usage analytics below.
• Messages you send us at hello@halv.money.

Halv doesn't read your contacts or your location, and it doesn't use your device's advertising identifier. The camera is used only when you scan a receipt or a QR code.

Why we use it, and on what legal basis

• To run Halv for you — your account, syncing your data between your devices and the people you split with, calculating balances, reading receipts, sending the notifications you've switched on, and your purchases. Basis: performing our agreement with you, the Terms of Service (GDPR Art. 6(1)(b)).
• To keep shared records complete — storing the names of people you add who aren't on Halv, and keeping your display name on shared expenses after you delete your account (see Deleting your account). Basis: the legitimate interest of the people you split with, and ours, in accurate shared records (Art. 6(1)(f)).
• To keep Halv safe and working — scan limits, rate limits, spotting abuse and refund fraud, fixing errors, including the crashes the Android app reports. Basis: legitimate interest (Art. 6(1)(f)).
• To improve Halv — usage analytics. Basis: legitimate interest (Art. 6(1)(f)); you can object at any time by switching it off or, in the Android versions that don't have the switch yet, by writing to us.
• To answer you when you write to us, and to handle complaints and requests. Basis: performing our agreement and legitimate interest (Art. 6(1)(b) and (f)).
• To meet legal obligations and defend legal claims. Basis: Art. 6(1)(c) and (f).

You don't have to give us your data, but Halv can't work without an email address and a display name.

Who can see your data

• People you split with. Members of a group you're in see your display name, profile photo, and the expenses, settlements and expense photos in that group. People on a split without a group see the same for that split. They don't see your email address.
• Your payment details are visible to people who share, or have shared, a group or a split with you — including after one of you leaves the group — so an old debt can still be paid.
• Anyone with an invite code — including someone without a Halv account — can see the group's name, who invited them, and the display names of the people in the group before joining.
• Anyone with a share link you send can see your display name, the expense's title, the amount, the other people's initials and, if they owe you, your payment details — while the link is active. Links stop working after 30 days or when you revoke them.
• Your profile photo is stored at a public web address. It isn't listed anywhere, but anyone who has the address can open it.

Service providers

These companies process data on our behalf, under our instructions:

• Supabase — database, sign-in, file storage and server functions. Ireland (EU).
• PowerSync — keeps the copy of your data on your device in sync.
• Google Cloud (Cloud Run and Vertex AI) — reads receipt photos. Processed in the EU. Receipts aren't used to train models and aren't stored by our scanning service; Google may keep a prompt for up to 90 days only if its automated safety checks flag it.
• PostHog — usage analytics, and crash reports from the Android app. EU (Frankfurt).
• RevenueCat — manages purchases. It gets your Halv account id and the store receipt, not your name or email. United States.
• Resend — sends sign-in, confirmation and password-reset emails. The emails are sent from the EU; Resend is a US company.
• Cloudflare — hosts this website and routes email sent to hello@halv.money to our email provider.

Apple and Google also handle data when you use their services through Halv: Sign in with Apple and Google Sign-In, in-app purchases through the App Store and Google Play, push notifications (Apple Push Notification service and Firebase Cloud Messaging), and the document scanner on Android. For sign-in and purchases they act under their own privacy policies.

Where a provider processes data outside the European Economic Area, we rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.

What notifications contain

If you switch notifications on, they carry a little of the content so you can read them at a glance: a person's display name, an expense's title, an amount, and for settlements the group's name. They travel through Apple's or Google's notification service to your device.

Usage analytics

Halv records how the app is used so we can find the parts that confuse people and fix them. That means events like "an expense was created" or "the paywall was shown", together with the app version, details of your device and its connection (its type, make and model, operating system, language and region, time zone, screen size, whether it's on Wi-Fi or mobile data and, on Android, the name of your mobile network operator), and an approximate location: the city your internet connection appears to be in, worked out from your IP address. It is not your device's location.

Once you're signed in, these events are linked to your Halv account id, along with a few rounded-off facts about your use of Halv (for example, roughly how many groups you're in, how you signed up, and whether you've bought an upgrade). Events recorded on your device before you signed up are linked to your account when you sign in. Analytics starts when the app opens, before you sign in.

What we never send: amounts, notes, the names of people or groups, email addresses, or the contents of any receipt. This data is never sold, never shared with advertisers, and never used to track you across other apps or websites.

Analytics is on by default. You can switch it off at any time in Settings → Share usage analytics; from then on nothing more is recorded. Some Android versions don't have that switch yet (see below).

Crash reports (Android only). When Halv's Android app crashes, it can send a crash report to PostHog, the same EU provider (Frankfurt) that handles usage analytics, so we can find out what went wrong and fix it. The report says what type of error it was, which screen was open, and where in the code it happened: the stack trace, with class and method names, file names and line numbers from Halv's own code and from the libraries it uses. Like every analytics event, it also carries the app version and build number, the device and connection details listed above, the platform, which Halv servers the app talks to, your Halv account id once you're signed in, and the approximate location worked out from your IP address. A crash report never contains amounts, the names of people or groups, email addresses, anything you've entered in an expense, or the error's message text, which Halv removes on your phone before anything is sent. The iPhone app sends no crash reports.

Crash reports are part of usage analytics. The Android versions of Halv that send them don't have the Share usage analytics switch yet; it comes with Settings in a later update. Until then, usage analytics and crash reports can't be switched off in those versions, but you can still object to them by writing to us (see Your rights). Once the switch is there, switching it off stops crash reports too. When you delete your account, crash reports already sent are kept like other analytics events (see Deleting your account).

On your device

Halv keeps a copy of your data on your phone so it works offline. When you sign out, Halv removes that copy, unless there are changes that haven't reached our servers yet — then it keeps them until they can be sent. Receipt and expense photos waiting to upload are kept the same way. On Android, the system may include Halv's data in your device backup.

How long we keep it

• Your account and what you record — for as long as your account exists.
• Shared expenses and settlements — for as long as the group exists, because they are the other members' records too.
• Deleted groups — when a group is deleted it disappears from everyone's app, but we keep its records in case it was deleted by mistake.
• Share links stop working after 30 days.
• Inactive accounts — we don't delete them automatically; your account stays until you delete it.
• Backups — daily, kept for 7 days.

Deleting your account

You can delete your account in the app: Settings → your profile → Delete account. If you have an open balance, Halv asks you to settle it first. We delete your login, email address, profile photo, payment details, receipt scans, push tokens, purchase records and your analytics profile.

What stays: your display name on the expenses and settlements you shared, so the other people's balances stay correct — shown the same way as someone who never signed up — and the content that is part of those shared records, such as expense photos you attached. Anyone who shared a group with you can rename that entry. Analytics events recorded before deletion are kept under your former account id, no longer linked to your profile.

Everything, step by step, is on Delete your Halv account.

Your rights

Under the GDPR you have the right to:

• access your data and get a copy of it;
• correct it — your name, photo and payment details can be changed in the app;
• delete it;
• restrict how we use it;
• take it with you in a machine-readable format;
• object to uses based on our legitimate interest — including analytics, which you can also switch off yourself in the app, except in the Android versions that don't have the switch yet.

Email hello@halv.money from the address on your account. We answer within one month; if a request is complex we may extend that by up to two more months and will tell you why. If we can't tell that the request comes from you, we'll ask you to confirm it. Some data is part of other people's records as well; we give you what's yours without exposing theirs.

You can also complain to the Polish data protection authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl — or to the authority in the EU country where you live or work.

Automated decisions

We don't make decisions about you that have legal or similarly significant effects by automated means alone. Halv does apply automatic limits to receipt scanning — how many free scans you have, and how many scans per minute, hour and day — and if a used upgrade is refunded, the free scans reset.

Age

Halv is for people aged 16 and over.

Security

Data travels encrypted, access to it is limited to what each person is allowed to see, and our providers store it in encrypted, access-controlled systems. If something goes wrong in a way that puts your data at risk, we will tell the authority and, where required, you.

Changes

If this policy changes materially, we'll tell you in the app or by email before the change applies, and update the date at the top.