Draft — not yet reviewed by a lawyer. FritFrit is in private testing. This page describes what the app and its server actually do today; it will be reviewed before FritFrit is published to either store. Diese Seite gibt es vorerst nur auf Englisch.

Privacy policy

Last updated 5 September 2026

FritFrit is an app for splitting shared expenses. It is built so that the smallest possible amount of information about you leaves your phone, and so that what does leave is only what other people in your groups need in order for the arithmetic to work.

There is no advertising, no analytics and no tracking of any kind. No advertising identifier is read, no analytics SDK is installed, no crash reporter is installed, no profile of you is built, and nothing about you is sold or shared with anybody for their own purposes. This is enforced in the code, not only promised: the app’s test suite fails the build if firebase_analytics, firebase_crashlytics or firebase_performance so much as appears in the dependency list.

This website behaves the same way. It sets no cookies at all — not one, of any kind — stores nothing in your browser, embeds nothing from a third party, and loads its own fonts from its own server, so that visiting it does not hand your IP address to anybody else. The language you are reading in is chosen from what your browser asks for, and if you pick a different one at the bottom of the page it is remembered by the address you are then on, not by anything stored. That is also why there is no cookie banner: there is nothing to consent to.

Who is responsible

What is stored, and where

Two copies of your data exist: one on your own phone, and one on a server, so that the other people in your groups see what you add. The phone’s copy is the one the app reads; the server is what the phones agree through.

On your phone

Everything the app shows you — your groups, their members, expenses, settlements and the photos you attached — is stored in a database on the device. That database is encrypted (SQLCipher), and its key is held in the platform’s own secure storage: the iOS Keychain, or the Android Keystore. Receipt photos are written to the app’s private directory, never to your camera roll and never to shared or external storage; on iOS they carry NSFileProtectionComplete, so they cannot be read while the device is locked. Your sign-in session is held in the same secure storage as the database key.

On the server

The server is Supabase, hosted on AWS in Frankfurt, Germany (eu-central-1). It holds:

Your profile

Display name, e-mail address, default currency, language, your three notification preferences, and whether you have an active plan. Your profile row is readable and writable by you only — nobody else in your groups can read your e-mail address, your plan or your preferences.

Your groups and what is in them

Group names, icons and currency; members and their display names; expenses (an amount in whole cents, an optional note, a category, a date, who paid and who shared it); settlements. Everyone who is a member of a group can read that group’s contents — that is what a shared ledger is. Nobody who is not a member can read any of it.

Receipt photos, if you attach them

Attaching a photo is the consent to upload it; nothing else uploads a photo. They are stored in a private bucket, readable only by the current members of that one group, and are never public. Uploads happen on Wi-Fi only unless you turn that off.

An IBAN, only if you enter one

Optional, never prompted for. It is copied onto your member row in each group you are in, and therefore reaches exactly those groups and no further. Clearing it clears every copy. FritFrit moves no money: it holds no card, initiates no transfer and confirms none. The “Pay” screen draws a standard SEPA payment QR code that your own banking app reads. (R-PRIVACY-6, R-STL-13)

Notification tokens

If you allow notifications, the push token for that install, its platform and language. Readable and writable by you only — other members never learn that you have a device, let alone its token.

Purchases

If you buy a plan, the store’s transaction identifiers, which product it was and when it expires. FritFrit never sees your card, and no price is ever stored.

What is deliberately not stored

• No password — sign-in is a 6-digit code sent to your e-mail address.
• No location, no contacts, no address book, no calendar.
• No text read from a receipt. Receipt scanning happens entirely on your phone; the photo is never uploaded for recognition and the recognised text is shown on the confirm screen and then discarded. (R-ENT-6)
• No balances or totals. Every figure you see is computed on the device from the rows it already has; the server stores no balance, no total and no summary of your spending.
• No advertising identifier, device fingerprint or usage event.

Notifications, and what Google and Apple can see

When somebody adds an expense to your group, the server sends a push message containing three identifiers and nothing else: which kind of thing happened, the group’s id and the row’s id — two random UUIDs and one of three fixed words. There is no name, no title and no amount in it, and no text of any kind. The sentence you read in your notification tray is written on your own phone, in your own language, from data that phone already had.

This matters because a push message passes through Apple’s and Google’s delivery infrastructure. What that infrastructure can see is a device token and a UUID. It cannot see who spent what, or with whom. (R-NOTIFY-3)

E-mail

FritFrit sends exactly one kind of e-mail: your 6-digit sign-in code, from noreply@fritfrit.app. There is no newsletter, no marketing and no “we’ve missed you”. Delivery is handled by Resend on European infrastructure. Your address is used to sign you in and to show you the “Signed in as” line, and for nothing else.

How long things are kept

Group data

For as long as the group exists. Deleting an expense marks it deleted rather than erasing the row, so that other people’s phones learn about the deletion when they next come online; those markers are kept for the lifetime of this version.

Receipt photos in the cloud

Deleted automatically 30 days after a group has been archived and all its balances are zero — whichever of those two happened later. The copy on the phone that took the photo is untouched. An active group is never pruned. (R-PRIVACY-5, D22)

Sign-in codes

Minutes. They are single-use and expire.

Purchase records

Kept after an account is deleted, because a refund can arrive later and there has to be somewhere to record it. They carry no name and no address.

Your choices

Take your data with you

Settings → Export all my data writes every group, expense, settlement and balance to CSV files, and downloads every receipt photo you do not already have on the device. No request, no waiting. (R-PRIVACY-3)

Clear this phone

Settings → Privacy → Reset local data & resync deletes the local database and downloads everything again. It changes nothing for anybody else. (R-PRIVACY-2)

Delete your account

Settings → Delete account & data removes your profile, your login, your notification tokens and the link between you and your member rows. It does not delete the groups’ history, and it cannot: the expenses you paid for are part of other people’s balances. Each of your members becomes a placeholder that keeps the display name, so nobody’s arithmetic breaks, and receipts you attached stay with the group’s expenses. The app says this in the confirmation dialog before you type DELETE. (D17, R-MEMBER-5, R-PRIVACY-4)

Turn notifications off

Three switches in the app, plus your operating system’s own setting. The debt reminder is off unless you turn it on, and sends at most one message per group per week.

If you are in the EU or the UK you also have the rights the GDPR gives you — access, rectification, erasure, restriction, portability and objection — and the right to complain to a supervisory authority. Write to hello@fritfrit.app. Most of these are things the app already does for you without asking anybody.

Who else processes this data

• Supabase — database, authentication and file storage, in Frankfurt.
• Resend — sending the sign-in code e-mail, on European infrastructure.
• Google (Firebase Cloud Messaging) and Apple (APNs) — delivering push notifications. They see a device token and two UUIDs, as described above.
• Apple and Google as app stores, if you buy a plan. They handle the payment; FritFrit is told only that a purchase exists.
• Vercel — hosting this website.

Children

FritFrit is not directed at children and is not intended for anybody under 16.

Changes

If this policy changes in a way that matters, the app will say so rather than quietly updating the date at the top.

← FritFrit