Privacy policy

We respect your privacy and process personal data in line with applicable laws, in particular Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll., on personal data processing. This document describes what data we process, for what purposes, with whom we share it, how long we keep it, and what rights you have.

The data controller is Lidmila Maršálková, Czech company ID: 05684447, registered office at Jindice 115, 285 04 Rašovice-Uhlířské Janovice, Czech Republic (hereinafter also the "controller" or "we").

This policy applies to the Kvitta mobile app for Android (Google Play) and iOS (App Store), the web app at kvitta.app, and the payment-link pages you send to others from the app.

• User account: email, display name and sign-in method (email and password, email link, Google, Apple or Facebook). When you sign in with Google, Apple or Facebook we receive your name, email and, where available, profile photo from that provider. With Apple you can hide your email.
• Profile and settings: profile photo or chosen picture, language, default currency, notification and reminder settings, whether you completed the intro.
• Bank account number (optional): account number or IBAN if you enter it. It is used to create QR payments and payment links. We do not process payment card numbers.
• Groups and expenses: group names, icons and colours, members and their names, roles, expenses (description, amount, currency, category, date, note, who paid and how it is split, receipt items), comments, settlements, kitty, recurring payments and archived groups.
• Payment links: when you send a link to someone who owes you, we store both names, the group name, the amount, the currency and your account number. A link is valid for 60 days.
• Notifications: the device token for push notifications (Firebase Cloud Messaging) and records of payment reminders sent.
• Premium purchases: your account identifier, the product purchased, purchase date and subscription status. Payment details are seen only by Google Play or the App Store; we have no access to them.
• Ads (free version only): the device advertising identifier (only with your consent), IP address, device information and consent status. These are processed by Google AdMob.
• Receipt photos: receipt text is recognised on your phone (Google ML Kit on Android, Apple Vision on iOS). We never upload the receipt photo; only the recognised items and amounts are saved to the expense.
• Imported data: expenses you import from a CSV file, and data from the earlier Kvitta Android app that was stored only on your phone. After you sign in we move it to your account.
• Technical and operational data from the web: IP address, cookie identifiers, device and browser information — for running the website, security, and analytics (Google Analytics and Microsoft Clarity only with consent).
• Support communication: the content of emails you send us.

• Contract performance (Art. 6(1)(b) GDPR): account and sign-in, groups, expenses, balance calculation, sync across devices, group activity notifications, payment reminders, payment links and Premium purchases.
• Legitimate interest (Art. 6(1)(f) GDPR): security, abuse prevention, bug fixing and customer support.
• Consent (Art. 6(1)(a) GDPR): personalised ads and the advertising identifier, analytics cookies on the web, publishing a blog comment (you write and submit it voluntarily), phone permissions (notifications, camera, photos).
• Legal obligation (Art. 6(1)(c) GDPR): accounting and tax records.

• Members of your groups see your name, profile photo, expenses, comments, balances and settlements within the groups they belong to. People who owe you see your account number in the QR payment.
• Anyone who receives a payment link sees your name, the debtor's name, the group name, the amount and your account number — even without the app or an account. Only send a link to the person it is meant for.
• Kvitta Wrapped and CSV and PDF exports are created on your phone. You decide who you send them to.

We do not sell your data and do not share it for marketing purposes. To run the app we use these processors:

• Google Firebase (Google Ireland Ltd. / Google LLC): Authentication (sign-in), Cloud Firestore (data), Cloud Storage (profile photos), Cloud Functions (notifications, reminders, recurring payments, payment links), Cloud Messaging (push notifications) and Hosting.
• RevenueCat, Inc. (USA): verifying and managing Premium purchases on Android and iOS. It receives your account identifier and purchase data from the store.
• Google AdMob (free version): ad serving and consent management; governed by Google's privacy policy.
• Google Analytics 4 (Google Ireland Ltd., web only): traffic measurement — which pages you view, how far you scroll them, clicks on app downloads, sign-up and links to other websites (including partner links in articles), form submissions including comments (only that one was sent, not its content), and the terms you type into the blog search. The Google Analytics script loads only after you consent to statistics cookies in the cookie banner; without consent it does not load and nothing is sent. Please do not type personal data into the blog search.
• Microsoft Clarity (Microsoft Ireland Operations Limited, web only): heatmaps and session recordings — all text on the page is masked; enabled only after consent to statistics cookies in the cookie banner.
• Vercel Inc. (USA): hosting of the kvitta.app website and of the blog comment administration.
• Neon Inc.: the database that stores blog comments.
• Slack: notifying the operator of a new comment (name and text) for moderation.

The following process data as independent controllers under their own policies:

• Google (Google Play, Sign in with Google) and Apple (App Store, Sign in with Apple, notification delivery to iPhone),
• Meta Platforms Ireland (Facebook Login). The Facebook SDK is used for sign-in only. It does not start when the app launches – it connects to Meta servers only when you sign in with Facebook (Meta then sees your IP address and device type); we do not send it the advertising identifier or automatic app events.

Exchange rates are downloaded once a day from the public European Central Bank rates (via the Frankfurter service); no personal data is sent.

• The free version shows Google AdMob ads (full-screen ads and ads in lists).
• On iPhone the system asks right after the first launch (before sign-in, and also with Premium) whether Kvitta may use the advertising identifier (App Tracking Transparency). If you decline, the advertising identifier is not used.
• In the EU, EEA, UK and Switzerland the app asks for your consent before the first ad if you do not have Premium (Google consent form).
• Without consent you get non-personalised ads. You can change your choice anytime in the app under Me → settings & notifications → ad privacy and consent, and on iPhone also in Settings → Privacy → Tracking.
• With Premium, no ads and no Google consent form are loaded at all (the iPhone system prompt still appears).

• Camera: taking a photo of a receipt and scanning an invite QR code.
• Photos: choosing a receipt or a profile photo.
• Notifications: alerts about expenses, settlements and reminders.

All permissions are optional and you can revoke them anytime in your phone settings.

• Account and profile: for as long as the account exists.
• Expenses in groups: for as long as the group exists. Expenses are a shared record of the group, so they stay with the other members after you leave the group or delete your account, so that their balances still add up.
• Deleted expenses: 30 days in the trash, then permanently deleted.
• Payment links: valid for 60 days, after which they can no longer be opened.
• Purchases: records at RevenueCat and the stores under their own rules; accounting records for the period required by law.
• Google Analytics (web): 14 months; enabled only with consent.
• Microsoft Clarity (web): session recordings 30 days, favourited sessions, heatmaps and aggregated data 9 months; enabled only with consent.
• Data is transmitted over TLS. Access to Firestore data is restricted by security rules — a group is visible only to its members. We regularly update software and apply access controls on a need-to-know basis.

App data is stored in Firebase in the nam5 region (USA) and Cloud Functions run in us-central1 (USA). RevenueCat is based in the USA. For transfers outside the EEA we rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the Standard Contractual Clauses (SCC) under Art. 46(2)(c) GDPR.

Essential: the kvitta.app website stores a consent cookie with your cookie choice (valid for 180 days). The web app at app.kvitta.app keeps you signed in using browser storage (Firebase Authentication). Both are necessary for things to work and do not require consent.

Analytics cookies (Google Analytics; Microsoft Clarity — cookies _clck and _clsk) are loaded only after your consent via the cookie banner. Without consent these scripts do not load at all. You can change or withdraw consent anytime via Cookie settings in the website footer or by clicking this link. After withdrawal, Google Analytics stops sending data immediately and we delete its cookies (_ga), Microsoft Clarity is notified that consent was withdrawn, and analytics scripts will not load on later visits.

We do not use tracking cookies or third-party advertising cookies on the website.

Partner links: some links in blog articles are partner (affiliate) links from the eHub, CJ and AffiliatePort networks and are marked as sponsored. If you buy through them, we may earn a commission at no cost to you. The website sends nothing to the partner; after you click, however, the affiliate network may set its own cookie on its website to attribute the purchase, under its own privacy policy. We measure clicks on partner links in Google Analytics only if you have consented.

Anyone can leave a comment under blog articles. Your name (a nickname is fine) and the text of the comment are published; we do not ask for your email. A comment appears immediately and is moderated afterwards; the operator is notified of each new comment. The legal basis is your consent — you can have your comment deleted at any time. Comments are stored in the operator’s administration (hosting by Vercel, database by Neon) for as long as the article exists or until you ask us to delete them at podpora@kvitta.app. To prevent spam (legitimate interest), a one-way fingerprint (salted hash) is created from your IP address and deleted after 24 hours; the IP address itself is not stored. Your browser remembers only the name you entered (in localStorage) for your next comment. Comments use no cookies. Submitting a comment is measured in Google Analytics only with your consent.

The app is not intended for children under 16. If we learn that a child under 16 created an account without parental consent, we will delete it.

Within the limits of applicable law you have the right to:

• access your personal data and obtain a copy of it (you can export a group's expenses to CSV yourself),
• have inaccurate or incomplete data corrected (you can edit your name, photo and account number directly in the app),
• erasure ("right to be forgotten") and restriction of processing,
• object to processing,
• data portability,
• withdraw consent, without affecting the lawfulness of processing before the withdrawal,
• lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ) or the supervisory authority in your country.

You can delete your account directly in the app under Me → settings & notifications → delete account. Other options are on the Account & data deletion page.

Updates will be published on this page with a new revision date. We will notify you about significant changes through the app.

Got a question or want to exercise your rights? Write to us:

• Kvitta support: podpora@kvitta.app
• Operator (CodeWhiskers): hello@codewhiskers.app
• Address: Jindice 115, 285 04 Rašovice-Uhlířské Janovice, Czech Republic