Privacy policy

Receipt photos. When you scan a receipt, the photo is uploaded so it can be read and shown alongside the split.

Receipt contents. The merchant, date, line items, taxes, fees and tip extracted from the photo, plus any edits you make.

Names you type. The display names of people you add to a split. There is no requirement to use real names.

Contacts you pick, if you import them. Where supported, your phone shows a picker and PiecePal receives the entries you choose. In the native app fallback, after permission, PiecePal reads contact names and phone numbers locally to show its own selection list. Only the people you select are saved to your account; the full list is not uploaded.

Account details. Your email address, login credentials and, if you sign in with Google or Apple, the name and profile details that provider returns.

Subscription status. If you subscribe in the iPhone or Android app, your plan, renewal date and a payment reference from Apple or Google (through RevenueCat). We never receive your card details.

Your location, only when you ask for it. When you look for places to eat nearby, your device's current location is sent to Google Maps to find them. We do not store it.

Places you save. The name and address of a place you save from a receipt, looked up on Google Maps so it can be shown on a map, with its map position.

Friends and Pal Circles, if you use them. The @username you choose, an optional nickname, your friends and the people you have blocked, which circles you are in and your role there, join requests and invitations, the places a circle chose and who was in that plan, and any report you send us. Nothing here is created until you choose a username.

Your phone number, if you add one. The number you type when you sign up or later in Settings. It only counts once you confirm it with a code we text you; until then it stays a suggestion on your account. You can change or remove it at any time. Nobody else sees it unless you turn on “Show my number to people I split with”; then signed-in people on the same receipt or in the same Pal Circle can see it under your name, and it can fill in as your Whish number for them.

Technical data. IP address, device and browser information and basic usage logs, used for security and to keep the service running.

Support messages you send us by email.

Utility bills can include your address, account number, billing period, usage and amount. Their original files and extracted details are stored with your account.

Before using AI, you can explicitly allow sending the document contents, merchant details and messages being processed through Lovable to providers including Google and OpenAI. Manual entry remains available if you refuse. Change or withdraw this permission in Settings to stop future AI requests.

To provide the service (account, scanning, splits, syncing, subscriptions) — performance of our contract with you.

Security and fraud prevention, and improving the product — our legitimate interests.

Customer support — contract and legitimate interests.

Tax and accounting records — legal obligation.

Optional features such as push notifications, contact import and nearby places — your consent, which you can withdraw at any time.

Receipt photos are sent to an AI model to extract the text on them, and what you type into the AI features is sent to an AI model to answer it. We do not sell your data and do not use it for advertising.

Apple and Google, when you subscribe inside the iPhone or Android app: they sell the subscription and handle the payment under their own privacy policies. RevenueCat manages those in-app subscriptions for us and receives your PiecePal account ID and purchase history.

Service providers who process data for us: Lovable (hosting, and the gateway to the AI models), Supabase (database, sign-in and file storage), Google and OpenAI (the AI models that read receipts and power the AI features), Google Firebase (push notifications), Google Maps (places), Resend (email delivery) and Twilio (the text message that carries your phone confirmation code; it receives the number and the code, only when you ask for one).

Professional advisers (legal, accounting) where needed, and authorities where required by law.

Some of these providers are located outside your country. Where data is transferred internationally we rely on appropriate safeguards such as standard contractual clauses.

We use appropriate technical and organisational measures, including encryption in transit, access controls and per-account data separation, to protect your information.

Depending on where you live, you can ask to access, correct, delete, restrict or export your data, object to processing, and withdraw consent. You can also complain to your local data protection authority. We respond within one month.

Friends and circle members see your @username and a nickname if you add one. They never see your name, email, receipts, spending or how you voted. Nobody can browse or search for people: someone has to type your exact username, and you can turn that off in your username settings.

A circle's plans, members and history are visible only to its members, and each member sees history only from when they joined. Circle admins can see who has asked to join and can remove people.

When a circle plans a meal, the places come from Google Maps and the order is worked out by PiecePal from each place's rating, price range, distance and type, and the kinds of places your circle has picked before. If a host has allowed AI, those anonymous place facts (never names, never votes) may be processed by a third-party AI service to suggest an order.

Receipts are reachable through an unguessable private link. Anyone who has the link can view the receipt and claim items on it — that is how sharing works. Treat a receipt link like the receipt itself, and only send it to the people you are splitting with.

Organizer links carry extra powers (editing items, removing people) and are separate from the link you share with the group.

The person who runs PiecePal has an administrator view of the service. It lists accounts (email address, name, how you sign in, when you joined and last signed in, and how many splits you have organised or joined) and recent splits (the store name, the total, who organised it and how many people are on it), and it can open a split through its link. Like anyone who operates a database, they can also reach stored data directly when that is needed to run, support and secure the service.

This access is used for the purposes listed above under “Why we use it, and our legal basis”: providing the service, customer support, and security and fraud prevention. It is limited to the account that has been given the administrator role.

Receipts, utility bills, their originals and private records stay until you delete them or your account. Billing records are kept as long as tax law requires. The location used to find nearby places is not kept. Security events are kept for up to 30 days. An account-deletion audit record retains the deleted account identifier and deletion timestamp for operational accountability; it does not retain the deleted documents. Third-party billing records can be retained where their legal obligations require it. Data we no longer need is deleted or anonymised.

Friend and circle requests expire after 14 days. A circle's history of chosen places is kept for 12 months. Individual votes in a circle plan are deleted within 7 days of a choice, or when the plan ends.

You can delete your account and its data yourself, at any time, from inside the app: open Profile, scroll to the bottom and choose Delete account under “Danger zone”. You will be shown exactly what is about to be removed and asked to confirm by typing DELETE.

This permanently removes your profile, your receipts and their items, your receipt photographs, utility bills and original copies, your trips, subscriptions, reminders, budgets, spending limits, notifications and preferences after cleanup succeeds. Failed cleanup is reported so you can retry. Completed deletion is irreversible. The limited security/deletion records and legally required third-party billing records described above follow their stated retention rules.

Your username, friendships, blocks, requests and circle memberships are deleted. Circles you were in carry on for the others, and ownership passes to another member. You disappear from the lists of who planned past outings.

One exception, so that other people's records are not destroyed along with yours: a split or payment tracker that other people joined continues to exist for them, with your name replaced by “Deleted user” and your photo deleted. The amounts stay so their share of the bill still adds up. Splits nobody else joined are deleted outright.

If you cannot reach the in-app option — for example you have lost access to your sign-in — you can also request deletion by emailing [email protected] from the address on the account, and we will carry out the same deletion for you.

PiecePal does not use advertising or cross-site tracking cookies. Signing in stores a session in your browser so you stay logged in; signing out clears it.

Our cookie policy lists everything PiecePal keeps in your browser and lets you change your choice at any time.

PiecePal is not intended for children under 13.

If this policy changes in a way that affects how your information is handled, the change will appear on this page.

Questions, deletion requests, or anything security-related: email [email protected].