TripSplit ("we", "our", or "the app") values and respects your personal privacy.
This Privacy Policy explains how our offline-first mobile application handles your financial records,
data synchronization, device permissions, and security.
TripSplit is fundamentally built on an offline-first architecture.
Your financial transactions, member names, and receipt snapshots remain strictly private and stored locally on your device by default.
Cloud synchronization only occurs when you explicitly initiate group trip sharing via secure Trip Codes.
1 Offline-First Architecture & Cloud Group Sync
TripSplit gives you full local control while offering convenient group sharing capabilities:
- Local SQLite Database: All core data—including family rosters, member profiles, trip records, individual expenses, advances, splits, and settlement calculations—is stored locally on your device in a private SQLite database.
- No Mandatory Accounts: You do not need to register an account, create a password, or submit your phone number or email address to use TripSplit.
- Optional Cloud Group Synchronization (Firebase): When you choose to share a trip with family or friends using a 6-character Trip Code or QR code, the trip's members, expenses, and settlements are synchronized securely through Google Firebase Cloud Firestore so all participating members can collaborate in real time.
- Encrypted In-Transit: All data transmitted between your device and Google Firebase is encrypted end-to-end using industry-standard TLS / HTTPS cryptographic protocols.
2 Device Permissions & Purpose
TripSplit requests only minimal runtime permissions strictly required for explicit user actions:
📷 Camera
android.permission.CAMERA is invoked only when you take a photo of a physical receipt or bill. Image captures are stored locally on your phone.
🖼️ Photo Library & Storage
Accessed only when you choose to attach an existing receipt image from your gallery, or when saving exported PDF / CSV expense reports to storage.
🔒 Biometrics & Fingerprint
USE_BIOMETRIC / USE_FINGERPRINT is used solely for the optional on-device App Lock. Verification is handled strictly by Android system APIs; no biometric templates are ever accessed by our app.
3 Advertisements & Third-Party SDKs
- Google Mobile Ads (AdMob): TripSplit displays advertisements to support continuous maintenance and free access. The Google Mobile Ads SDK may collect pseudonymous device information, advertising IDs (AAID), diagnostic metrics, and approximate coarse location to deliver non-intrusive ads, prevent ad fraud, and cap ad repetition.
- Strict Financial Isolation: Your personal receipt photographs, split amounts, member names, and notes are never transmitted to advertisers or AdMob.
- Privacy Controls: You can learn more about how Google handles ad data or adjust your ad settings at Google Advertising Policies & Terms.
4 Data Sovereignty, Retention & Deletion
You maintain complete ownership of all data entered into TripSplit:
- Instant In-App Deletion: You can edit or permanently delete any family profile, member, trip, expense record, or settlement at any time directly within the app.
- Complete Data Wipe: Uninstalling TripSplit or clearing its app storage via Android Settings permanently deletes all local databases, cached preferences, and local receipt attachments.
- Shared Trip Data: Cloud-synced trips associated with a Trip Code can be cleared or modified by the trip participants at any time.
5 Security Safeguards
- Cryptographic App Lock: Optional 4-digit PIN security protected with salted SHA-256 cryptographic hashing.
- Biometric Protection: Compatible with Android BiometricPrompt for seamless, secure hardware-backed authentication.
- Safe Exporting: PDF expense statements, CSV spreadsheets, and backup archives are transferred exclusively through the native Android system share sheet at your explicit request.