🔒 Privacy Policy - ShareSpend v1.0

1. Introduction

Welcome to ShareSpend, a shared expense management application developed by CatSizer Lab.

We take the protection of your personal data very seriously. This privacy policy informs you about:

• What data we collect
• How we use it
• Your rights regarding your data
• The security measures we implement

By using ShareSpend, you accept the practices described in this policy.

2. Data Controller

3. Data Collected

3.1 Authentication Data

When you create an account:

• Email (if signing in with email/password)
• Username (auto-generated or customized)
• Profile photo URL (if signing in via Google, stored in Firestore for offline display)
• Firebase unique identifier (UID)
• FCM token (for push notifications)

Legal Basis: Contract execution (service provision) - Art. 6(1)(b) GDPR

3.2 Expense Data

When you scan a receipt or create an expense:

• Receipt photos (processed locally via OCR, NOT stored on our servers)
• Item list (name, price)
• Total amount
• Expense date
• Currency used (14 supported: EUR, USD, GBP, CHF, JPY, CAD, AUD, CNY, INR, BRL, MAD, KRW, RUB, MXN)
• Category (food, transport, etc.)
• Participants (names and splits)

Legal Basis: Contract execution (core app functionality) - Art. 6(1)(b) GDPR

3.3 Group Data

When you create or join a group:

• Group name
• Group emoji
• Member list (names, emails if Firebase accounts, IDs, avatar URLs if Google accounts)
• Balances (amounts owed between members)
• Shared expense history
• Settlements (completed reimbursements)

Legal Basis: Contract execution + Consent (sharing with other users) - Art. 6(1)(a) + (b) GDPR

3.4 Budget Data

When you set budgets:

• Budgeted category
• Monthly limit amount
• Month and year
• Associated expenses

Legal Basis: Contract execution (budget tracking functionality) - Art. 6(1)(b) GDPR

3.5 Technical Data

Automatically collected:

• IP address (via Firebase)
• Device type (Android/iOS)
• OS version
• App version
• Device system language (for currency detection fallback only)
• FCM token (Firebase Cloud Messaging identifier for push notifications)
• Advertising identifier (AAID/IDFA) for Google Ads
• Crashlytics (anonymized error reports)

Legal Basis: Legitimate interest (service improvement, debugging) - Art. 6(1)(f) GDPR

3.6 Location Data (NOT COLLECTED)

Legal Basis: N/A (no collection)

4. How We Use Your Data

4.1 Core Features

• OCR Scanning: Text extraction from receipts (processed locally, images NOT uploaded to our servers)
• Multi-Currency OCR: Automatic detection of 14 currencies (EUR, USD, GBP, CHF, JPY, CAD, AUD, CNY, INR, BRL, MAD, KRW, RUB, MXN)
  • Detection via symbols/patterns on receipt (local OCR)
  • Device language fallback if no currency detected
• Split Calculations: Equal or custom split algorithms
• Synchronization: Cloud Firestore to access your data across multiple devices
• Push Notifications: Firebase Cloud Messaging for budget alerts, new group expenses, reimbursements
• Group Invitations: Generation of links/QR codes with temporary tokens (30-day expiration)
• Avatar Display: Google profile photos cached locally for offline access

4.2 Service Improvement

• Crashlytics: Bug detection and correction
• Firebase Analytics: Anonymized usage statistics (user count, popular features)
• A/B Testing: User interface optimization

4.3 Advertising

Google AdMob displays banner ads in the application.

Data shared with AdMob:

• Advertising identifier (AAID/IDFA)
• IP address
• In-app browsing data

Note: Personalized ads can be disabled in your device system settings (not in-app).

5. Data Sharing

5.1 With Other Users

When you join a group:

• Your name is visible to all members
• Your profile photo (if Google account) is visible to all members
• Your shared expenses in the group are visible
• Your balances (amounts owed/receivable) are visible

5.2 With Third Parties (Services)

We use the following services:

Service	Shared Data	Purpose
Firebase Authentication	Email, UID, name, avatar URL	Secure authentication
Cloud Firestore	All app data (including avatar URLs)	Cloud storage sync
Firebase Cloud Messaging	FCM token, UID	Push notifications
Firebase Crashlytics	Error logs, device info	Debugging
Google AdMob	AAID/IDFA, IP, usage	Advertising
Google Cloud Functions	expenseId, userId, groupId, amounts, names, reasons	Disputes, settlements, group notifications, invitations

All these services are GDPR compliant.

5.3 Legal Obligations

We may disclose your data if required by law (court order, competent authority).

5.4 We Do NOT Sell Your Data

ShareSpend never sells your personal data to third parties.

6. Data Security

6.1 Technical Measures

• Encryption in transit: TLS/SSL for all communications with Firebase
• Encryption at rest: Data stored encrypted on Google Cloud servers
• Secure authentication: OAuth 2.0 (Google Sign-In), bcrypt for passwords
• Firestore Rules: Strict access restrictions:
  • Users:
    • ✅ Read: Own data only (/users/{userId})
    • ✅ Write: Owner OR initial FCM token setup
  • Groups:
    • ✅ Read: ALL authenticated users (required for QR/link invitations)
    • ✅ Create: Authenticated users only
    • ✅ Update: Group members OR admins only
    • ✅ Delete: Group members only
  • Expenses:
    • ✅ List (queries): ALL authenticated users
    • ✅ Get (specific document): Group members OR solo owner only
    • ✅ Create/Update/Delete: Group members OR solo owner only
  • Invite tokens:
    • ⚠️ Read: EVERYONE (including non-authenticated users)
    • ✅ Create: Group members only
    • ✅ Delete: Authenticated users only
  • Reports:
    • ✅ Read: Reporter only
    • ✅ Create: Authenticated users (auto-set status "pending")
    • ❌ Update/Delete: Forbidden (manual admin review only)
  • Debt reminders:
    • ❌ Read/Write: Forbidden (Cloud Functions only)
    • 🔒 Used for rate limiting (2 reminders/day per pair)
    • 🗑️ Auto-deleted after 7 days
  • Settlements/Disputes: Group members only

• Invitation tokens: Automatic expiration after 30 days
• Server-side validation: Cloud Functions for sensitive operations (disputes, settlements, debt reminders)
• Rate limiting:
  • Debt reminders: Max 2/day per user pair (7-day history)
  • Invite token validation: Max 10/minute (local throttle)

6.2 Organizational Measures

• Data access limited to authorized developers only
• Database access logs
• Regular security audits
• Frequent dependency updates (security patch fixes)

6.3 No Absolute Guarantee

7. Data Retention

7.1 Retention Periods

Data	Duration	Justification
User account	While account active	Service provision
Expenses	While account active	Financial history
Groups	While at least 1 active member	Ongoing collaboration
Budgets	While account active	Budget tracking
Avatar URLs	While account active (until "Clear Solo Data" action)	Profile display (Firestore + local cache)
Avatar cache (local Flutter cache)	Until cache expiration or manual clear	Offline display (NOT cleared on sign out)
Crashlytics logs	90 days	Debugging
Invitation tokens	30 days	Security
Push notifications (Firestore doc)	Deleted immediately after sending	Performance
Debt reminders	7 days	Rate limiting (2/day per pair)
Empty groups	90 days after last activity	Storage optimization (0 active members)
Reports	Indefinite (manual review)	Community safety
Resolved reports	1 year then archived	Legal compliance (moved to reports_archive)

7.2 Automatic Deletion

• Soft delete groups: Marked as deleted for you, permanently deleted when all members have deleted it
• Expired tokens: Automatic cleanup via Cloud Functions (30 days)
• Ephemeral documents: Push notifications deleted after sending
• Debt reminders: Deleted after 7 days (rate limiting only)
• Empty groups: Deleted after 90 days of inactivity (0 active members)
• Resolved reports: Archived after 1 year (moved to reports_archive collection)
• Avatar URLs: Removed from Firestore when "Clear Solo Data" is executed (Settings → Data → Clear Solo Data). Local cache (Flutter image cache) is NOT explicitly cleared and will persist until:
  • App uninstall
  • Manual cache clear (device settings)
  • Cache expiration (Flutter default TTL)

8. Your Rights (GDPR)

As a European user, you have the following rights:

8.1 Right of Access (Art. 15 GDPR)

You can request a copy of all your personal data.

How: Email thecatsizer@gmail.com with subject "GDPR Access Request"

8.2 Right to Rectification (Art. 16 GDPR)

You can correct inaccurate data.

How:

• Name: Profile > Edit name
• Email: Contact thecatsizer@gmail.com
• Avatar: Sign out and sign in again with Google (auto-update)

8.3 Right to Erasure (Art. 17 GDPR)

You can request deletion of your data.

How:

• In-app: Settings > Account > Delete account
• By email: thecatsizer@gmail.com with subject "GDPR Deletion Request"

8.4 Right to Restriction (Art. 18 GDPR)

You can request to limit processing of your data.

How: Email thecatsizer@gmail.com

8.4bis Difference: Sign Out vs Clear Solo Data

ShareSpend offers two distinct actions for managing your data:

Action	Location in App	What is DELETED	What REMAINS
🚪 Sign Out (Temporary disconnection)	Settings → Account → Sign Out	✅ Local cache (expenses, groups) ✅ FCM token (Firestore only) ✅ Session data (SharedPreferences) ⚠️ NOT deleted: • Avatar photo cache (Flutter image cache)	✅ User profile (name, email, avatar URL) ✅ All expenses in Firestore ✅ All group memberships ✅ All budgets You can sign back in anytime
🔥 Clear Solo Data (Permanent deletion + sign out)	Settings → Data → Clear Solo Data	🔥 IMMEDIATE PERMANENT DELETION: ✅ All solo expenses (solo_{userId} group) ✅ All personal budgets ✅ User profile document (name, email, avatar URL) ✅ Local cache (except language/theme/tutorial preferences) ✅ FCM token ⚠️ NOT deleted: • Avatar photo cache (Flutter image cache) • Firebase Authentication account ✅ You will be signed out immediately	✅ Firebase Authentication account ✅ Group memberships (name becomes "Deleted User") ✅ Shared expenses (visible to other members) You can sign back in to create a new profile

8.4ter Clear Solo Data - Personal Data Deletion

Users can permanently delete all their personal data (solo expenses, budgets, and Firestore profile) while keeping their shared group memberships intact.

This action is available in-app under Settings → Data → Clear Solo Data.

Function name in code: _clearSoloData() (see settings_tab.dart line ~280)

After deletion:

• ✅ You will be redirected to the login screen
• ✅ You can sign in again to create a new profile
• ✅ Your previous shared groups will still exist (you will be listed as "Deleted User")

Legal Basis: Legitimate interest (service integrity) - Art. 6(1)(f) GDPR

8.5 Right to Data Portability (Art. 20 GDPR)

You can retrieve your data in a structured format (JSON).

How:

• In-app: Settings > Data > Export data
• JSON copy to clipboard

8.6 Right to Object (Art. 21 GDPR)

You can object to the processing of your data.

How: Email thecatsizer@gmail.com

8.7 Right to Withdraw Consent

You can withdraw your consent at any time (does not affect the lawfulness of prior processing).

How:

• Push notifications: Settings > Notifications > Disable
• Account: Delete account

8.8 Right to Lodge a Complaint

You can file a complaint with CNIL (France) or your national supervisory authority.

9. Children's Data

ShareSpend is intended for users aged 16 and older (13 with parental consent in some countries).

We do not knowingly collect data from children under 13.

If you believe a child under 13 is using the app without authorization, contact us immediately: thecatsizer@gmail.com

10. International Transfers

10.1 Data Hosting

Your data is stored on Google Cloud Platform (Firebase) servers located in:

• Europe (priority, region europe-west1 - Belgium)
• United States (replication for availability)

10.2 GDPR Guarantees

Google Cloud complies with:

• Standard Contractual Clauses (SCC) of the European Commission
• EU-US Data Privacy Framework

More info: https://cloud.google.com/privacy

11. Cookies and Similar Technologies

11.1 ShareSpend Does NOT Use Cookies

The mobile app does not use cookies as it has no embedded web browser.

11.2 Technologies Used

• SharedPreferences (Android) / UserDefaults (iOS): Local storage of preferences (theme, language, etc.)
• FCM Token: Identifier for push notifications
• AAID/IDFA: Advertising identifier (Google AdMob)

This data is stored locally on your device.

11.3 Data Stored Locally (SharedPreferences)

The following preferences are stored only on your device:

• App language (en, fr, it, es, de, pt, nl, pl)
• Theme (light, dark, system)
• Default currency (EUR, USD, etc.)
• Automatic rounding (none, 0.50, 1.00)
• Vibrations (on/off)
• Sounds (on/off)
• Notification preferences (budgets, groups)
• Category cache (for performance)
• Group cache (synchronization)
• Avatar cache (offline display of profile photos)
  • Stored via: Flutter CachedNetworkImage (system image cache)
  • Location: Device image cache (managed by OS)
  • Size: Varies (depends on number of group members)
  • NOT explicitly cleared on:
    • ❌ Sign Out (remains until cache expiration)
    • ❌ Clear Solo Data (remains until cache expiration)
  • Automatically cleared on:
    • ✅ App uninstall
    • ✅ Device cache clear (Settings → Storage → Clear cache)
    • ✅ Cache expiration (Flutter default TTL)
• Last budget reset (month/year)
• Privacy policy accepted (version + date)

This data is NEVER sent to our servers.

12. Policy Changes

We may modify this privacy policy at any time.

In case of major changes:

• In-app notification
• Email (if you have an email account)
• Date update at the top of this page

Your continued use of the app after modification constitutes acceptance of the new terms.

13. Specific Data Processing

13.1 Receipt Photos (OCR)

13.2 Group Data (Visibility)

Data visible to ALL authenticated users (due to QR/link invitations):

• Group name
• Group emoji
• Member names
• Member profile photos (avatar URLs if Google accounts)
• Number of members

Data visible to group members ONLY:

• Your shared expenses in the group
• Your balances (amounts owed/receivable)
• Your status (admin or member)
• Expense details (amounts, items, splits)

Data NOT visible:

• Your email (unless manually shared)
• Your personal expenses (solo mode)
• Your budgets
• Your other groups

13.3 Disputes and Conflicts

When you dispute an expense:

Recorded data:

• Your name (visible to all)
• Dispute reason (free text, max 500 characters)
• Dispute date
• Status (open, resolved)
• Resolved by (admin name + date if resolved)

Visibility:

• All group members see the dispute
• History kept in expense (even after resolution)

Cloud Functions:

• disputeExpense: Records dispute + notifies members (NO moderation)
• resolveDispute: Marks as resolved + notifies

Legal Basis: Consent (voluntary action) - Art. 6(1)(a) GDPR

13.4 Settlements/Reimbursements

When you mark a debt as paid:

Recorded data:

• Reimbursed amount
• Payment method (cash, revolut, lydia, bank transfer)
• From who → To who (IDs + names)
• Reimbursement date
• Related group

Visibility:

• All group members see the settlement
• Used to automatically recalculate balances

Cloud Functions:

• notifySettlement: Notifies both parties + group

Legal Basis: Consent (voluntary action) - Art. 6(1)(a) GDPR

13.5 QR/Link Invitations

Invitation tokens:

• Randomly generated (timestamp)
• Stored in Firestore (invite_tokens/{token})
• Expiration after 30 days
• One token = one group only
• Automatic cleanup of expired tokens

13.6 Content Moderation

To protect all users, we use local moderation only:

• Forbidden words list (insults, spam)
• Length verification (3-100 characters)
• Spam detection (repeated words)
• Excessive caps detection

Legal Basis: Legitimate interest (community safety) - Art. 6(1)(f) GDPR

13.7 Receipt Templates

To improve OCR scan accuracy, ShareSpend memorizes:

Data stored locally (SharedPreferences):

• Store name (optional)
• Average position of item names (X pixels)
• Average position of prices (X pixels)
• Average vertical spacing between lines
• Number of scanned items
• Confidence score (scan quality)

Usage:

• Pre-fill OCR parameters for subsequent scans
• Improve automatic detection
• Maximum 20 templates stored (FIFO)

This data remains on your device, never sent to our servers.

Legal Basis: Legitimate interest (UX improvement) - Art. 6(1)(f) GDPR

13.8 Cloud Functions Used

List of automated backend functions:

Function	Processed Data	Purpose
notifyNewExpense	groupId, expenseTitle, amount, paidByUserId	Notify new expense
disputeExpense	expenseId, userId, reason	Record dispute + notify
resolveDispute	expenseId, disputeId	Mark resolved + notify
notifyDebtDirect	groupId, fromUserId, toUserId, amount	Individual debt reminder
notifySettlement	groupId, fromUserId, toUserId, amount, method	Notify reimbursement
notifyMemberAdded	groupId, newMemberName	Notify member added
notifyMemberRemoved	groupId, removedMemberName, removedBy	Notify member removed
notifyGroupInvitation	groupId, inviterName, inviteeToken	Notify group invitation
notifyMemberLeft	groupId, memberName	Notify member left
notifyAdminTransferred	groupId, newAdminName	Notify admin transfer
notifyAdminRoleChanged	groupId, targetUserName, isPromotion	Notify admin role change
sendPushNotification	tokens, title, body, type	FCM trigger (onCreate)

All these functions:

• Region: europe-west1 (Belgium)
• Logs kept 90 days
• Non-blocking errors (if function fails, app continues)

Legal Basis: Contract execution - Art. 6(1)(b) GDPR

13.9 Inappropriate Content Reporting

You can report:

Reportable content:

• Group (offensive name, spam)
• Expense (fraudulent amount, inappropriate description)
• User (abusive behavior)

Recorded data:

• Your ID (reportedBy)
• Content type (contentType)
• Content ID (contentId)
• Reason (reason: spam, harassment, fraud, inappropriate)
• Optional details (details: free text)
• Status (pending, reviewed, resolved)
• Report date

Processing:

• Stored in Firestore reports/{reportId}
• Manually reviewed by moderators
• No automatic response (variable delay)

User blocking:

• You can block a user (stored in users/{yourId}/blockedUsers)
• You will no longer see their groups/expenses
• They can still see yours (no automatic reciprocal blocking)

Legal Basis: Legitimate interest (community safety) - Art. 6(1)(f) GDPR

13.10 Product Database (OCR Improvement)

To improve automatic item recognition:

Data used:

• 5000+ common products (name, average price, categories)
• OCR patterns (name variants, common errors)

Storage:

• Local assets (embedded in app, no server sync)
• Manual update (app releases only)

Usage:

• Progressive matching (3 passes: exact, OCR variants, fuzzy)
• Automatic OCR error correction
• Category suggestions based on product name

Your purchases are NOT collected to enrich the database

Legal Basis: Legitimate interest (UX improvement) - Art. 6(1)(f) GDPR

14. Detailed Legal Bases (GDPR)

Processing	Legal Basis	GDPR Article
Account creation	Contract execution	Art. 6(1)(b)
Expense storage	Contract execution	Art. 6(1)(b)
Avatar URL storage	Contract execution (profile display)	Art. 6(1)(b)
Push notifications	Consent	Art. 6(1)(a)
AdMob advertising	Consent (IDFA) or Legitimate interest (AAID)	Art. 6(1)(a) or (f)
Crashlytics	Legitimate interest (service improvement)	Art. 6(1)(f)
Group data sharing	Consent (voluntary action)	Art. 6(1)(a)
Content moderation	Legitimate interest (community safety)	Art. 6(1)(f)

15. Specific Declarations

15.1 GDPR Compliance

ShareSpend complies with the General Data Protection Regulation (GDPR) of the European Union.

15.2 CCPA Compliance (California)

For California users:

• You have the right to know what data we collect
• You can request deletion of your data
• We do NOT sell your personal data

15.3 Apple App Store Compliance

ShareSpend complies with Apple App Store privacy rules (if applicable).

15.4 Google Play Store Compliance

ShareSpend complies with Google Play Store privacy rules.

16. Contact and Complaints

16.1 User Support

16.2 GDPR Requests

Email Subject:

• "GDPR Access Request"
• "GDPR Deletion Request"
• "GDPR Rectification Request"
• etc.

Processing Time: 1 month maximum (extendable by 2 months if complex)

16.3 CNIL Complaint

If you are not satisfied with our response:

17. Glossary

• UID: Unique User Identifier (Firebase)
• FCM: Firebase Cloud Messaging (push notifications)
• AAID: Android Advertising ID (advertising identifier)
• IDFA: Identifier for Advertisers (iOS)
• OCR: Optical Character Recognition (text recognition)
• Firestore: Cloud database (Google)
• Cloud Functions: Serverless backend automation
• GDPR: General Data Protection Regulation (EU)
• CCPA: California Consumer Privacy Act (California)
• Soft delete: Logical deletion (marked as deleted, not yet permanently erased)
• Token: Temporary access key (invitations)
• Avatar URL: Web address of your Google profile photo

18. Version and History

Current Version: 1.0 (November 7, 2025)

Initial Release Features:

• ✅ Firebase Authentication (Google Sign-In + Email/Password)
• ✅ Google profile photo integration (avatar URLs)
• ✅ Group expense sharing with QR invitations
• ✅ Multiple payers support (shared payments)
• ✅ Smart budgets with alerts (80% & 100%)
• ✅ Push notifications (FCM)
• ✅ Multi-currency OCR (14 currencies)
• ✅ 8 languages (EN, FR, IT, ES, DE, PT, NL, PL)
• ✅ Dark mode default
• ✅ Local receipt processing (Google ML Kit)
• ✅ Debt reminders with rate limiting
• ✅ GDPR & CCPA compliant

19. Policy Acceptance

By using ShareSpend, you confirm that you have:

• ✅ Read this privacy policy
• ✅ Understood how we collect and use your data
• ✅ Accepted the conditions described
• ✅ Understood that your Google profile photo may be visible to other users

20. Useful Links

• Support: thecatsizer@gmail.com
• Firebase Policy: https://firebase.google.com/support/privacy
• AdMob Policy: https://support.google.com/admob/answer/6128543
• Google Cloud Privacy: https://cloud.google.com/privacy
• CNIL (France): https://www.cnil.fr/

🇫🇷 Version Française

🇮🇹 Versione Italiana

🇪🇸 Versión Española

🇩🇪 Deutsche Version

🇵🇹 Versão Portuguesa

🇳🇱 Nederlandse Versie

🇵🇱 Polska Wersja