Evenfolk — Privacy Policy

This document is a draft and is being finalised.

Effective date: 15 October 2026

Last updated: 15 October 2026

1. Who we are

Evenfolk ("Evenfolk", "we", "us") is a mobile application for splitting shared expenses and keeping track of who owes whom.

The controller of your personal data is:

to be confirmed (the "Controller")
Registered address: to be confirmed
Contact: support@evenfolk.app

This policy explains what personal data we collect, why, how long we keep it, and what rights you have.

2. Data we collect

We only collect data you or the people you share expenses with put into the app. We do not buy data about you, and we do not track you across other apps or websites.

2.1 Account data

Collected when you sign up and when you edit your profile.

Data	Required?	Why
Email address	Required	Sign-in identity, password resets, service notices
Password	Required	Authentication. Stored only as a salted hash — we never see the plaintext
Display name, username	Required	So other members recognise you in a group
Avatar image	Optional	Profile picture
Phone number	Optional	Helping friends find you
Country, language, default currency	Optional	Formatting amounts and dates correctly

2.2 Payment details you choose to publish

Your profile can hold payment handles — for example a PayPal link, a Revolut or Wise handle, a UPI ID, an IBAN, or a bank identifier — so that people who owe you money can pay you back.

These are optional and self-published: you decide whether to add them, and anything you add becomes visible to your friends and to members of groups you share. Do not add details you are not comfortable sharing with those people. You can remove them at any time in the app.

We never initiate, process, receive, hold, or settle any payment. When you tap to settle up, the app hands the details to your own banking or wallet app, or copies them to your clipboard. Money moves entirely outside Evenfolk and we have no visibility into whether, when, or how much you actually paid.

2.3 Content you create in the app

Groups you create or join, and their members
Expenses: title, amount, currency, date, category, notes, who paid, and how the amount is split
Settlements you record
Friend connections, friend requests, and invite codes/links you generate
Receipt photos you attach to an expense

Expenses and balances are shared by design: everyone in a group can see the expenses of that group, including who paid and each person's share.

2.4 Support requests

If you report a problem from inside the app, we receive your message, any screenshots you attach, and basic technical context (app version, device model, operating system version) so we can reproduce the issue.

2.5 Device permissions

Photo library / camera — only when you attach a receipt or a screenshot. We access the specific images you pick, never your library as a whole.

You can revoke these permissions in your device settings at any time; the rest of the app keeps working.

2.6 Data stored only on your device

Some data never leaves your phone — for example a settlement in progress, kept so you do not lose it when you switch to your banking app. Uninstalling the app removes it.

To keep working without a connection, the app also keeps a copy of what you last saw — your profile, groups, balances, expenses and activity — and any expense you add while offline, with its receipt photos, until it reaches our servers. These copies live in the app's private storage. Signing out deletes them, and so does uninstalling the app.

2.7 What we do NOT collect

We do not use advertising SDKs or advertising identifiers.
We do not use third-party analytics or behavioural tracking.
We do not access your contacts, location, calendar, messages, or bank accounts.
We do not sell or rent personal data to anyone, and we do not "share" it for cross-context behavioural advertising as those terms are used under US state privacy laws.

3. Why we use your data, and on what legal basis

For users in the EEA and the UK, our legal bases under Article 6 GDPR are:

Purpose	Legal basis
Creating and running your account; showing groups, expenses and balances; syncing across your devices	Performance of a contract (Art. 6(1)(b))
Sending service emails: confirmation, password reset, essential notices	Performance of a contract (Art. 6(1)(b))
Answering your support requests	Performance of a contract / legitimate interests (Art. 6(1)(b), (f))
Keeping the service secure: preventing abuse, spam, and unauthorised access	Legitimate interests (Art. 6(1)(f))
Fixing bugs and keeping the service working	Legitimate interests (Art. 6(1)(f))
Optional profile fields, receipt photos, camera and photo access	Consent (Art. 6(1)(a)) — you provide them by choice and can withdraw at any time
Keeping records we are legally required to keep, and responding to lawful requests	Legal obligation (Art. 6(1)(c))

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

4. Who your data is shared with

4.1 Other users

Members of a group see your display name, avatar, and every expense, share, and settlement in that group.
Your friends see your profile and any payment details you published.
Anyone you send an invite link or QR code to can use it to connect with you.

4.2 Service providers (processors)

We keep the list deliberately short:

Provider	What it does	Where
Supabase	Database, authentication, file storage, backend hosting — this is where your account and app content live	to be confirmed
Porkbun	Hosts evenfolk.app (this website)	to be confirmed
Resend	Delivers transactional email (sign-up confirmation, password reset)	to be confirmed
Apple App Store / Google Play	Distribute the app and process any purchases. They are independent controllers for the purchase itself; we receive only a confirmation of entitlement, never your card details	Global

Each processor is bound by a written data processing agreement and may only act on our instructions.

4.3 Legal disclosure

We may disclose data where we are legally required to — a valid court order, a lawful request from a competent authority — or where it is necessary to establish, exercise, or defend legal claims, or to protect the rights and safety of our users.

4.4 Business transfer

If Evenfolk is ever sold or merged, your data may transfer to the acquirer. We will notify you before it happens and before any different privacy policy starts to apply.

5. International transfers

Your data is stored in to be confirmed. Where data leaves the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), together with the safeguards our providers maintain. You can request a copy of the relevant safeguards at support@evenfolk.app.

6. How long we keep data

Data	Retention
Account and profile	While your account exists
Expenses, splits, settlements	While the group exists, or until deleted — subject to section 6.1
Receipt images	Until you delete the expense or your account
Support tickets and attachments	to be confirmed after the ticket is closed
Backups	Rolling backups are overwritten within to be confirmed
Server logs	to be confirmed

After you delete your account we erase or irreversibly anonymise your personal data within to be confirmed, except where we must keep something to comply with a legal obligation or to defend a legal claim.

6.1 Shared expenses — an important limit on erasure

Evenfolk records financial arrangements between several people. An expense you added is also a record of what other members owe or are owed. If we erased it on your request alone, we would be destroying their record of a debt they have a legitimate interest in keeping.

So when you delete your account:

your profile is removed, and your name and avatar stop being displayed;
your entries in shared groups are anonymised rather than deleted — they remain as an amount and a share attributed to a removed member, so the other members' balances stay correct;
data in groups where you are the only member is deleted outright.

This is our legitimate interest, and that of the other group members, under Article 17(3) GDPR. If you believe your circumstances outweigh it, write to support@evenfolk.app and we will assess your request individually.

7. Your rights

Wherever you live, you can ask us to:

Access — get a copy of the personal data we hold about you
Rectify — correct anything inaccurate (most of it is editable in-app)
Erase — delete your account and data, within the limits of section 6.1
Restrict or object to processing based on our legitimate interests
Port — receive your data in a structured, machine-readable format
Withdraw consent at any time, without affecting processing already done

Most of this is available directly in the app under Settings. For anything else, write to support@evenfolk.app. We answer within one month; if a request is complex we may extend by two further months and will tell you why.

If you are in the EEA or the UK you also have the right to lodge a complaint with your local data protection supervisory authority. If you are a California resident, you have the rights described above under the CCPA/CPRA, and we will not discriminate against you for exercising them.

8. Security

All traffic between the app and our servers is encrypted with TLS.
Passwords are stored only as salted hashes; nobody at Evenfolk can read them.
Receipt images and support attachments live in private storage buckets that are not publicly reachable.
Database access is governed by row-level security: the database itself enforces that you can only read rows belonging to you or to groups you are a member of.
Access to production systems is limited to people who need it.

No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours and inform you where the law requires it.

9. Children

Evenfolk is not intended for children under 16. We do not knowingly collect personal data from them. If you believe a child has given us personal data, write to support@evenfolk.app and we will delete it.

10. Changes to this policy

We may update this policy as the app changes. The "last updated" date at the top always reflects the current version. If a change materially affects your rights, we will notify you in the app or by email before it takes effect.

11. Contact

Questions, requests, or complaints: support@evenfolk.app

to be confirmed, to be confirmed