Your data in AA split

Beta privacy notice · Updated 9 November 2026

AA split helps friends record shared expenses and calculate who owes whom. This notice describes the current beta. To delete your account, open Profile → Delete account or use our account deletion page. For privacy questions, contact the owner at privacy@aa-split.sg.

AA credits and payments

AA split is free. AA credits are optional prepaid credits for AI help beyond what’s free and for Shop items, and they never expire. On the website, top-ups are paid through Stripe: accounts whose home country is Singapore pay in Singapore dollars by PayNow or card, and other accounts pay in US dollars by card. In the iPhone and Android apps, top-ups are bought through the App Store or Google Play, and RevenueCat confirms each purchase for us. These services receive an opaque billing identifier for your account and the details needed to take and confirm the payment. AA split stores your credit balance and a record of each top-up, refund, AI charge and Shop purchase, including the pack, amount, currency, payment method type and the provider’s payment reference. Card and bank details are entered on Stripe’s hosted page or handled by Apple or Google; AA split never sees or stores them.

A refunded or disputed top-up takes back the credits it added, which can leave a negative balance. Top-ups belong to the AA split account that bought them and can’t be moved to another account. Unused credits can’t be used after you delete your account, and no automatic refund is issued. Records of top-ups and their use are kept without your profile details where we need them for accounting, refunds and fraud prevention. Payment providers keep their own records under their own notices. A subscription bought earlier isn’t canceled automatically; cancel it where you bought it.

Your local workspace

Your local workspace, receipt photos, downloaded language packs, and offline changes are stored in your browser on this device. Clearing site data can remove them. Export your workspace from your profile if you need a copy. Other people using the same device and browser profile may be able to access locally saved information.

Connected accounts and shared groups

When you choose Google sign-in, AA split receives your Google account identifier, name, email address, and profile image information to create and authenticate your account. It does not request access to your Gmail, contacts, or Google Drive.

Connected groups, memberships, expenses, item assignments, settlements, and account records are stored on the AA split server. Members of a group can see that group's shared records and participant information. Only share information appropriate for everyone in the group. Offline changes to connected groups are sent to the server when the app reconnects and synchronizes.

Automatic expense tracking

Payment text is processed on the capturing device. Raw notification text and selected-app settings are not uploaded. Uncertain captures stay on the device unless you choose to share a redacted example as described below. After five distinct confirmations, matching payment formats can save automatically on that device. If you enable Improve Auto-track for everyone, the app also sends the source, parser version, currency, a merchant fingerprint and a redacted format with your confirmation or correction. It does not send raw notification text, payment amounts or dates with these confirmations. Confirmation reports are linked to your account for deduplication, kept for up to 90 days and deleted with your account. You can stop future sharing in Auto-track settings. Qualified formats are reviewed and tested before inclusion in a future app update. Saved auto-tracked expense facts, including merchant, amount, currency, category, date and a random import identifier, are sent to your signed-in account when the app opens online. They are private Personal expenses until you choose to share or split them. Other signed-in devices receive these saved expenses, edits and deletions. The importing device keeps an acknowledgement to prevent repeated notifications from restoring deleted expenses.

Issue reports from Profile

When you choose Send report in Profile, we receive your description, up to three pictures you select, the app build and platform. These reports are linked to your signed-in account. Picture metadata is stripped, and descriptions and pictures are encrypted in server storage. Only the developer can review them to investigate and track fixes. Only pictures you select are sent; your expense history and other photos are not included automatically. Avoid including passwords, payment credentials or other sensitive information. Reports and pictures become unavailable after 90 days and are deleted by scheduled cleanup or account deletion. Investigation status and notes are internal and do not imply that an app update has been published.

Optional auto-track reports

Auto-tracked expenses and payments awaiting review have an optional reporting action. You can share limited parser diagnostics and optionally include a payment example. The preview shows the amount, currency, payment type, source app identifier when available and redacted payment wording. Names, account details, reference numbers and other unrecognised text are replaced on your device before the example is stored or sent; raw notifications are not uploaded. Reports can also include the app build, parser decisions, detected and saved amounts, and up to eight related records. On-device comparisons show relative timing, matching merchants, repeated notification events and sync relationships without sending names, raw identifiers or your full expense history. The form gathers available details automatically; older records or another device may not have the original notification. No report is sent automatically. Reports are linked to your signed-in account, expire after 90 days and are removed by scheduled cleanup or account deletion. The developer reviews these reports to investigate issues and track fixes for future updates. Reporting does not change your expense or automatically train a model.

Receipt image retention

On Android, photos shared to the native app are first staged in private app storage, with a maximum of ten photos under 8 MB each. Staged copies are removed after transfer to the local receipt inbox, or during the next intake cleanup after 24 hours.

Shared photos wait for you to choose Personal expenses, a one-time meal, or a group; receiving a photo does not authorize a cloud scan. Pending photos are associated with the signed-in account. Photos shared while signed out can be claimed by the next account that imports them on that device.

On iPhone, you can deliberately send the photo to the Telegram bot and open its Add this receipt link.

New receipt images are compressed and kept on AA split’s servers for 30 days by default. In Profile > Receipt storage, you can choose 7, 30 or 90 days or discard after scanning; no photo is kept longer than 90 days. The choice applies to new receipt images, within your photo storage (see Free use and AI limits). Access ends at expiry; server cleanup removes expired copies in regular batches, including while your app is closed. Cleanup can take longer during a backlog or outage. Expired local images are removed while AA split is open or when it next opens; a closed browser cannot run cleanup.

Expense and shared-draft images are kept in private Cloudflare R2 object storage, without application-level encryption. One-time-meal images retain their server encryption and require the current meal link. This is not end-to-end encryption. Eligible web downloads use private links lasting at most 60 seconds, bounded by photo expiry. A previously issued link can work until it expires after access is revoked; new links require current group access. Devices cache downloaded image bytes under the account and retention setting, never the temporary links. Failed downloads do not extend expiry. Deletion jobs retry during outages, so physical removal can follow later while expired access is already denied.

Older local images without a saved date receive a 7-day expiry when storage is upgraded. Receipt image cleanup keeps extracted expense details and does not delete original photos from your gallery or Telegram messages. Expiring Telegram references are removed separately from transaction history. Reopening a cached image does not extend its retention period.

Receipt scanning and translation

Free bill splitter

You can prepare a one-time expense without signing in. Its details stay in this browser until you sign in and create a sharing link, unless you choose AI receipt scanning. A pending sharing draft is saved in this tab’s session storage for up to 24 hours; closing the tab or clearing browser data can remove it. Receipt photos follow the local receipt-storage policy below.

The free scanner uses a signed, essential browser cookie lasting up to 90 days to enforce two AI scan attempts per UTC calendar month. The server also uses a keyed hash of your network address for abuse limits, including shared-network and service-wide caps. No advertising fingerprint or location permission is used. Quota records expire at the end of their limit windows and are cleaned up during later requests. A provider attempt can use an allowance even if its response fails.

Device scanning remains free when the AI allowance is used. Clearing cookies does not guarantee another allowance, and people on a shared network may encounter an additional limit.

The signup and sign-in screen discloses online receipt processing and links to our Receipt scanning terms. Continuing records the accepted version and time on your account after authentication, and the scanner does not ask a signed-in account again. When you choose to scan or rescan, AA split sends your photo, including personal details visible on it, through its server to a disclosed receipt processor.

The covered processors are Google Vertex AI, Google Gemini, and Qwen through OpenRouter and Alibaba. Rescan photo uses Qwen3.7 Flash through OpenRouter and Alibaba. Account agreement is remembered across signed-in devices, including after clearing local app data. Existing accounts are not backfilled as accepted; they are asked once if needed. A new processor outside this disclosure requires new agreement. Guests keep a separate browser-level prompt. An already sent photo cannot be recalled.

Account agreement does not automatically send photos. Manual entry and device scanning remain available. Initial signed-in scans may fall back to local scanning if the cloud is unavailable; failed Qwen rescans preserve reviewed items. Clearing browser data removes guest agreements, but not server-recorded account agreement. Manual expense entry outside the receipt scanner does not require receipt-processing agreement. Receipt translation packs run on your device. Saving a shared expense sends its reviewed item text, amounts, and assignments to the server; available saved receipt photos are compressed, stripped of image metadata and stored on the server for access from your other signed-in devices. Group members can access images attached to their shared expenses. Server uploads respect your account’s storage setting and any earlier expiry from scanning. Missing or expired local originals are not recovered by sync.

For one-time meals, an available receipt photo is also compressed, stripped of image metadata, encrypted on the server, and shared through the meal’s current review link. It is removed when the creator deletes its receipt details, when its seven-day sharing window expires, or when its creator deletes their account.

Replacing or revoking a meal link prevents further photo access through the old link. Previously viewed or downloaded copies cannot be recalled. Personal spending saved from a meal retains the reviewed item names, quantities, assignments, participant display names, payer, adjustments and shares, not the shared photo. These saved receipt details are encrypted on the server and available offline on the device after syncing. Each imported Personal expense belongs to the account that saved it and remains if the creator deletes the source meal or its converted group expense.

Anyone holding an active meal link can read the shared names, receipt items, shares and available photo without signing in. Only the signed-in creator can edit or reopen sharing. After seven days, the link closes; completed receipt facts remain encrypted for the creator until they delete the meal details or their account.

Reopening creates a fresh seven-day link and does not restore expired photos or change saved spending or payment status. Stored meal details are limited to 500 meals per creator, with at most 50 active meals. Model downloads contact their hosting providers, which receive ordinary connection information such as your IP address.

Scanning and translation can make mistakes, so review the results before saving.

Personalization and notifications

Your Personal ledger is private to your account. We save your chosen name, home country, default currency, app language, group appearance and setup preferences. To suggest a currency and greeting, your browser contacts GeoJS, which receives your IP address and returns an approximate country and time zone.

AA split stores only that country and time zone on your device for six hours, not the IP address or precise location. A VPN can affect the estimate; your saved home preference takes priority.

Push notifications are optional and require your permission on each device. We store the browser subscription endpoint and encryption keys to deliver group transaction updates through your browser's push provider. Notifications may show expense information on your lock screen. Turn them off in Profile or your device settings. Signing out disconnects that session from notification delivery; account deletion removes subscriptions.

Announcements, news and offers

Signed-in accounts have an Updates inbox for release and service announcements. Promotional announcements and campaign push alerts require the optional “News & offers” preference inside Profile > Push notifications, which is off by default. Campaign push also needs a valid device subscription and a signed-in session.

Turning off news and offers stops future campaign push delivery and hides promotional inbox items; it does not turn off transaction alerts. A push already accepted by a provider cannot be recalled.

Announcements can be selected using your saved app language and home country. We associate an announcement with your account to avoid duplicate inbox entries. When you expand an announcement or click its action, we record the read or click time to report aggregate engagement. Push results report acceptance by the push provider, not proof that you saw the message. We do not add third-party marketing trackers or share recipient lists with advertisers.

Announcements expire from the inbox 30 days after their scheduled publication. Announcement and engagement records are removed in bounded cleanup batches beginning 90 days after expiry; cleanup runs while the service is operating and may take longer during a backlog or outage. Account deletion removes your announcement associations. Unsent push jobs expire after 24 hours.

Messaging integrations

Sharing an invitation opens the messaging platform you choose. That platform handles the message under its own privacy policy. If Telegram bot connections are enabled, messages and photos you deliberately send to the bot are processed by Telegram and the AA split server. A cloud receipt provider may process those photos when that optional feature is configured.

For a retained Telegram receipt, AA split stores a private, expiring Telegram file reference and caches a local image when you open it. Image bytes are processed temporarily by the server and are not stored permanently there. Only current members of the associated AA split group can fetch the image.

Free use and AI limits

AA split has no subscription. Every account gets free AI receipt scans each day and a monthly AI allowance for AA assistant and category help; device receipt scanning and typed expenses have no daily cap. To apply these limits, we store your daily count of AI receipt scans, your monthly AI allowance usage and the size of the receipt photos saved to your account. When today’s free scans or the monthly allowance are used, AI help can continue from your AA credits, charged by processing cost; failed requests are not charged. Receipt photos are kept for up to 90 days, and each account can store up to 1 GB of them. When storage is full, new receipt photos stay on your device instead of being uploaded.

AA credit prices are shown before you pay: on the website in Singapore dollars or US dollars, based on the home country in your AA split profile, and in the apps by the App Store or Google Play for your store country. AA split doesn’t look up your location to set a price.

The assistant and AI allowance

The assistant works in Telegram and, for signed-in accounts, in the app under Assistant. Most messages are understood on the AA split server. Only receipt photos and messages it cannot read itself are sent to the configured AI provider, with the message and limited current context. Each account has a monthly AI allowance. To apply it, we store your account’s monthly AI allowance usage; we do not keep the messages for this. The assistant proposes changes, such as saving a list of expenses, changing several categories or dates, deleting expenses or recording a payment, and nothing changes until you tap to confirm it. Changes made through the assistant in Telegram are marked “via Telegram” in that group’s Activity. Shared group expenses can be changed by any member of that group, in the app or through the assistant; your personal expenses can only be changed by you. In a group chat the assistant answers only about that linked group and your own part in it, and every reply there is visible to the whole chat; your personal expenses, other groups and AI allowance are shown only in your private chat or in your own app.

Messages you send to the assistant in the app, and its replies, are stored with your account so you can read the conversation, and are deleted after 30 days or when you delete your account. They are not shared with Telegram or other members.

You can set monthly budgets for everything or a category in Analytics. We store each limit and its currency with your account and compare them only with your own spending; nobody else in your groups sees them. Budget alerts are currently unavailable. Saved limits and earlier alert history are kept with your account until you change them or delete your account. To suggest better categories, the assistant looks at the categories you previously gave the same expense titles. When it cannot tell where an expense in Other belongs, it may offer to use your shared AI allowance to ask the AI provider; only if you tap that does it send the titles, amounts and currencies of those expenses (up to 20), and you review the suggestions before anything changes. At most every two weeks it may offer, in your private chat or on Home in the app, to move recent expenses out of Other; we store when that offer was last sent or answered. Profile → Preferences → Category suggestions controls automatic category suggestions. You can turn them off or back on there. Telegram delivery also follows your connection settings; pausing the assistant in AA split → Telegram stops those bot messages. Account deletion removes your budgets, alerts, AI allowance usage, suggestion records and in-app assistant messages.

Meta Muse

You can connect AA split to Meta’s Muse app with an API key made in Connectors → Meta Muse and added to a custom connector in Muse, or, once AA split is listed in Muse, by connecting from Muse. You choose full access or read only. Muse can then read your groups, member names, balances and recent expenses. With full access, Muse can also add, change or settle expenses through the assistant: Muse understands your request, and reads any receipt photo you give it, with Meta’s own AI, then sends AA split the details, such as the amount, the people and a receipt’s items and charges. AA split’s AI provider, your AA credits and your AI allowance are not used for Muse. Nothing in your groups changes until Muse confirms one of the assistant’s buttons, and changes made through Muse are marked “via Meta Muse” in Activity, where other members of that group can see them.

AA split shares this information only with Meta Muse, as answers to Muse’s requests; Meta handles it, including photos you give Muse, under its own privacy policy. AA split stores the connection (your account, its access level, and when it was connected and last used) and keeps API keys and Muse’s access and refresh tokens only as one-way hashes. Unfinished sign-ins are deleted a day after they expire. Requests and details Muse sends to the assistant, and its replies, are kept in a separate conversation for 30 days and do not appear under Assistant in the app. AA split does not use this information for advertising or profiling.

To change Muse’s access or disconnect, open Profile → Connectors → Meta Muse. Making a new API key stops the earlier one. Disconnecting ends Muse’s access straight away and deletes the connection’s tokens; expenses already saved stay in your groups. Deleting your account removes your connections.

Service providers and security

Synced records travel over HTTPS and are stored in Supabase's AES-256-encrypted database. The API verifies the database server's certificate and hostname when connecting over TLS. Google sign-in and server-side membership checks control account and group access. The server processes authorized records to provide balances, synchronization and the Telegram assistant; this is service-managed encryption, not end-to-end encryption. Local browser copies and downloaded Excel files rely on your device's security.

AA split uses Google for sign-in, Render for application hosting, and Supabase for its database. These providers process the data needed to deliver their services. Database hosting is configured in Singapore; network delivery and provider operations may involve other countries. Server logs and security records help diagnose failures, prevent abuse, and protect accounts. Keep invitation links private: a valid invitation can grant access to its group.

Retention, export, and deletion

Account and shared expense records remain until they are removed or the service's records are otherwise cleaned up. This beta does not promise a fixed automatic deletion period. You can export expenses, payments, splits and members as an Excel workbook from your profile and manage local data on your device. Contact the email above to request account deletion; ownership must be verified before a request is applied.

Account deletion revokes sessions and anonymizes account and membership information. Shared ledger and audit records can remain to preserve other members' expense history. Text you or others entered into shared expense descriptions may still identify you. Copies already exported by other members and provider backups may remain outside the active account. Do not place passwords, payment-card details, or identity documents in expense notes.

Product analytics

AA split uses aggregate registrations, active users, group adoption and recorded feature usage to improve the service. These reports are calculated from account, expense and activity records. These aggregate reports exclude customer names, emails, expense descriptions, receipt contents and Telegram messages. This feature adds no third-party analytics tracking.

To count active users, when you use AA split while signed in, including through Telegram, we record that your account was active during that hour. The record includes the platform (iPhone app, Android app, web browser, installed web app or Telegram), the app version and how many times the app was opened. It does not include the screens you view, what you enter, your location, IP address or device identifiers. These records are linked to your account to avoid counting you twice, are used only for aggregate reports, are deleted after about 400 days and are deleted with your account.

Service analytics use aggregate usage and campaign results. They exclude individual transactions, balances, receipt contents, chat messages, credentials, authentication tokens, push endpoints and recipient lists. Descriptions, pictures and diagnostics you explicitly submit through issue reporting are handled separately as described above. Access is restricted to the verified developer account and recorded in security logs without copying report or customer record contents.

This reporting restriction does not mean that server-stored data is end-to-end encrypted or inaccessible to authorized infrastructure operators. The service and its hosting providers process the underlying records described above to run AA split, support account requests and investigate failures.

Changes to this notice

We will update this page when the beta's data handling changes. Check the date above for the current version.

Group safety

Group settings let you block invitations and notifications from another account without changing shared expenses or balances. Blocks store the two account IDs. Reporting opens an email draft with your chosen reason and group/member identifiers; you choose whether to send it using your email app. It does not automatically upload receipt contents or send a report. Group safety guidance.