Privacy Policy

This Privacy Policy explains what personal data CostDivider ("we", "us") processes when you use this application, and your rights under the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.

Last updated: 28 September 2026.

1. Data controller

Pierre Di Marco
Im Flürchen 22
54309 Newel
Germany
pierdm@gmail.com

2. What data we collect

• Account data: your email address and password (stored hashed, never in plain text). If you sign in with Google, we receive your email address and display name from Google instead of a password.
• Member and group data: the names and (optionally) email addresses of expense-group members, group names and descriptions, expenses, deposits, and any messages posted on a group's message board or in direct messages.
• Receipts (optional): a photo or a PDF you attach to an expense. It is stored with that expense and can be opened by the other members of that group — never through the links described in section 4a. For some groups a receipt is also read automatically when it is uploaded; see section 4c.
• Sent messages: we keep a record of every email this app sends you — group invitations and account-confirmation links — including the recipient address, subject, full message text, the time it was sent, and whether the mail server accepted it. See section 6.
• Who you have shared a group with: when you and another registered user are both members of the same expense group, we record that the two of you have met, and the date we first recorded it. No message, no email address and no group content is stored in that record — only the two accounts and the date. See section 6a.
• Payment details (optional): if you want, you can record in your profile how you can be paid — an IBAN, or a user name at PayPal or Revolut. This is entirely optional; the app works exactly the same without it. See section 4b.
• Push notifications (optional): if you switch on notifications and your browser asks you to allow them, we store what your browser gives us so that a notification can be delivered to it: an address at your browser maker's push service, and the two keys that let us encrypt a message only that browser can open. One record per browser you allow it in. See section 8b.
• Technical data: IP address, browser/device information, and timestamps, collected automatically as part of standard web server logging for security and troubleshooting purposes. These logs are kept for no longer than 14 days and are then deleted automatically.
• Cookies and storage on your device: only what the app needs to work — see section 8 for the full list.

3. Why we process this data

• To provide the service you asked for — creating your account, managing expense groups, computing settlements, sending invitations and confirmations, and enabling messaging between people who have shared a group (performance of a contract, Art. 6(1)(b) GDPR).
• To keep the app secure, to prove what was sent to whom, and to diagnose technical problems (legitimate interest, Art. 6(1)(f) GDPR).
• Where you have given consent — for push notifications (section 8b) and for payment details you choose to record (section 4b) — Art. 6(1)(a) GDPR.

4. Who we share data with

Other members of an expense group can see the names, contribution settings, and balances of other members in the same group — this is inherent to how the app works. Our infrastructure runs on a rented virtual server; the hosting provider processes data on our behalf as a processor under a data processing agreement. Emails are handed to our mail provider for delivery. We do not sell your personal data to anyone.

Beyond that, data reaches a third party in exactly two situations, and both are ones you start yourself:

• Signing in with Google. If you use the "Sign in with Google" button, you are sent to Google (Google Ireland Limited) to authenticate there, which tells Google that you are signing in to this application, and Google returns your email address and display name to us. Simply having the button on the login page sends nothing: it is a form on our own server, and nothing reaches Google until you press it. If you would rather Google not be involved, register with an email address and password instead. The legal basis is performance of a contract, Art. 6(1)(b) GDPR.
• Push notifications. If you switch notifications on and allow them in your browser, delivering one means handing it to the push service your browser maker runs — Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge. There is no way round that: it is how the web push standard works, and which service is involved is decided by the browser you chose, not by us. See section 8b.

Everything the pages of this app need in order to work — stylesheets, scripts, icon fonts — is served from this server. Apart from the two cases above, both of which you start yourself, this site loads nothing from a content delivery network or any other third-party host, so merely opening a page, including this one, does not disclose your IP address to anybody but us and our hosting provider.

4a. Links that show group data without a login

Two kinds of link in this app deliberately work for whoever holds them, with no account and no password:

• A group link a moderator can switch on for an expense group. Anyone with that address sees the group's members by name, its expenses and deposits, and who owes what.
• A personal link issued to a member who has no account, which shows that one person their own share and payments, and is also how an invitation is answered.

These addresses contain a long random token and are not published, indexed or guessable — but they are not secret either, and we cannot tell who a link was passed on to. Treat one like a key: anyone you send it to can see what it opens, and can pass it on further. A moderator can switch the group link off at any time, and the address stops working immediately — note that switching it on again reactivates the same address rather than issuing a new one, so a link that was passed around once becomes usable again. A personal link is replaced when the member's account is deleted. If you would rather your name and figures not be reachable this way, ask the group's moderator not to enable the group link.

4b. Optional payment details

Once an expense group is closed, the app proposes who should pay whom, and how much, so that everybody ends up at zero. If you have recorded payment details in your profile, they are shown only to the person that plan asks to pay you — not to the whole group, not to members of other groups, and never through a group's public share link (section 4a).

For an IBAN, the server turns it into a picture: a QR code that common banking apps can read, already carrying the recipient, the amount and the reference. For PayPal or Revolut, it becomes a link to that provider. Both are built from a fixed pattern; you cannot store an address or link of your own here.

We do not process payments. This app never receives money, never forwards any, and never initiates a payment. It displays a detail its owner entered. It does not find out whether or when you paid — a payment that has been made is recorded by hand as a deposit. If you open the link to PayPal or Revolut you leave this app, and that provider's privacy policy applies from there on.

The legal basis is your consent, given by entering the detail (Art. 6(1)(a) GDPR). You can withdraw it at any time by choosing “No details” in your profile, which deletes it. Deleting your account (section 6) deletes it too.

4c. Reading a receipt

For some groups, a receipt attached to a new expense is read automatically, and what it appears to say — a title, an amount and a date — is filled into the form as a suggestion. Nothing is saved by that. The person who uploaded the receipt still looks at the form, corrects whatever is wrong, chooses who paid — no receipt says that — and presses Save themselves. No decision about anybody is taken automatically, and there is no automated decision-making within the meaning of Art. 22 GDPR.

The receipt does not leave our server. The text is extracted on the same machine the application runs on, by software installed there. Where a language model is additionally used to make sense of that text, it runs on that same machine and is reachable only from it — the application refuses to use one configured anywhere else. Neither a receipt nor any text read from one is sent to a third party, to an external service, or to any provider of an artificial-intelligence service. The two cases in section 4 remain the only ones in which data reaches a third party, and section 5 is unaffected.

The reading is off by default and is switched on for an individual group by us as the operator, not by its members. It uses no data other than the receipt that has just been uploaded: no other expense, no other member, and nothing from another group. Nothing read from a receipt is used to train anything. The legal basis is the same as for the expense the receipt belongs to: performance of a contract, Art. 6(1)(b) GDPR.

We do keep a record of how well the reading works, and it is deliberately built so that your receipt cannot appear in it: per attempt it holds only which of the three fields were proposed, which of those were still unchanged when the expense was saved, how long it took, and which group it belonged to. No receipt text, no title and no amount is stored in it. The legal basis is our legitimate interest in being able to judge whether this feature is any use, Art. 6(1)(f) GDPR. See section 6.

5. International transfers

The application itself, its database and its backups are operated within the EU, and we do not transfer your data outside the EU/EEA for the operation of the service. The exceptions are the two situations in section 4, each of which only happens because you chose it. For the Google sign-in, Google Ireland Limited may transfer data to Google LLC in the United States on the basis of the EU–U.S. Data Privacy Framework. For push notifications, the push service belongs to whichever browser you use, and most of those companies are established in the United States; sending a notification necessarily reaches that service, under the transfer safeguards that provider relies on.

If you do not enable push notifications and do not use the Google sign-in, no data about you leaves the EU/EEA.

6. Data retention and deletion

We keep your account and expense-group data for as long as your account exists. You can request deletion at any time by writing to pierdm@gmail.com.

Deleting an account anonymises it rather than removing every trace of it. Your login, email address, personal access link, payment details and API keys are deleted, your direct messages and conversations are deleted, along with any record of accounts you had blocked or that had blocked you, any unanswered group invitations are withdrawn, every record of whom you have shared a group with is removed, and your name is removed from your profile — wherever the app shows who somebody is, a neutral placeholder appears in its place. (Our programming interface, which is used by software rather than read by a person, sends an empty name together with a marker saying the account was deleted, and leaves the wording to whatever is displaying it.) The expenses, deposits and message-board posts you entered stay with their groups, no longer attributed to you by name: those entries are other people's financial records too, and removing them would silently change what the remaining members owe each other. If you need those entries removed as well, the group's moderator can delete them.

One thing is worth being exact about: a group's change history records what was done and by whom at the time it happened. Entries written before the deletion keep the name as it stood when they were written, because a record of who agreed to what is the point of keeping one.

A receipt is kept for as long as the expense it is attached to: deleting the expense deletes it, and deleting the group deletes it along with everything else that group holds. It can also be removed on its own from the expense's edit screen, without deleting the expense. The record of how well receipt reading works (section 4c) belongs to its group and is deleted with it.

The record of sent emails described in section 2 is kept for up to 12 months and then deleted; messages that are only notifications about activity in your groups are deleted after 30 days.

That record contains the message text as it was sent, except for the links in it. An invitation or confirmation link is a key — a personal link (section 4a) keeps working until the person it was issued to creates an account — so before a message is written to the log every such link is removed from the copy and replaced with a note saying it was there. The log answers what was sent, to whom, and when. It is deliberately not a place where a working key is kept, and reading it does not let us, or anyone who obtained it, open what your link opens.

6a. People you have shared a group with

The record described in section 2 is what lets the app show you the people you have been in an expense group with, suggest them when you invite somebody into a new group, and let the two of you message each other. It deliberately outlives the group itself: without it, leaving a group — or the group being deleted — would erase every trace that you and the other person had ever shared one, which is precisely what the feature exists to prevent.

You can end it. Once you and the other person have no active group in common, either of you can remove the connection from the "known people" page. Removing it deletes the record for both of you, and the other person is not notified — that is intentional, so that stepping out of somebody's contacts does not require announcing it. Afterwards neither of you can start a new conversation with the other. A conversation you already have is not affected at all — it stays open and either of you can still write in it, because message history is not destroyed when a relationship changes. If you want someone's messages to stop, block them; blocking is a separate, deliberately visible step. If you share a group again later, a new record is created from that point on.

Only registered accounts appear in these records. Guests who were invited without ever creating an account are not included, and deleting an account removes every such record it was part of.

7. Your rights

Under the GDPR, you have the right to access the personal data we hold about you (Art. 15); request correction of inaccurate data (Art. 16); request erasure, the "right to be forgotten" (Art. 17); restrict processing (Art. 18); object to processing based on our legitimate interest (Art. 21); receive your data in a portable form (Art. 20); and withdraw consent at any time where processing is based on consent (Art. 7(3)), which does not affect the lawfulness of what was done before you withdrew it.

To exercise any of these, write to pierdm@gmail.com. We answer within one month, as Art. 12(3) requires.

Providing your email address and a password (or using an external sign-in) is necessary to have an account at all — without it we cannot tell your groups apart from anyone else's, so there is no version of the service that works without it. Everything else you enter is voluntary.

We do not use your data for automated decision-making or profiling within the meaning of Art. 22 GDPR. The settlement figures the app computes are arithmetic on what members entered, not a decision about a person.

You also have the right to lodge a complaint with a data protection supervisory authority, in the member state of your residence, place of work, or of the alleged infringement. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Hintere Bleiche 34, 55116 Mainz, Germany
www.datenschutz.rlp.de

8. Cookies and storage on your device

This site sets only the cookies it needs in order to work. The ePrivacy Directive and § 25(2) TDDDG allow strictly necessary cookies to be set without asking, which is why there is no cookie banner: there is nothing optional to agree or object to. These are all of them:

Other storage on your device is only used for something you asked for: a copy of pages for offline reading once you switch offline mode on (section 8a); an entry you submit while your device has no connection, kept in your browser until it can be sent; and a note that notifications are on, once you switch them on (section 8b). Nothing of this exists until you do that.

No analytics, tracking or advertising. We use no analytics service, no tracking pixel and no advertising cookies, our pages load nothing from other companies' servers, and we do not measure how you use the app. If that ever changes, we will ask for your consent first, before anything optional is stored.

8a. Data stored on your device (offline mode)

If you switch offline mode on — it is off unless you turn it on, from the link in the footer of every page — this app keeps a copy of the pages you have opened while signed in on that device, so that you can still read them without a connection. That copy includes what those pages show: member names, expenses, deposits and balances, together with the app's own stylesheets, scripts and icons.

Nothing is transmitted anywhere by storing it. The copy lives in your browser's cache and local storage on that one device, is not shared with your other devices, and is never read by us. It is deleted when you sign out, when you switch offline mode off, when you press "delete offline data on this device", and automatically when a different account signs in on the same device.

The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR); storing it on your device is strictly necessary for a service you explicitly asked for by switching offline mode on (§ 25(2) TDDDG), which is why it is a switch rather than something that happens by itself.

8b. Push notifications

If you turn notifications on in your profile and your browser asks you to allow them and you agree, this app can send a message to that browser when something happens in one of your groups. It is off until you do both, and it is only ever available to people with an account — there would otherwise be no way to switch it off again.

Allowing it stores one record per browser: an address at that browser's push service, and two keys used to encrypt the message. We store nothing else about the device — no advertising identifier, no location, no telephone number.

Delivering a notification means handing the encrypted message to that push service, which is run by the maker of the browser you chose — Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge. That is how the web push standard works and there is no version of this feature without it. The message itself is encrypted with the two keys above, so the push service can see that a message is on its way to your device and cannot read what it says. The legal basis is your consent, given in the browser prompt (Art. 6(1)(a) GDPR); storing the record on your device is covered by § 25(1) TDDDG as consent for the same reason.

You can withdraw it at any time, in either place and with the same effect: switch notifications off in your profile, or withdraw the permission in your browser's site settings. The stored record for that browser is deleted, and deleting your account (section 6) deletes every such record. Turning it off stops delivery; it does not stop the activity being recorded in your groups, which is ordinary group data under section 2.

9. Changes to this policy

We may update this policy from time to time. The version posted on this page is the one currently in effect.

10. Contact

Questions about this policy or your data? Write to pierdm@gmail.com.

This privacy policy exists in German and English. The German version is the authoritative one.