Privacy policy

Last updated: November 5, 2026

Kwitsy helps friends keep track of shared costs. This page explains, in plain words, what we collect and why. We don't sell your data and we don't show ads.

Kwitsy is run by Kramatics LLC, which is responsible for your data (the "controller"; under India's DPDP Act, the "Data Fiduciary"). For anything about your data, email contact@kwitsy.com.

What we collect

Account details: your name and email address. If you sign in with Google, we receive your name, email address and profile picture from Google. We don't get your Google password or access to anything else in your Google account.
What you add: groups, the people in them, expenses, payments, comments, receipt photos and the payment app handles you choose to share. If you add bank details to get paid (an IBAN with the account holder's name and BIC, a Pix key, a CLABE, a phone number or email for Bizum, MB WAY or Wero, a phone number for Swish, Vipps MobilePay, TWINT or BLIK, or a Tikkie link), we keep those too.
Contacts: adding people from your contacts (the phone's contact picker, or a contacts file you import) reads only the contacts you choose, in your browser; a contacts file is never uploaded. Phone numbers aren't sent to us or stored (they only fill in the text and WhatsApp invite links on your device). The name and email of each person you pick are used like a name and email you type.
Invitations: when you add someone by email who doesn't have a Kwitsy account, we send them one invitation email with the group's join link (at most one a day and three in total per address, and none after they tap "stop" in it). To keep to those limits we store only a scrambled key of the address, not the address itself.
Technical data: sign-in sessions (a cookie that keeps you logged in), and basic request logs kept by our hosting provider to run and secure the service. If you use a group as a guest (without an account), a cookie on that device remembers which name you picked; the group owner can sign guests out. A language cookie remembers the language you picked, and in our Android app a cookie notes that you're using the app. There are no advertising or analytics cookies.
“How did you hear about Kwitsy?”: if you answer, we only add one to a count for that answer. Your answer isn't kept with your account.
Partner links: if you open Kwitsy from a link with a partner code (like kwitsy.com/?via=code), we add one to that code's count for the day, and one more if you create an account within a day. Two short-lived cookies on our own site (the codes already counted today, until midnight UTC; the code itself, for one day) stop double counting, and a form of your network address scrambled with a secret key, so we can't read it back, changes every day, limits repeat counts and is deleted the next day. The code is never saved with your account or shared.
Feedback: if you use “Send feedback” (in Account, or at the bottom of Help), we keep what kind it is (an idea, something wrong, or other), your message, the page you sent it from, your language and, if you're signed in, which account sent it. Your email address is kept with it only if you tick “OK to email me about this” (your account's address, or the one you type when signed out). We don't store your network address, browser or device with it. When you're signed out, a form of your network address scrambled with a secret key limits how many messages can be sent in a day (against spam); it changes every day and is deleted the next day.

How we use it

To run Kwitsy: work out balances, show your groups and activity, and let group members see shared expenses.
To send emails you need: sign-in links, and notifications and reminders (you can turn these off in Account settings).
To send push notifications if you turn them on for a device: the message goes through your browser maker's push service (Google, Apple, Mozilla or Microsoft). Turn them off in Account settings; signing out turns them off for that device.
To read receipts you choose to scan: the image is sent to our AI provider to extract items and totals.
To help others repay you: anyone who currently owes you in a group can tap to see your bank details (and payment phone numbers and links) on Settle up, as a QR code and copy buttons for their banking app; you're told when someone looks (once a day per person), and there's a daily limit. Kwitsy never moves money. They're never put in group exports, notifications, emails, links, our AI prompts or analytics; your own data download includes them. When you change them, your shared groups are told that you changed your payment details (not the details themselves), you get an email, and the new details show to others a day later.
To fill in the form when you use Quick add: the sentence you type is sent to our AI provider.
To read your feedback and improve Kwitsy. Only the people who run Kwitsy read it. If you ticked “OK to email me about this”, we may email you about it, for example once to say it's fixed.
To answer questions you ask about a group: the question and that group's expenses, as needed to answer it, are sent to our AI provider.
To turn receipts you forward to a group's email address into drafts: the email is received by our email provider, and an attached receipt is stored and, if scanning is on, read by our AI provider. Only mail from your own account address is used.
To suggest a category and spot possible duplicates: an expense's description, amount, date and payer names are sent to an AI provider. They answer only with a suggestion; nothing is changed without you.

Why we're allowed to use it

To provide the service you signed up for (running your account and groups, sign-in emails): this is needed to perform our agreement with you.
Notification emails, security and abuse prevention, request logs, category suggestions and duplicate warnings: our legitimate interest in running a safe, useful service. You can turn notifications off at any time.
Feedback you send: our legitimate interest in improving Kwitsy; emailing you about it only if you ticked “OK to email me about this”.
Push notifications and the AI features (receipt scanning, Quick add, questions, forwarded receipts), and bank details for getting paid: only when you choose to use them.
In India, we use your data with your consent, which you give by creating an account (or joining as a guest) after seeing this notice, and by choosing the features you use. You can withdraw it at any time by deleting your account or turning a feature off; that doesn't affect what was done before.

How long we keep it

Your account and groups: until you delete them.
Sign-in links: 15 minutes. Sign-in sessions: 30 days after your last visit.
Guest cookies: up to 180 days, or until the group owner signs guests out.
Invite links: 30 days. "Check the math" links: until someone turns them off.
Receipt photos: until the group they belong to is deleted for good (30 days after it's deleted), or sooner with a forwarded receipt's unsaved draft. Forwarded-email text: as long as its draft.
Feedback: until we no longer need it, or until you delete your account or ask us to delete it. Deleting your account deletes the feedback you sent, including any sent signed out from the same email address. For feedback sent without an account, email us.
When you delete your account, your personal details are removed straight away. Encrypted backups kept for recovery roll off within 90 days.

Where it's stored

Kwitsy runs in the United States (Vercel and Neon). If you're in the EU, UK or elsewhere, your data is transferred there under our providers' standard data-protection terms, including the EU Standard Contractual Clauses.

Who can see your data

People in a group can see that group's members, expenses and comments. Your payment app usernames are visible to people you share a group with; your bank details, payment phone numbers and links only to people who currently owe you in a group, after a tap on Settle up (you're told when someone looks, once a day per person, and there's a daily limit). If a group allows guests, anyone with its invite link can view it and add to it without an account. If someone in a group creates a read-only "check the math" link, anyone with that link can see the group's names, expenses and balances (not emails) until it's turned off. Nobody else can see your groups.

Service providers

We use a small number of providers to run Kwitsy, who process data only on our behalf:

Vercel (hosting and file storage)
Neon (database)
Resend (email delivery, and receiving receipts you forward)
Anthropic (receipt scanning, Quick add and questions, only when you use them; and the small automatic checks: category suggestions, duplicate checks, spotting repeating bills, and deciding which part of a forwarded receipt email to read)
Google (only if you choose Sign in with Google)

Your choices

Download everything we hold about you any time from Account → Your data.
Turn email notifications on or off in Account settings.
Delete your account any time from Account → Delete your account. Groups only you use are deleted; in shared groups your expenses stay (so everyone else's balances still add up) but you appear as "Former member".

Your rights

Depending on where you live (for example under the GDPR, UK GDPR, India's DPDP Act or California law), you can ask us to access, correct, delete or export your data, and to restrict or object to how we use it. Most of this you can do yourself in the app; for anything else, email us and we'll reply within one month. You can also complain to your local data protection authority. In India, email us first at contact@kwitsy.com (our grievance contact); if you're not satisfied with our answer, you can then complain to the Data Protection Board of India. In India you can also nominate someone to use these rights for you if you die or can't act yourself: email us to set this up. We answer complaints within one month, and always within the 90 days India's rules allow.

AI providers

The Claude features (receipt scanning, Quick add, questions) only run when you use them. A few small checks run on their own: when you type an expense description it's sent to suggest a category and to ask whether it repeats; when you save an expense its description, amount, date and payer's name are compared with similar ones in the group to warn about duplicates; and a forwarded receipt email's subject and start are read to decide where the receipt is. These checks also use Anthropic's Claude (a small, fast model), so all AI processing is done by Anthropic. Only what each check needs is sent, and nothing is used for ads. Anthropic's commercial terms say it doesn't train its models on data sent through its API. AI suggestions can be wrong, so Kwitsy always lets you check them before anything is saved.

Children

Kwitsy is for people aged 16 and over (18 and over in India, where younger people need the consent of a parent or lawful guardian). We don't knowingly keep data about anyone younger: if you believe a child is using Kwitsy, email us and we'll delete their account.

Changes

If we change this policy in a way that matters, we'll update the date above and tell signed-in users by email first.

Contact

Questions or requests: contact@kwitsy.com