Last updated: August 25, 2026 · Effective: August 25, 2026
This Policy applies to all users of the Splik app, available on iOS and Android. For the purposes of the DPDP Act, Splik acts as the Data Fiduciary in relation to the personal data of our users (Data Principals). If you do not agree with this Policy, please do not use the Service.
We collect only what the Service needs to function. We do not use advertising or analytics SDKs, and Splik does not sell your personal data.
| Category | What we collect | Collected from |
|---|---|---|
| Account & identity data | Name, phone number, email address | Provided by you at sign-up |
| Expense & group data | Expense descriptions, amounts, dates, categories, group names, who's included in each split | Entered by you or shared by group members |
| Receipt & profile images | Photos you attach to an expense or set as a profile picture | Your camera or photo library, with your permission |
| Contacts (optional) | Names and phone numbers from your device address book | Your device, only if you grant permission |
| Authentication data | Device-level biometric confirmation (Face ID / fingerprint) — Splik never receives the biometric data itself | Your device's operating system |
| Device & push-notification data | Firebase Cloud Messaging token, device type, app version | Automatically, to deliver notifications and keep the app secure |
| Preferences | Theme, font, currency-converter settings, notification settings | Stored locally and/or against your account |
We do not collect precise or approximate location, payment card or bank account numbers, government ID numbers, call logs, or SMS content.
Each permission is requested only at the moment it is needed, and every one is optional in the sense that declining it only disables the specific feature it powers — you can always use Splik's core group-splitting features without granting any of them.
| Permission | Why Splik asks for it | If you decline |
|---|---|---|
| Contacts | "Splik needs access to your contacts to let you easily add friends and group members by their phone numbers." | Add friends manually by typing a name and number instead |
| Camera | "Splik needs access to your camera to take photos of receipts and profile pictures." | Skip attaching a receipt photo or profile picture |
| Photo library | "Splik needs access to your photo library to choose receipts and profile pictures." | Skip attaching an existing photo |
| Biometrics (Face ID / fingerprint) | "Authenticate to log in to Splik" — a faster, optional way to unlock the app | Log in with your regular account credentials instead |
| Notifications | To alert you about new expenses, settlements, and account activity | Turn off in Profile → Notifications, or at the OS level, at any time |
We process your personal data for the following specified purposes, and for no purpose incompatible with them:
Under the DPDP Act, our processing is based on your consent, given at account creation and at the time each optional permission is requested, except where processing is permitted without consent for a "legitimate use" recognised under the Act (for example, to comply with a legal obligation or in a medical/public-order emergency). You may withdraw consent at any time as described in Section 10.
In accordance with the DPDP Act, before we process your personal data on the basis of consent we will present you with a clear, itemised notice, in plain language, stating: (a) the personal data being collected, (b) the specific purpose of processing, (c) the manner in which you may exercise your rights under Section 10, and (d) how to lodge a complaint with the Data Protection Board of India. Your consent is free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action (for example, tapping "Allow" or "Agree"). You may give or withhold consent separately for each purpose, and withdrawing consent is as easy as giving it.
We do not sell, rent, or trade your personal data. We disclose personal data only in the following circumstances:
Our infrastructure provider (Google Firebase / Google Cloud) may process and store data on servers located outside India. We take reasonable steps to ensure any such transfer is subject to appropriate contractual and technical safeguards. We will comply with any country-specific restriction on cross-border transfer of personal data that the Central Government of India may notify from time to time under the DPDP Act.
We apply reasonable technical and organisational measures appropriate to the sensitivity of the data we hold, including encryption of data in transit and at rest (via Firebase's platform-level encryption), role-based access rules on our database (Firestore Security Rules) so that a user can only read data belonging to their own account or a group/expense they are part of, and access controls restricting our own personnel's access to production data to what is strictly necessary. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we work to protect your data and will notify you as described in Section 13 if a breach affecting you occurs.
We retain your personal data for as long as your account remains active, so your history is available if you sign in again or reinstall the app. We retain data for the following further periods, or until the purpose of processing is no longer served, whichever is earlier:
Where the DPDP Rules prescribe a fixed retention/erasure period for a class of data fiduciary that applies to us, we will follow that period, including any advance notice to you before erasure.
Subject to verification of your identity and the exceptions permitted by law, you have the right to:
You may exercise these rights from within the app (Profile → Privacy) or by emailing us at info@splik.in. If unsatisfied with our response, you may complain to the Data Protection Board of India.
You can permanently delete your Splik account and associated personal data at any time, directly within the app, from Profile → Settings → Delete Account. This is a full, self-service deletion flow — we do not require you to contact customer support or visit a website to complete it. When you delete your account:
In line with the DPDP Act, Splik defines a "child" as an individual under the age of 18. The Service is intended for users who are 18 years of age or older, and we do not knowingly collect personal data from anyone under 18. If we become aware that we have inadvertently collected personal data from a child, we will delete it promptly. If you believe a child under 18 has provided us with personal data, please contact us at info@splik.in.
In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals without undue delay, in the manner and within the timeline prescribed under the DPDP Rules, and will describe the nature of the breach, its likely consequences, and the measures taken or proposed to mitigate it.
In accordance with the DPDP Act, we have designated a Grievance Officer to address your queries and grievances regarding the processing of your personal data.
If you are not satisfied with the resolution of your grievance, you may escalate your complaint to the Data Protection Board of India, constituted under the DPDP Act.
The Service may contain the ability to share content to third-party apps you already have installed on your device (e.g. sharing a summary via WhatsApp). This Policy does not cover, and we are not responsible for, the privacy practices of any third-party app or website you may reach that way.
We may update this Policy from time to time to reflect changes in our practices or in applicable law. If we make a material change, we will notify you in-app or by another appropriate means before the change takes effect, and update the "Last updated" date above. Continued use of the Service after a change takes effect constitutes your acknowledgement of the updated Policy.
Questions about this Policy or how we handle your data? Email us at info@splik.in.