Last updated: March 14, 2026
Your privacy is important to us. This policy explains how we collect, use, and protect your data.
PureSplit is committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and other applicable privacy laws. This policy describes how we handle your personal information. The data controller under GDPR is Maksymilian Olowski operating as a private individual (see Imprint). No data protection officer has been appointed.
We collect the minimum data necessary to provide our service:
Your data is used exclusively to:
Processing is based on Art. 6(1)(b) GDPR (contract performance) for providing the service, Art. 6(1)(f) GDPR (legitimate interest) for security measures such as Turnstile, Art. 6(1)(a) GDPR and § 25(1) TTDSG (consent) for Google Analytics, and Art. 6(1)(c) GDPR where statutory retention obligations apply.
We do not sell, rent, or trade your personal information. Your expense data is only visible to members of groups you create or join. We only share data with third parties when required by law.
The application and database are hosted in Germany (Nuremberg). Your data is stored on secure servers. We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, or destruction.
Under GDPR, you have the following rights:
You can exercise these rights through the Settings page in your account.
You have the right to lodge a complaint with a supervisory authority (e.g., your local data protection authority).
We retain your data only as long as necessary to provide our services. When you delete your account, all your personal data is permanently removed from our systems. Google Analytics event data is retained for 14 months (the maximum permitted by GA4) and then automatically deleted by Google; aggregated, non-identifying statistics may be kept beyond that period.
We use essential cookies required for authentication and session management. With your consent, we also set analytics cookies for Google Analytics (see next section). We do not use advertising cookies. You can change your cookie choice at any time using the "Cookie settings" button below.
With your prior consent we use Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and, where applicable, Google LLC (USA). Google Analytics uses cookies and similar identifiers to help us understand how visitors interact with the app (pages viewed, session duration, device/browser category, approximate location based on a truncated IP address). We have configured Google Consent Mode v2 (advanced) so that no analytics cookies are set and no measurement data is collected until you accept analytics in the cookie banner. IP addresses are anonymised. The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TTDSG. You can withdraw your consent at any time with effect for the future using the "Cookie settings" button below. Data may be transferred to the USA; Google LLC is self-certified under the EU-US Data Privacy Framework. Google's privacy policy: https://policies.google.com/privacy
We use Cloudflare Turnstile on our login and registration pages to protect against bots and automated abuse. Turnstile is a privacy-preserving CAPTCHA alternative that may collect minimal client-side signals (such as IP address, TLS fingerprint, and browser data) solely to distinguish human users from bots. This data is processed by Cloudflare, Inc. and is used exclusively for security purposes—not for advertising or profiling. As the website operator, we act as the data controller for this processing. For more information about Turnstile and Cloudflare's data practices, see Cloudflare's Turnstile Privacy Policy: https://www.cloudflare.com/privacypolicy/
If you choose "Continue with Google" when signing in or registering, Google will process authentication data and provide us with basic profile information (such as your name, email address, and profile image) needed to create or access your account. We do not receive your Google password. This processing only occurs when you actively choose Google Sign-In. For more information, see Google's Privacy Policy: https://policies.google.com/privacy
We use Resend (Resend, Inc., USA) to send emails such as verification emails, group invitations, settlement notifications, and payment reminders. Recipient addresses and email content are transmitted to Resend. Resend processes this data solely as a processor on our behalf. When data is transferred to the USA, appropriate safeguards (e.g., Standard Contractual Clauses) apply. For more information: https://resend.com/legal/privacy-policy
We use the following subprocessors to deliver the service: Cloudflare, Inc. (USA) — Turnstile bot protection during registration and login. Data transferred: IP address, TLS/browser fingerprint. Safeguards: EU-US Data Privacy Framework (DPF) self-certification. Data Processing Addendum executed under Art. 28 GDPR. Reference: https://www.cloudflare.com/cloudflare-customer-dpa/ — DPF list: https://www.dataprivacyframework.gov/list Google Ireland Limited (Ireland) / Google LLC (USA) — Google Analytics 4 web analytics, only when you grant analytics consent in the cookie banner. Google Sign-In (OAuth) is used only when you actively choose that login option. Data transferred: truncated IP address, device/browser data, pseudonymous client identifier, page interaction events (Analytics); email, name, profile image URL (OAuth). Safeguards: EU-US Data Privacy Framework (DPF) self-certification. Standard Contractual Clauses where applicable. Data Processing Addendum executed under Art. 28 GDPR. Reference: https://business.safety.google/adsprocessorterms/ — https://cloud.google.com/terms/data-processing-addendum — DPF list: https://www.dataprivacyframework.gov/list Resend, Inc. (USA) — Transactional email delivery (verification, password reset, group notifications). Data transferred: recipient email address, recipient name, message content. Safeguards: Standard Contractual Clauses (SCCs) pursuant to Commission Implementing Decision (EU) 2021/914 (Module 2: controller-to-processor), supplemented by additional technical and organizational measures. Reference: https://resend.com/legal/data-processing-addendum Hetzner Online GmbH (Germany) — Application hosting (via Coolify) and S3-compatible object storage for receipt attachments. Data centers in Nuremberg / Falkenstein / Helsinki (EU/EEA only). Safeguards: EU hosting, no third-country transfer. Data Processing Addendum executed under Art. 28 GDPR. Reference: https://www.hetzner.com/rechtliches/avv A copy of each Data Processing Addendum and the Transfer Impact Assessment for US transfers (Schrems II) can be requested at [email protected].
We may update this policy from time to time. We will notify you of any significant changes via email or through the application.
For any privacy-related questions or to exercise your GDPR rights, please use the data management tools in your account settings or contact us directly (email: [email protected]).