Draft — not yet reviewed by a lawyer. FritFrit is in private testing. This page describes what the app and its server actually do today; it will be reviewed before FritFrit is published to either store. Ova je stranica zasad samo na engleskom.

Privacy policy

Last updated 17 September 2026

FritFrit is an app for splitting shared expenses. It is built so that the smallest possible amount of information about you leaves your phone, and so that what does leave is only what other people in your groups need in order for the arithmetic to work.

There is no advertising, no analytics and no tracking of any kind. No advertising identifier is read, no analytics SDK is installed, no third-party crash reporter is installed, no profile of you is built, and nothing about you is sold or shared with anybody for their own purposes. This is enforced in the code, not only promised: the app’s test suite fails the build if firebase_analytics, firebase_crashlytics, firebase_performance, sentry, bugsnag, instabug or datadog so much as appears in the dependency list. When something goes wrong, the app keeps its own notes on your phone, and they leave it only if you send them, or if you have asked the app to send crash reports for you — see Diagnostics and problem reports.

This website behaves the same way. It sets no cookies at all — not one, of any kind — stores nothing in your browser, embeds nothing from a third party, and loads its own fonts from its own server, so that visiting it does not hand your IP address to anybody else. The language you are reading in is chosen from what your browser asks for, and if you pick a different one at the bottom of the page it is remembered by the address you are then on, not by anything stored. That is also why there is no cookie banner: there is nothing to consent to.

Who is responsible

[CONTROLLER NAME]
[STREET ADDRESS]
[POSTCODE, CITY]
[COUNTRY]
hello@fritfrit.app

Placeholder. This block is filled in before FritFrit is offered to anybody outside private testing.

What is stored, and where

Two copies of your data exist: one on your own phone, and one on a server, so that the other people in your groups see what you add. The phone’s copy is the one the app reads; the server is what the phones agree through.

On your phone

Everything the app shows you — your groups, their members, expenses, settlements and the photos you attached — is stored in a database on the device. That database is encrypted (SQLCipher), and its key is held in the platform’s own secure storage: the iOS Keychain, or the Android Keystore. Receipt photos are written to the app’s private directory, never to your camera roll and never to shared or external storage; on iOS they carry NSFileProtectionComplete, so they cannot be read while the device is locked. Your sign-in session is held in the same secure storage as the database key.

The app also keeps a short diagnostic log on the phone — which kind of record it synced, whether the server answered, how long a step took — and, if it crashes, a record of the error beside it. Both are in the app’s private directory, with any problem report that is waiting to be sent, and they stay on the phone: they are left out of the phone’s backups, on Android and on iPhone alike. Signing out, deleting your account and resetting local data delete them — the log, the crash records and every report not yet sent. No line the app writes into the log has a name, an amount, a title or an e-mail address in it, and anything that looks like one — an e-mail address, an IBAN, an amount, a code, a token, an id — is masked before a line is saved. The log also keeps, masked the same way, what the software the app is built on prints for itself; masking cannot catch a name such text may quote, so those lines never leave the phone — no report carries them, and neither does Share. A report waiting to be sent holds what is listed under Diagnostics and problem reports, the one line you may have typed into it included. (R-PRIVACY-7, R-PRIVACY-8)

On the server

The server is Supabase, hosted on AWS in Frankfurt, Germany (eu-central-1). It holds:

Your profile
Display name, e-mail address, default currency, language, your three notification preferences, and whether you have an active plan. Your profile row is readable and writable by you only — nobody else in your groups can read your e-mail address, your plan or your preferences.
Your groups and what is in them
Group names, icons and currency; members and their display names; expenses (an amount in whole cents, an optional note, a category, a date, who paid and who shared it); settlements. Everyone who is a member of a group can read that group’s contents — that is what a shared ledger is. Nobody who is not a member can read any of it.
Receipt photos, if you attach them
Attaching a photo is the consent to upload it; nothing else uploads a photo. They are stored in a private bucket, readable only by the current members of that one group, and are never public. Uploads happen on Wi-Fi only unless you turn that off.
An IBAN, only if you enter one
Optional, never prompted for. It is copied onto your member row in each group you are in, and therefore reaches exactly those groups and no further. Clearing it clears every copy. FritFrit moves no money: it holds no card, initiates no transfer and confirms none. The “Pay” screen draws a standard SEPA payment QR code that your own banking app reads. (R-PRIVACY-6, R-STL-13)
Notification tokens
If you allow notifications, the push token for that install, its platform and language. Readable and writable by you only — other members never learn that you have a device, let alone its token.
Purchases
If you buy a plan, the store’s transaction identifiers, which product it was and when it expires. FritFrit never sees your card, and no price is ever stored.
Problem reports, only if you send them or turn on automatic sending
The report as it was sent — what is listed under Diagnostics and problem reports — with the time it arrived and a short code the server makes from the first lines of a crash’s error, so that repeats of one crash are counted together. They are kept in a table that neither the app nor any signed-in user can read, and are read only by FritFrit’s operator on its admin page. A report carries no account, so it can be found by its device code and by nothing that names you.

What is deliberately not stored

Notifications, and what Google and Apple can see

When somebody adds an expense to your group, the server sends a push message containing three identifiers and nothing else: which kind of thing happened, the group’s id and the row’s id — two random UUIDs and one of three fixed words. There is no name, no title and no amount in it, and no text of any kind. The sentence you read in your notification tray is written on your own phone, in your own language, from data that phone already had.

This matters because a push message passes through Apple’s and Google’s delivery infrastructure. What that infrastructure can see is a device token and a UUID. It cannot see who spent what, or with whom. (R-NOTIFY-3)

Diagnostics and problem reports

The app sends nothing from the diagnostic log on its own. A report leaves the app in one of three ways, and each of them is yours:

Before you press Send, See what’s sent shows the report exactly as it will leave. It contains whether it is a crash or a report you wrote, and when it was made; the app’s version and build; your phone’s operating system, its version and the phone’s model; the app’s language, text size and light or dark setting; how many groups are on the phone — a number, never their names; whether the app could reach the server; how long it had been running; for a crash, the kind of error, a short code the error carries if it has one, and where in the app’s code it happened — never the error’s own message; up to the last 100 lines of the log, masked as described above; the line you typed, if any; a random id for the report itself; and the random id of the app’s installation, which the device code is made from. Nothing the app puts in it ever contains your name, your e-mail address or your account id, the name of a group or of anybody in one, an amount, an expense title or note, an IBAN, a receipt photo, an invite code, or a sign-in or notification token. The one part the app cannot vouch for is the line you type: it is masked like a log line, so an e-mail address, an amount, an IBAN or an invite code typed there is hidden, but a name or a title typed there is sent as you typed it — which is why the field asks you not to type one. (R-PRIVACY-7)

The device code is the first eight characters of that installation id, a random value the app makes the first time it is needed. Report a problem shows it as XXXX-XXXX, so that you can tell us which report is yours. Neither id is derived from your account or from your phone. Reinstalling the app makes a new installation id, and so do signing out, deleting your account and resetting local data.

A report is sent without your sign-in: the report carries no account, and FritFrit does not connect it to one. To stop anybody flooding it, the server counts reports for a day per device code, per sending IP address and, for an IPv6 address, per the network it is part of. FritFrit’s database never stores the address itself — only a code made from it with a secret key that is kept on the server, so that nobody without that key can work back to the address, and those counts, codes included, are deleted two nights later. Our hosting provider (Supabase) keeps short-lived logs of every request the app makes, this one included: the address it came from, the approximate location worked out from that address (country, region, city, postal code and time zone), the network the address belongs to, the name of the software that sent the request, and the time. (R-PRIVACY-9, D30)

E-mail

FritFrit sends exactly one kind of e-mail: your 6-digit sign-in code, from noreply@fritfrit.app. There is no newsletter, no marketing and no “we’ve missed you”. Delivery is handled by Resend on European infrastructure. Your address is used to sign you in and to show you the “Signed in as” line, and for nothing else.

How long things are kept

Group data
For as long as the group exists. Deleting an expense marks it deleted rather than erasing the row, so that other people’s phones learn about the deletion when they next come online; those markers are kept for the lifetime of this version.
Receipt photos in the cloud
Deleted automatically 30 days after a group has been archived and all its balances are zero — whichever of those two happened later. The copy on the phone that took the photo is untouched. An active group is never pruned. (R-PRIVACY-5, D22)
Sign-in codes
Minutes. They are single-use and expire.
Purchase records
Kept after an account is deleted, because a refund can arrive later and there has to be somewhere to record it. They carry no name and no address.
Problem reports
90 days from the day each one arrives, then deleted automatically by a job that runs every night. On your phone the diagnostic log is two small files that drop their oldest lines as new ones are written, only the five newest crash records are kept, and at most the ten newest reports wait to be sent. (R-PRIVACY-7, R-PRIVACY-9)

Your choices

Take your data with you
Settings → Export all my data writes every group, expense, settlement and balance to CSV files, and downloads every receipt photo you do not already have on the device. No request, no waiting. (R-PRIVACY-3)
Clear this phone
Settings → Privacy → Reset local data & resync deletes the local database and downloads everything again. It changes nothing for anybody else. (R-PRIVACY-2)
Delete your account
Settings → Delete account & data removes your profile, your login, your notification tokens and the link between you and your member rows. It does not delete the groups’ history, and it cannot: the expenses you paid for are part of other people’s balances. Each of your members becomes a placeholder that keeps the display name, so nobody’s arithmetic breaks, and receipts you attached stay with the group’s expenses. The app says this in the confirmation dialog before you type DELETE. (D17, R-MEMBER-5, R-PRIVACY-4)
Turn notifications off
Three switches in the app, plus your operating system’s own setting. The debt reminder is off unless you turn it on, and sends at most one message per group per week.
Send crash reports, or don’t
Profile → Privacy & security → Send crash reports automatically is off until you turn it on; with it off, nothing is sent unless you press Send. Turning it off discards what automatic sending queued: a crash report it was still waiting to send, for instance while your phone was offline, is deleted and never sent, and from then on the app asks before sending a report about any crash. A report you sent yourself with Send is not taken back: it still leaves when your phone is back online. Signing out, deleting your account and resetting local data turn the switch off again. A report already sent carries no account, so we cannot find yours by your name or e-mail address; if you want one deleted before its 90 days are up, write to us with its device code. The phone shows only its current code, and signing out, deleting your account, resetting local data and reinstalling the app each make a new one, so note the code under Report a problem before you do any of those: a report sent under an earlier code can be found by that code and by nothing else. (R-PRIVACY-7)

If you are in the EU or the UK you also have the rights the GDPR gives you — access, rectification, erasure, restriction, portability and objection — and the right to complain to a supervisory authority. Write to hello@fritfrit.app. Most of these are things the app already does for you without asking anybody.

Who else processes this data

Children

FritFrit is not directed at children and is not intended for anybody under 16.

Changes

If this policy changes in a way that matters, the app will say so rather than quietly updating the date at the top.

← FritFrit