EvensiesEspañol

Privacy policy

Last updated

Who we are

Evensies keeps track of shared costs in a group: who paid, who owes whom, and settling up. This policy covers the Evensies app and this website, and says what we store about you, where, why, for how long, and who else handles it.

Evensies is a Freedom Terminal product. Freedom Terminal is the trading name of the app's developer, the seller named on the app's App Store page, who is responsible for your data. Write to support@freedom-terminal.com about anything in this policy.

The short version

  • No ads and no tracking. We don't sell your data or share it for advertising.
  • From version 1.0.1, the app sends anonymous usage data and crash reports, never your groups, names or amounts. You can turn it off in Account with Share anonymous usage data.
  • You sign in with your email address and a one-time code. There is no password.
  • Your groups are kept on your phone and on our server, so everyone in a group sees the same balances.
  • Receipts you add are shown only to the members of that group.
  • On an iPhone with Apple Intelligence on, running iOS 27 or later, a receipt you scan is read on the phone itself; it is sent to an outside service only if the phone cannot read it and receipt scanning is on.
  • A receipt is sent to an outside service to be read only while receipt scanning is on, and only when you add it to an expense.
  • You can delete your account in the app, and it happens at once.

What we store, where, why and for how long

Your email address

Where
Our database at Cloudflare
Why
To send you sign-in codes and to know which account is yours, and, only if you turned it on, occasional news about Evensies; turn it off in Account at any time.
How long
Until you delete your account.

Your name and default currency

Where
Our database
Why
Your name shows on your place in each group you are in. Until you type a name in Account, it is the part of your email address before the @. The currency starts your new groups.
How long
Until you delete your account. The name on your places in groups stays with those groups (see Deleting your account).

Sign-in sessions

Where
Our database, and your phone's secure storage (the Keychain on iPhone)
Why
To keep you signed in. The sign-in software also records, with each session, the IP address it was started from when the network passes it on, and the user agent your phone sent (the app's and the system's name and version). We don't use these for anything else.
How long
90 days after you last used the app. Deleted when you sign out with a connection, and when you delete your account.

Sign-in codes

Where
Our database
Why
To check the code you type.
How long
A code works for 10 minutes. It is deleted once used, and cleared out after it expires.

If you sign in with Apple: the account ID Apple gives Evensies, the email address Apple shares (yours, or a relay address if you chose Hide My Email), your name if you let Apple share it, the sign-in token Apple signed, and a token from Apple that lets us end Sign in with Apple for Evensies

Where
Our database, the token from Apple encrypted; and on your phone, in its secure storage, the account ID Apple gives, and the name Apple gave until a sign-in with it goes through
Why
To know which account is yours when you sign in with Apple. A relay address forwards our sign-in codes and emails to you, and you can turn it off in your Apple Account's settings. Your phone asks Apple each time Evensies opens whether you still use Sign in with Apple for it, and signs you out if not.
How long
Until you delete your account, when we also ask Apple to end Sign in with Apple for Evensies. If Apple can't be reached, we keep the token from Apple, encrypted, and ask again each night until Apple confirms. On your phone, until you sign out.

A one-way scrambled form of your network (IP) address, only if you ask for a sign-in code for the account App Review uses to test the app, and for nothing else

Where
Our database
Why
To limit how many codes that one account is given each day, by one device and in all.
How long
Deleted the night after the day it was made.

Your groups: names, the names of the people in them and when each was sent an invite link, expenses (description, amount, currency, exchange rate, date, category, notes, who paid and who owes), payments, comments, repeating expenses, settings, the group's notes and who last changed them and when, and the activity and change history

Where
Our database, and a copy on the phone of each member
Why
So every member sees the same group and the same balances, on any phone and offline.
How long
As long as the group exists. An owner of the group can delete it in the app: it is gone for every member at once, its owner can restore it from Activity for 30 days, and the nightly cleanup after that deletes it for good, with its receipts. A deleted expense or payment disappears from the group, but its record stays in the group's history, and anyone in the group can restore it from Activity.

Receipts: photos, screenshots and PDFs you add to expenses

Where
Cloudflare R2 file storage, filed under the group
Why
So the group's members can open the receipt from the expense. Only members can, and browsers are told not to keep a copy. Each file is stored with the account that added it and the file's original name.
How long
As long as the group exists, and deleted with it when a deleted group is deleted for good. Deleting an expense does not delete its receipt file, so restoring the expense brings the receipt back: write to us to have one removed.

Receipts you chose for an expense and never saved with it

Where
Cloudflare R2 file storage, filed under the group
Why
The app uploads a receipt as soon as you choose it, so it is on the expense the moment you save. Only the group's members can open it, and browsers are told not to keep a copy.
How long
Deleted by our nightly clear-out, normally the first night after it is a day old, and on a later night when many are waiting.

A group's cover photo, if someone in the group adds one

Where
Cloudflare R2 file storage, filed under the group; on members' phones, in memory only while the app is open
Why
To show it at the top of the group and beside its name. Only members can see it, browsers are told not to keep a copy, and the app never writes it to the phone's storage. It is stored with the account that added it.
How long
Until it is deleted once someone in the group replaces or removes it. A photo uploaded and never set as the cover is deleted by our nightly clear-out, normally the first night after it is a day old, and on a later night when many are waiting. Otherwise as long as the group exists.

How many receipts you scanned each day

Where
Our database
Why
To limit each account to 40 scans a day.
How long
Until you delete your account.

Your purchase: the App Store's transaction number for the Create groups purchase, whether it was a test or a real purchase, whether it came through Family Sharing, any refund, and which account holds it. Also a random code on your account that the App Store puts inside your purchase.

Where
Our database
Why
To know which account may create groups, to move the purchase when you restore it, and to honour refunds.
How long
The random code goes with your account. The purchase record is kept after you delete your account, with nothing linking it to you, so a refund still counts if it is restored to another account.

Invite links: a code that works for 7 days, who made it, which name in the group it was made for when it was made for one person, and who last joined with it; and, once someone opens it on this website, a viewing link for that browser

Where
Our database
Why
To let people join a group, and let people without the app see its balances.
How long
Invite records stay with the group. Viewing links work until someone in the group taps Stop sharing link, which also turns off every invite.

Notifications, if you turn them on: your phone's notification token, with the app version and your phone's language and number format; your notification choices; and when you last sent someone a reminder

Where
Our database
Why
To send notifications to your phone through Apple, in your language, and to allow one reminder a week.
How long
The token is deleted when you sign out or delete your account (after a sign-out without a connection, the next time Evensies opens with one), when Apple tells us it no longer works, or when your phone has not sent it to us for 90 days (Evensies sends it at least once a week while you use it). Your choices are deleted with your account, and the record of a reminder a week after it was sent.

The Weekly email, if you turn it on: that it is on, the language and number format it is written in, and when it was last put together for you

Where
Our database; each email goes to you through Resend
Why
To send you, at most once a week, what others changed in your groups and what you owe, in your language. It says nothing about a group you are not in. Turn it off in Account, or with the link at the foot of any of them, which needs no sign-in.
How long
The language and number format until you turn it off, in the app or with the link, or delete your account. When it was last put together is replaced each week; once you turn it off, it is kept until a week has passed since it was last put together, so turning it back on cannot bring a second email that week, and is then deleted by our nightly clear-out, normally the first night after. Nothing of what an email said is kept.

How you get paid, if you add it in How you get paid: your Venmo, PayPal.Me, Cash App, Revolut, Monzo, UPI, Wise or PayMe name, the email or U.S. mobile number you use with Zelle, the Spanish mobile number you use with Bizum, and any bank details you type

Where
Our database, and a copy on the phones of the people in your groups
Why
So people in your groups can pay you: Settle up opens their payment app with your name and the amount filled in, or shows your Zelle or Bizum for them to copy into their bank's app. Only people who share a group with you see them, never someone who only has an invite link. Evensies never moves money itself.
How long
Until you change or clear them, or delete your account. A phone keeps its copy until the app next asks for that group's details, which stop coming once its owner leaves the group, or until its owner signs out.

Anonymous usage data and crash reports, from version 1.0.1 of the app: a random identifier made for this installation; which steps you take in the app, such as that an expense was added and how it was split, but never its description, amount or the names of the people in it; the app's version, the phone's model and system, its language and time zone; and, when something goes wrong, the kind of error and where in the app's code it happened, never its message

Where
PostHog, in the United States
Why
To see where people get stuck and which features are used, and to find and fix crashes. It is not linked to your account, your email address or your name, and is never used for advertising. Your IP address reaches PostHog with each request; PostHog is set to discard it, and no location is derived from it. Turn it off in Account with Share anonymous usage data: the app then sends nothing more, and deletes the identifier and anything waiting to be sent. A request already on its way completes.
How long
Up to 7 years at PostHog. On your phone, until you turn the switch off or delete the app.

Server logs: each request's address, time and result, details Cloudflare adds, and our error messages

Where
Cloudflare
Why
To find and fix faults.
How long
Up to 7 days.

Emails you send us

Where
Our mailbox at Zoho Mail
Why
To answer you.
How long
As long as we need them to help you.

On your phone and in your browser

The app keeps a copy of your groups and the exchange rates it has used on your phone, so it works offline. Signing out or deleting your account removes them, and the CSV files you exported. Copies of photos and files you picked for receipts can stay in the phone's temporary storage until the system clears it. A few things about the phone itself stay through a sign-out, such as how many times the app was opened, when it last asked you to rate it, and whether Share anonymous usage data is on; while it is, so do the usage data's random identifier and what waits to be sent.

The demo trip you can open before signing in lives only on your phone and is never sent to us. Only the anonymous usage data described above goes, while it is on.

When you open an invite link on this website, your browser keeps a viewing link for that group in its own storage, so the page still works after the invite expires. Clearing this site's data in your browser removes it. This website sets no cookies and runs no analytics.

Receipt scanning

On an iPhone with Apple Intelligence on, running iOS 27 or later, Scan a receipt reads the receipt on the phone itself: the phone's text recognition reads the words on it, and Apple's on-device model copies out the shop's name, the date, the currency, the items, tax, tip and total, which the app fills the expense in with for you to check. Both run on the phone, so a receipt the phone reads is not sent anywhere to be read, and this works with no connection and in the demo.

Where the phone does not read a receipt itself, while receipt scanning is on and you add a receipt to an expense, with Scan a receipt and then a photo or file, or by sharing one into Evensies, the app uploads it to the group and our server sends it to Anthropic's Claude service, which reads it and returns the shop's name, the date, the currency, the items, tax, tip and total. The app fills the expense in with them for you to check.

Only the receipt itself is sent: not your name, your email address or anything about your group. A receipt can show things printed on it, such as the last digits of a card, so add only receipts you are happy for the group to see. If you don't want a receipt read, don't add it: type the expense yourself. We don't use receipts to train anything.

When receipt scanning is off, nothing is sent to Anthropic. A receipt you add is attached to the expense, read on the phone where the phone reads receipts itself and otherwise as it is, and only the group's members can open it. A demo group stays on your phone, so its receipts are not kept.

Who else handles your data

  • Cloudflare runs our server, database and file storage, and keeps the server's logs.
  • Vercel serves this website, and sees your IP address while doing so, as any web host does.
  • Resend sends your sign-in codes, and the weekly email if you turn it on. It receives your email address and the code, and for the weekly email what it says: your groups' names, the names of the people you owe, and the amounts.
  • Anthropic reads the receipts your phone does not read itself, while receipt scanning is on, through its Claude service, as described above.
  • Frankfurter, which publishes the European Central Bank's reference rates, and ExchangeRate-API, for currencies the bank does not cover, give us exchange rates. Our server asks them for currency codes and a date only, never anything about you.
  • Apple takes payment for the purchase and handles refunds and Family Sharing; we never see your payment details. Apple also delivers notifications if you turn them on.
  • Zoho hosts our support mailbox.
  • PostHog receives the anonymous usage data and crash reports described above, from version 1.0.1 and only while Share anonymous usage data is on.

These companies may handle data in the United States and other countries. We share nothing else with anyone, unless the law requires it.

What we don't collect

No location, no advertising identifier, and nothing about your activity in other apps or websites. The app asks for the camera only when you choose to add a receipt, and for your photos only when you choose a receipt or a group's cover photo. It opens your contacts only when you tap From Contacts to invite someone, and then reads only the person you pick: their name becomes their name in the group, and their phone number or email address only fills in the message your phone sends them. The number and address are never sent to us, and your other contacts are never read.

Deleting your account

In the app, open Account and tap Delete account. It happens at once and cannot be undone.

We delete your account, your email address, your sessions, your notification tokens and choices, how you get paid, and your scan counts, and the app clears its copy on your phone.

Groups belong to all their members, so what you added to them stays: expenses, payments, comments and receipts, and your place in each group under the name the group knew you by, no longer linked to any account. That keeps everyone else's balances right. To have your name taken off a group as well, write to us.

Your choices and rights

  • Get a copy: Export everything as CSV in Account gives you every group's expenses and payments. For anything else we hold about you, write to us.
  • Correct: change your name in Account, and edit or delete expenses and payments in the group.
  • Delete: see Deleting your account, or write to us.
  • Notifications: turn them off in your phone's Settings at any time.
  • Weekly email: turn Weekly email off in Account, or use the link at the foot of any of them.
  • News about Evensies: we send it only if you turned it on, and you can turn it off in Account at any time, which withdraws your consent.
  • Usage data: turn Share anonymous usage data off in Account at any time. As it is not linked to you, we cannot find what was already sent by your account or your email address.

We use your data to provide the service you asked for, send occasional news about Evensies only with your consent, and keep logs and collect anonymous usage data and crash reports, which you can turn off, because we have a legitimate interest in keeping it working, safe and getting better. You can ask us to see, correct or delete your data, or to stop using it, by writing to support@freedom-terminal.com. If you are in the European Union or the United Kingdom and are unhappy with our answer, you can complain to the data protection authority where you live.

Children

Evensies is not directed at children under 13, and we don't knowingly collect personal data from them. If you think a child under 13 has given us personal data, write to support@freedom-terminal.com and we will delete it.

Keeping it safe

The app and this website talk to our server over encrypted connections. The server checks that you are a member before it shows you a group or a receipt. Your session is kept in your phone's secure storage. The balances page an invite link opens shows names and amounts only: never email addresses, descriptions, notes, comments or receipts.

Changes to this policy

When this policy changes, the date at the top changes. If a change means we collect something new, we will say so here before it applies.