Split It privacy policy

Effective 31 October 2026

Split It has no account, ads, tracking, analytics or crash reporting. Your groups are encrypted on your phone, and when you share one, only the people in it can read it: Pensive Frog Games can't.

What stays on your phone

Your groups, expenses, receipts, comments and settings are saved on your phone in an encrypted database. Copies of receipt photos you attach or view, and the last spreadsheet you exported, may stay unencrypted in Split It's cache on your phone until it's cleared. Device backups, such as iCloud Backup or Google backup, may include app data according to your device settings. Deleting the app removes its data, except that on iPhone the keys that open it and your phone's sharing keys stay in the Keychain, and a reinstalled Split It uses them again.

Your code

People are added by scanning each other's code. A code carries your name, the Split It picture you chose, a random ID and your phone's public keys. Scanning it in person needs no internet.

To send your code to someone far away, Split It makes a short link: https://pensivefrog.games/split/u#s= and 12 random characters. Your phone seals the code with a key worked out from those characters and stores it on Split It's relay under a one-way hash of them, so the relay never sees the link and can't read the code; anyone you give the link to can. It can't be changed or deleted once stored. The relay deletes it within 401 days of your phone last renewing it, which your phone does about once a month while you use Split It. A new name or picture makes a new link; the old one keeps working until it expires.

An invitation to a group works the same way: https://pensivefrog.games/split/join#s= and 12 random characters, with the group's name, your name and your code sealed the same way on the relay. It's stored when you share an invitation, can't be changed, and the relay deletes it within 401 days. An invitation sent when Split It can't reach the relay carries all of that after the "#", which your browser never sends to this website or anyone else. On your way to the App Store or Google Play from an invitation's page, the page copies the link to your clipboard so you can paste it into the app; it never reads your clipboard.

If a short link is opened in a web browser, the browser asks this website for the page; the 12 characters come after the "#", so the browser never sends them to this website or anyone else. The page then fetches the sealed code from the relay and opens it in the browser. Short links made by Split It's first versions put the characters in the address itself (https://pensivefrog.games/split/u/…), so for those the website receives them.

Your QR code, and a link sent when Split It can't reach the relay, carry the whole code after a "#" (https://pensivefrog.games/split/u#…). Your browser never sends that part to this website or anyone else.

Sharing a group

Changes to a shared group are sealed on your phone with the group's key before they leave it, and travel through Split It's relay, which Pensive Frog Games runs on Cloudflare. The relay sees only a random room number and sealed messages it can't read: no names, amounts or members. For each phone in a group it also keeps a code that's different in every group, how far that phone has read and when it last connected; it removes a phone's entry once the phone has been away 30 days, the next time it tidies that group, which can wait until someone in the group writes again. It holds each sealed change until every member's phone has it, and for 31 days at most, then deletes it, and it keeps no logs. Receipt photos are made into a small scan on your phone, and cross the relay, sealed the same way, only when someone in the group opens that expense; the relay deletes them within 4 days. The relay uses a phone's network address only while it's connected, to limit how fast one address can send, and never stores it. Cloudflare, which runs the relay, handles network traffic such as IP addresses under its own privacy policy.

While Split It is open, it checks your inbox on the relay for groups you've been added to; the inbox's address is worked out from your code. When you add someone to a group, your phone puts the group's name and key and your code in their inbox, sealed so only their phone can open it.

Sync Nearby sends the same sealed changes straight to a friend's phone over Bluetooth or Wi-Fi, without the internet, while its screen is open. Your phone asks your permission before Split It looks for phones nearby.

A group keeps its history: a deleted expense or comment stays in the group's activity, and people added later get the whole history.

Comments are seen only by the people in the group. You can delete your own comments, remove a member, or hide a person's comments on your phone (they still arrive, unseen). Report Comment opens an email to support with that comment and who wrote it; nothing is sent until you send it.

Camera, photos and files

The camera scans a friend's code and photographs receipts, and receipt text is read on your phone. Split It sees only the photos you choose to attach. A spreadsheet you export goes only where you send it.

Exchange rates

With Split It Pro, or once you're in a group that has it, Split It downloads the European Central Bank's daily reference rates through its relay. The request carries nothing about you or your groups. Otherwise Split It downloads no rates, and uses the ones you type.

Split It Pro

Split It Pro is a one-time purchase through the App Store. Apple handles the payment under its own privacy policy: Split It learns only whether Pro is unlocked, and Pensive Frog Games receives nothing about you from the app. A group started by someone with Pro says so to the people in it, sealed like the rest of the group, so they have Pro there too. The count of new expenses each day, for the free allowance, is kept on your phone.

Payment apps

Usernames you add under Get paid go into your profile in each group you share, sealed like the rest of it, so the people there can pay you; Ask to settle puts your pay links in a message you choose where to send. The pay buttons open Venmo, PayPal or Cash App (or its website) with the username and amount filled in, and for Venmo the group's name as the note. Split It sends nothing to them by itself; those apps handle what you do there under their own privacy policies.

Reminders

Reminders for repeating expenses and the settle-up reminders you set are scheduled on your phone, after it asks your permission. Your phone's notifications keep their text (the expense, amount and group, or the friend and balance) outside Split It's encrypted database. Nothing is sent anywhere to make them happen.

When iOS lets it, Split It reads your groups' sealed messages in the background, and your phone writes a notification saying who changed what in a group, with the same text kept outside the encrypted database until you clear it. No push service is involved: Split It has no notification token for your phone, and its relay can't read the messages or tell you that one has come.

If you email support, Pensive Frog Games receives the information you choose to send and keeps it only as needed to answer you. Contact support@pensivefrog.games to request deletion of support correspondence.

The online policy describes the current release. Any change to what the app collects will require an updated policy before it is introduced.

Contact and support

Pensive Frog Games (Pensive Frog LLC)
support@pensivefrog.games

Privacy questions, feedback and requests about support correspondence are welcome at this address.