Privacy notice

The short version

MSRX Split stores your group's names, expenses and amounts in your own browser, on your own device. When two members' devices are online together they exchange the group's changes directly with each other. There is no database on our side holding your group, so there is no copy of it for us to keep, lose, sell or be asked to hand over.

The price of that design is real and is explained below: if every device holding a group is lost and nobody made a backup, the group is gone, and nobody can recover it for you.

One optional feature is the exception: typed questions to Ask Split AI. They are off unless an admin turns them on for the group and you agree on your own device, and what they send is set out below.

What is stored on your device

• In your browser's IndexedDB, one record per group: its name, the people you added, every expense (title, amount, currency, who paid, how it was split, category, date), the exchange rates you typed, the trip's budget and last day if an admin set them, and whether an admin has turned on Ask Split AI for the group.
• In your browser's local storage, a short list of the groups on this device: each group's name, its code, which person in the group is you, when you last downloaded a backup, and whether you agreed on this device to send typed questions to Ask Split AI. The code is kept here because it is the only way back into the group.
• Nothing else. Your Ask Split conversation is kept only while the group is open and is gone when you close or reload it. Clearing this site's data in your browser removes all of it from that device.

What we do not collect

• No account, name, email address, phone number or password. There is nothing to sign up for.
• No cookies, and no consent banner, because there is nothing to consent to.
• No analytics, no advertising, no tracking pixels and no fingerprinting. We do not even count page views.
• No third-party scripts or fonts. Fonts are your system's own, and every script and style file is served from this site.

How your devices find each other

To sync, two devices must first be introduced. That involves three parties besides the members themselves, and you should know about each.

• The sync relay, msrx-split-relay.msrx.workers.dev, runs on Cloudflare Workers. Your device connects to it and it learns your device's IP address, as any server you connect to does. It is told an opaque room name derived from the group code and passes along connection-setup messages that are encrypted with a key derived from the code, which it does not have. It cannot read them. It keeps rooms in memory only, writes nothing to storage, and logs neither message contents nor room names. Cloudflare, as the host, may keep its own standard request logs under its own policy.
• Cloudflare's TURN service (turn.cloudflare.com), only when a direct link cannot open. If your network blocks direct links, your devices can pass the group's data through this relay instead. It sees both devices' IP addresses and how much data passes, but not what the data says, which stays encrypted between the two devices. To use it, your device asks the sync relay for a temporary credential that expires after 12 hours; the relay holds the account secret and your device never receives it, and the request carries no group data and not the code.
• A public STUN server run by Google (stun.l.google.com). Your device asks it what public address it appears to have, so that other devices can reach it. Google can see your device's IP address when you sync. No group data is sent to it.
• Other members' devices. Once introduced, devices connect directly to each other (WebRTC), which means each member's device can learn the IP address of the others it connects to. Only people who hold the group code can do this. The group's data travels directly between devices, encrypted in transit.

The group code

The code is the only key to a group. Anyone who has it can join and see every expense, name and amount in the group, and edit or delete entries. Share it only with people on the trip. Sending it by WhatsApp, SMS or email means that service carries it.

An admin can remove a member from the list, but that does not stop anyone who still has the group code from opening the group. To shut someone out, an admin moves the group to a new code and shares the new links only with the people who should stay. There is no server to reset a code, so a lost code cannot be recovered; a backup file cannot be opened without it.

Invite links

Each person's invite link contains the group code and that person's four-character personal code. The everyday link (Copy or Share) holds nothing else. The longer link (Copy long link) also holds, when the group is small enough to fit, a compressed copy of the group as it was when you shared it: its name, people and expenses. That is what lets a new member open the group straight away even when nobody else is online. Both sit in the part of the link after the # sign, which a browser never sends to a server, so this site does not receive them.

The copy is as readable as the code is, since anyone with the code can join and see the same things. But it stays in the chat, email or message for as long as that message does, and the service carrying it can store it. Share links only with people on the trip, and share a fresh link to include newer expenses. Opening a link with a copy only fills in a group your device has never seen or one that is still empty; it never changes a group that already has data.

Admins, members and leaving

The person who creates a group is its admin. Admins add people, remove people, and can make other members admins. If the only admin leaves, the member who joined next becomes admin. A group that has people always has an admin.

These roles are rules the app follows, not a lock. There is no server to check them, so anyone who has the group code can still read and change the group's data. Treat roles as house rules among people who trust each other, not as security. Removing a person does not cut off their access either: to shut someone out, start a new group.

What admins do to the group's people and settings (adding, removing, promoting, renaming, closing the trip, moving the group) is written to an activity list that every member can read, showing who did it and when. It records what happened; it cannot stop a modified app from changing the group's data, but it means such a change is not hidden.

Every member can see what every other member has paid, their share, their balance, and when they joined: that is what a person's profile shows. When a device is first set up as a person, the group records that they have joined and when.

Each person in a group has a personal code of four characters, worked out from their entry in the group, so every device shows the same one. Every member can see everyone's. A personal code pairs a device with a person ("this phone is Dinesh") and lets an invite fill in a name. It is not a password and it does not limit what anyone holding the group code can see or change. A person can rename themselves, and an admin can rename anyone.

When you leave a group, or an admin removes you, your entry is marked as left. Your name, everything you entered and your balance stay in the group's data on every device that has synced, so that the others can still settle up with you and the history stays correct. Leaving stops you being offered in new expenses and makes the group read-only for you. Someone who left can rejoin from the same screen; someone an admin removed cannot, and only an admin can add them back. Neither removes anything from other members' devices.

"Remove from this device" erases this device's copy of the group and takes it off your list. It does not affect copies on other devices.

To really shut someone out, an admin can move the group to a new one. A new group with a new code is created and everything is copied into it: people, entries and balances. The people left behind are not part of it. Each person who stays claims their place again with a new personal link, and the old group is closed and shows that it moved. The new code is never written into the old group. Whoever was left behind keeps the old group and everything in it up to the moment of the move, and anything not yet synced to the admin's device before the move is not copied.

Other people's information

Groups contain the names and spending of the people in them. If you add someone, you are recording information about them, so make sure they know and are happy to be in the group. Every member sees everything in the group.

When anyone deletes an expense it is marked as deleted, but its details stay in the group's data on every device that has synced, so that a delete on one phone cannot be undone by another phone syncing an older copy. A deleted entry no longer appears or counts, but it is not erased. It cannot be erased from other members' devices by you or by us.

Backups and exports

A backup file is the whole group, encrypted with a key derived from the group code. It is safe to keep in email or cloud storage, and it is useless without the code.

The spreadsheet (CSV) export is not encrypted. It is a plain list of every expense, and where it goes after you download it is up to you.

Ask Split AI

Ask Split answers questions about a trip's spending. The quick questions (how much the group has spent, what you owe, who paid most, where the money went, the biggest costs, the forecast, the budget and who pays whom) are worked out on your device from the group's own data. Nothing is sent anywhere for them.

Typed questions use AI. They are off unless an admin turns them on for the group, which every member sees in the group's activity list. Even then nothing is sent from your device until you agree on that device, and you can stop at any time from the Data tab. When you ask a typed question, your device sends:

• Your question, with every member's name replaced by a label such as P1 or P2. Your device puts the names back into the answer, so the services below do not receive them. A name the app cannot recognise, such as a nickname you type, is sent as you typed it.
• If the question needs the group's figures, a summary of them: each person's label with what they paid, their share and their balance; totals by category and by day; the largest expenses' amounts, categories, dates and who paid them (as labels); the payments that settle everyone up; and the budget and last day of the trip, if set. Expense titles, the group's name and the group code are never sent, and names typed into a category are replaced by labels too.
• The last few questions and answers of the same conversation, labelled the same way, so that a follow-up question makes sense.

These go to this site's own server function on Vercel (/api/ask), which passes them on and keeps nothing: it has no database and writes no logs of questions, summaries or answers. Vercel's standard request logs (the time and your IP address) apply as for any page. The question alone, without the summary, goes to TypeSafe (api.typesafe.ai) to be sorted: a common question is sent back to your device and answered there, so the figures are not sent at all. Otherwise the question and the summary go to Groq (api.groq.com), whose AI writes the answer. Groq's terms say it does not keep inference requests by default, except where needed to keep its service reliable or to investigate abuse, and that it may not use them to train models.

AI answers are labelled as AI answers and can be wrong. Check the figures in the app before you pay anyone.

Server logs

This site is hosted on Vercel. Like any web host, Vercel records standard request information (the page requested, the time, your IP address and your browser's user agent) for the pages it serves. We do not add to those logs, query them, or connect them to anything. Your group data is never part of a request to this site, except the summary that Ask Split AI sends when you have turned it on, described above.

Your rights

Rights to access, correct or erase personal data apply to data an organisation holds about you. We hold none of your group's data. To erase it from a device, clear this site's data in the browser or delete the group there. Entries other members have already synced remain on their devices, as described above.

If you think something here is wrong, or want to ask about anything on this page, write to mrinalsinghraja@gmail.com.

Who is responsible

For the purposes of India's Digital Personal Data Protection Act 2023 the responsible party, and the controller under UK and EU GDPR, is Mrinal Singh Raja, an individual publishing under the name "MSRX". MSRX is a brand, not a registered company.

Grievances under India's Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 go to mrinalsinghraja@gmail.com. We aim to acknowledge within 24 hours and resolve within 15 days.

Children

This app is not directed at children. It collects nothing that identifies anyone to us, so a child using it is in the same position as an adult. A parent or guardian should decide whether a child joins a group, because everything in a group is visible to every member.

Changes

If this notice changes, the date at the top changes with it. The claims here are checked against the code by automated tests, so if the software stops behaving as described, a test fails before the change can ship.