Privacy Policy

1. Who we are

hesaplash ("we", "us") is an app for splitting shared expenses and keeping a simple personal budget. The data controller is hesaplash (hesaplash.com). Contact for privacy questions and KVKK/GDPR requests: gizlilik@hesaplash.com.

2. What we process and why

Account. Your name and e-mail address, and the sign-in method you choose, are handled by our authentication provider (Clerk). We keep a copy of your name and e-mail address so other members of your rooms can recognise you and so we can send you e-mails. Purpose: providing the service (contract). Your language, time zone and default currency are stored to show amounts and dates correctly.

Consents. Which version of this policy and of the Terms you accepted and when, and whether you agreed to optional marketing messages. Purpose: proof of consent and acceptance (legal obligation, contract).

Rooms and expenses. Rooms you create or join, their members, expenses (amount, currency, date, category, who paid, how it is split, description and note), comments, the history of changes, payments between members ("settle up"), fixed (recurring) costs, periods and the activity feed. Everything you enter in a room is visible to the members of that room, and it stays in the room for them if you later leave or delete your account (see section 7). People added to a room by name without an account ("placeholders") are stored with the name the room member gave. Purpose: providing the service (contract).

Personal budget. Your personal income and expense entries, recurring entries and categories. Visible only to you. Purpose: providing the service (contract).

Payment details you choose to share. For example an IBAN or a PayPal.me, Revolut or Venmo handle, shown to the room members or people you choose so they can pay you. We never move money and never receive card or bank credentials.

Receipts. Receipt photos you upload, the text read from them and the merchant name. Text recognition (OCR) runs on your device; the image is sent to us only to be stored with the expense. On the free plan receipt images are deleted automatically 90 days after upload (storage limit 20 MB); the amounts and items read from them stay with the expense.

Invitations and e-mails. E-mail addresses you enter to invite someone, and the transactional e-mails we send (invitations, reminders, summaries), in the recipient's language. We do not send marketing e-mails unless you agreed to them.

Notifications. If you turn on push notifications, the browser's push subscription (an endpoint address and keys). Notifications carry no personal data: only the type of event, the room and — if you allow it — the room name (never for one-to-one rooms).

Technical data. To protect the service we count requests per account for rate limiting (counters are removed by a daily clean-up, so they are kept for up to about 26 hours), and keep an encrypted copy of each response for 24 hours so a repeated request is not applied twice (removed by the same daily clean-up, so kept for up to about 48 hours). The messages our code writes to the operational logs contain request identifiers and error types but no names, e-mail addresses or content. Our hosting provider's request logs (Cloudflare Workers Logs) additionally record, for every request, its address (URL) — for invitation links this includes the invitation code in the path — and technical request metadata including your IP address and approximate location; they are kept for at most 7 days and then deleted automatically by Cloudflare. If error reporting is enabled (Sentry), error reports contain the error type, the program location, the browser and operating system and a one-way hash of your account identifier — never your name, e-mail address, what you entered, cookies or full URLs.

Pro subscription. If you subscribe to Pro, the purchase is made with Paddle (Paddle.com Market Ltd), which acts as the merchant of record: Paddle collects your payment details, billing address and tax information, charges you, issues invoices and handles refunds and taxes. We never see your card or bank details. We receive and keep only what is needed to give you Pro: Paddle's customer and subscription identifiers, the subscription status, the plan (monthly or yearly) and when it renews or ends; we send Paddle your account identifier and e-mail address so the checkout is prefilled and the subscription is linked to your account. The Paddle payment page is loaded from Paddle's servers only when you open the checkout. Purpose: providing the service you bought (contract). For the payment data it collects, Paddle is an independent controller under its own privacy notice (https://www.paddle.com/legal/privacy).

Mobile app (iOS and Android). The app uses the same account and data as the website. In addition:

• *Purchases in the app.* On a phone you can buy Pro through the App Store (Apple) or Google Play (Google). The store charges you, keeps your payment details and handles refunds; we never see them. To check purchases we use RevenueCat (RevenueCat, Inc.): it receives your hesaplash account identifier (a random ID, not your name or e-mail address) with a signature proving it is yours, the store's purchase records (product, prices and currency, store country, transaction identifiers and dates) and the technical data its SDK sends (app and OS version, device model, IP address). We keep the store, plan, subscription status and renewal or end date. When you delete your account we ask RevenueCat to delete its record of you; a store subscription can only be cancelled by you in the App Store or Google Play. Purpose: providing the service you bought (contract).
• *Notifications.* If you allow notifications, the phone's push token is stored encrypted and used through Expo (650 Industries, Inc.), which hands the notification to Apple (APNs) or Google (FCM). Notifications carry no personal data, as described above.
• *Camera and photos.* Used only when you scan a receipt, and only after you allow it. The text is read on your phone with Google's on-device text recognition (ML Kit); neither the image nor the text is sent to Google. ML Kit may send Google anonymous technical metrics about how the feature runs (device model, OS and app version, the feature used and its performance, a random per-installation identifier); these do not identify you.
• *On the phone.* Data you have opened is cached on the phone, encrypted with a key kept in the phone's Keychain/Keystore, so it can be shown offline; expenses, payments and comments you add offline wait there until they are sent. The sign-in session is kept in the phone's secure storage. Uninstalling the app removes all of this.

On your device. Your theme and language choice and notification wording are kept in your browser's storage; OCR language files are cached by your browser. We use only cookies that are strictly necessary for signing in (set by Clerk); there are no analytics or advertising cookies. To see how the public website is used, we count visits with Cloudflare Web Analytics: it sets no cookies, stores nothing on your device and does not identify you or follow you across sites — it gives us only totals such as page views, referring sites, countries and page load speed.

We do not sell personal data, do not use it for advertising and do not make automated decisions with legal or similarly significant effects.

2a. Guest use

You can use hesaplash without an account by entering a display name and accepting the Terms and this policy. We collect no e-mail address from guests.

What we store for a guest. Your display name (encrypted like other names, see section 3), a random access key, the room data you create or join, records of your consents, and the standard request logs described in this policy. The access key is kept on your device; our server keeps only a hash of it.

Losing access. The key lives only on that device and browser. If you clear the app or browser data, or lose the device, you lose access to the guest profile. Room data stays with the room. A room owner or admin can send you a link that hands your place in that room to another account.

What guests cannot use. Personal budget, friends, Pro purchases, saved payment methods and push notifications need an account.

Signing in or up later. If you sign in or sign up on the same device, your guest rooms move to your account and the guest profile is deleted. If your account is already a member of one of the same rooms, nothing moves and you can choose to continue as a guest or delete the guest profile.

Your rights as a guest. Delete the guest profile from the account screen; the same deletion process as for accounts applies (section 7). Data export applies to guests too.

3. How we protect it

Personal data and free text are encrypted in our database with AES-256-GCM before they are stored: names, e-mail addresses, expense descriptions and notes, comments, change history, personal entries, payment details, OCR text, merchant names, invitation e-mails and push subscriptions. Receipt images are encrypted before they are written to storage and are only decrypted by our servers when an authorised member views them. Encryption keys are separate per user and per room and are themselves encrypted with a master key held as a server secret. E-mail addresses are looked up by a keyed hash, not in plain text. Amounts, dates, currencies, categories, room names and category names are stored unencrypted because the service computes with them. All traffic uses HTTPS.

4. Who receives data (processors)

Members of your rooms see what is entered in those rooms, including your name. We may disclose data where the law requires it.

5. International transfers

Some processors are located outside Türkiye and outside the EEA (in particular the USA). These transfers rely on the standard contracts published by the Turkish Personal Data Protection Board under KVKK Art. 9 (notified to the Authority within five business days of signing) and, for transfers from the EEA, the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework adequacy decision. You can ask for a copy of these safeguards at gizlilik@hesaplash.com.

6. How long we keep it

• Account data: while your account exists.
• Receipt images: free plan — 90 days after upload, then deleted automatically; Pro — kept while you are on Pro, and 90 days from the day you leave Pro.
• Invitations: links and e-mail invitations expire after 7 days.
• Short-lived technical data: rate-limit counters (up to about 26 hours), stored responses for repeated requests (24 hours, removed within about 48 hours).
• Hosting request logs (Cloudflare Workers Logs): URLs (including invitation codes in invitation links), IP addresses and request metadata for at most 7 days.
• What you wrote in shared rooms: expense descriptions, notes, comments and receipts you added to a room stay in that room as long as the room exists, also after you delete your account (shown as written by "Deleted user").
• In-app subscription data (Pro): store, status and dates while your account exists; RevenueCat's record is deleted when you delete your account. Apple and Google keep their own purchase records.
• Subscription data (Pro): Paddle identifiers, status and dates while your account exists; deleted with your account (the subscription is cancelled at once). Paddle keeps its own billing records for the periods tax law requires.
• Error reports (if enabled): 90 days.
• After you delete your account: see section 7. Database backups (point-in-time recovery) keep earlier states for 30 days; deletion is therefore complete at the latest 30 days after you delete your account.

7. Your rights

Under KVKK (Art. 11) and the GDPR you can ask what we hold about you, have it corrected or deleted, restrict or object to processing, withdraw consent at any time and receive your data in a portable format. In the app:

• Download my data (Account → Your data) gives you a ZIP file with everything we keep about you as JSON, plus the receipt images you uploaded.
• Delete my account (Account → Your data) works immediately: your personal encryption key is destroyed, so your name, e-mail address and personal entries become unreadable at once; your personal entries, budget, payment details, personal receipts and notification subscriptions are deleted; the e-mail address in invitations sent to you is erased (and open invitations are cancelled); your sign-in account at Clerk is deleted; rooms you own are handed over to another member. Shared room records stay so the other members' balances remain correct: amounts and splits remain, and you appear as "Deleted user" (also in e-mails to others). The descriptions, notes, comments and receipts you added to shared rooms belong to those rooms and remain visible to their members, attributed to "Deleted user" instead of your name; remove anything you do not want to stay before deleting your account. Deletion is not blocked if you still owe or are owed money, but we warn you first.
• You can change your name, language and notification settings in the app at any time.

For any other request write to gizlilik@hesaplash.com from the e-mail address registered to your account; we answer within 30 days (KVKK Art. 13). You may complain to the Personal Data Protection Authority (KVKK Kurulu) in Türkiye or to the supervisory authority of your EU country of residence.

8. Children

The service is not intended for people under 16, and we do not knowingly collect data from anyone under 16. If we find such an account, we delete it.

9. Changes

When we change this policy we publish the new version with its date and ask you to accept it again in the app before you continue.

Last updated: 11 October 2026