Privacy Policy

Applies to the Trimtab mobile apps for iOS and Android and to this website.
Last updated: August 26, 2026

Ta polityka prywatności prowadzona jest wyłącznie po angielsku — to wersja wiążąca.

1. Two ways to use Trimtab

Almost everything in this policy follows from one distinction, so it is worth stating first.

• A private group — the default. It lives in the app's storage on your phone. It is never uploaded, we never see it, and the app makes no network request on its behalf.
• A shared list — a group you have explicitly shared. A copy of it is stored on our server so that the phones holding the invitation link can all show the same list and keep it up to date.

A group only becomes a shared list when you open it, choose “Share list” and confirm. Nothing is uploaded before that, and creating a group never starts it.

2. Who is responsible

The Trimtab apps, this website and the server behind shared lists are provided by Trimtab, who is the data controller for the shared lists stored on it. For any question about this policy or your data, write to support@trimtab-app.com.

3. What the app stores on your device

To do its job the app stores what you type in:

• group names, their currency and how expenses are split;
• the names of the people in a group and their ownership shares;
• expenses: title, amount, date, who paid and who took part.

This is written to the app's private storage (SwiftData on iOS, a local database on Android), which other apps cannot read. There is no account to sign in to, so this data is not tied to any identity: we do not ask for and never receive your name, email address, phone number or payment details.

4. Sharing a list: what leaves your device

When you share a group, and every time it changes afterwards, the app sends our server exactly the contents of that group — and nothing else:

• the group's name, its currency and its split settings;
• each member's name, ownership share and whether they are still in the group;
• each expense: title, amount, date, who paid, who took part and in what proportion.

Along with it the app sends a small amount of technical data, needed only to keep several phones in step. Every entry in the list carries a random identifier and the time it was last changed — that is how two phones work out which version of an expense is the newer one. Each phone also identifies itself with a random identifier for the app installation and a random access token, and tells us which platform and phone model it is (for example “iPhone” or “Google Pixel 8”) so we can diagnose compatibility problems.

That installation identifier is generated the first time you share something. It is not derived from anything about you or your device, is not linked to any advertising identifier, and is the only thing tying your phone to a list. Uninstalling the app discards it — unless you later restore that phone from a backup, which brings your shared lists back with it (section 12).

As with any internet service, our server also sees the IP address a request comes from. It is used to serve the request and appears in the standard server logs described in section 14. It is not stored alongside the list and not used to build any profile.

Groups you have not shared are not included in any of this. The app does not upload them, does not check them against the server, and does not send us anything about how you use the app.

5. Who can see a shared list

Anyone holding the invitation link can open the list, read every expense in it, add new ones and edit what is there. That is the whole point of the feature, and it is also its main risk: the link is the key. There is no password on top of it, because the app deliberately has no accounts.

The link contains a random eight-character code — roughly 800 billion combinations — and repeated wrong guesses from the same place are blocked, so a list cannot be found by trying codes. Shared lists are not listed anywhere, not searchable and not indexed by search engines: without the link there is no way to reach one. But a link forwarded on, posted in a group chat or left in someone's message history keeps working. Send it only to the people the list concerns, and if it ends up somewhere it should not, stop sharing (section 9) and share again to get a new one.

Shared lists are not end-to-end encrypted: the server stores them in a form it can read, because it has to hand them to the other devices. We do not look at their contents, do not analyse them and do not use them for anything other than passing them between the phones that follow the same link.

6. Other people's names

The people you add to a group are usually named with a first name or a nickname you choose. In a private group that stays on your phone. In a shared list it is sent to our server and becomes visible to everyone holding the link, together with what each person paid and owes.

You decide what to write, so please keep it to what the situation needs — a first name is normally enough, and there is never a reason to put an address, a phone number or a bank detail into an expense title. Sharing a holiday's costs with the friends you travelled with is a personal activity, and European data protection law treats it as such; using the app to collect information about people for any other purpose is not what it is for.

7. What we never do

• We do not ask you to create an account, and we do not know who you are.
• The app collects no usage statistics, analytics or crash reports, and reports nothing about how you use it.
• There is no advertising, no tracking pixel and no third-party SDK that profiles you.
• We do not sell your data or share it with anyone. The only data that reaches us is a list you chose to share, and it goes no further than the people you sent the link to.
• We do not use shared lists to train anything, to build profiles, or for any purpose other than showing the same list on several phones.

8. Storage, security and how long we keep shared lists

Shared lists are kept on a server located in the European Union. They are transmitted over HTTPS, and the access tokens that identify each phone are stored only as a cryptographic hash, the way passwords are — a copy of the database would not reveal them. To stop invitation codes being guessed we also keep a short-lived counter of failed attempts, held against a hash of the address they came from rather than the address itself, and discarded within minutes.

A shared list stays on the server for as long as it is in use. If nobody opens it for a long time it is deleted automatically, along with its members, expenses and device records; the same happens to a list that has been deleted for everyone, once enough time has passed for the other phones to have received the news. Deletion is permanent — we keep no archive of shared lists, and there is nothing to restore from afterwards. Private groups are never on the server in the first place, so nothing about them is kept.

9. Deleting your data and stopping sharing

Inside the app you can delete individual expenses, remove people or delete a whole group at any time. Uninstalling the app removes its local database and with it everything on that phone.

For a shared list, “Stop sharing” asks which of two things you mean, because the difference matters:

• Just leave — your phone stops following the list. The others keep theirs, as they would expect; the copy on the server stays for them.
• Delete for everyone — the list and its expenses are removed from the server and disappear from every phone following it.

If you want a shared list gone from the server, choose “Delete for everyone” before deleting the group locally — deleting your own copy alone leaves the others' intact. If you cannot get to the app any more, write to support@trimtab-app.com with the invitation code and we will delete it for you.

10. Legal basis under the GDPR

For a shared list, we process the data it contains in order to provide the feature you asked for — showing the same list on several phones — which is the performance of a contract with you under Article 6(1)(b) GDPR. The random installation identifier and access token are processed on the same basis: without them the server cannot tell the phones apart or keep the list secure.

Server logs, including IP addresses, are processed on the basis of our legitimate interest in keeping the service running and defending it from abuse, under Article 6(1)(f) GDPR.

For private groups there is no legal basis to state, because there is no processing on our side at all.

11. Your rights

Under the GDPR you have the right to access, correct, delete, restrict and port your personal data, to object to processing, and to complain to a supervisory authority in your country.

For private groups we hold nothing to disclose or erase — the data is in your hands, on your device. For a shared list, the copy on our server is under your direct control from inside the app: you can read all of it, edit it, stop sharing it or delete it for everyone at any moment, which covers access, rectification and erasure without having to ask anyone. If you would rather we acted on your behalf, write to support@trimtab-app.com with the invitation code. Because there are no accounts, that code is the only thing that identifies a list to us — we cannot find one without it, and we have no way to look up “all lists belonging to you”.

If you contact us by email, we use your address solely to answer you and keep the message no longer than necessary.

12. Device backups

If you have backups enabled on your phone, your device may include the app's data — private groups included — in the backup created by Apple (iCloud Backup) or Google (Android Backup / Google One). Those backups are made and encrypted by Apple or Google under their own privacy policies; we have no access to them. You can turn backups off for Trimtab in your device settings.

13. App stores

The app is distributed through the Apple App Store and Google Play. When you download or update it, Apple and Google process data such as your account and device information under their own terms. They may also give us anonymous, aggregated statistics — for example the number of downloads or crash counts — that cannot identify an individual user.

14. This website and server logs

This site sets no cookies, embeds no trackers and asks you for nothing. The invitation page a share link opens shows only the list's name, its currency and how many people and expenses it has — never the expenses themselves, so a link opened by accident does not spill the contents.

Like any web server, ours writes standard access logs — IP address, time, requested address, browser identification — for both the website and the app's requests. They are used for security and troubleshooting, kept for a short period, and never used to profile visitors or connected to the contents of a shared list.

15. Children

Trimtab is not directed at children and we do not knowingly process their data. The app asks for no personal details at all, and a group only reaches us if someone deliberately shares it. If you believe a child has shared a list containing their data, write to us and we will delete it.

16. Changes to this policy

If this policy changes, the new version will be published on this page with an updated date. Meaningful changes affecting how data is handled will also be announced in the app's release notes.

17. Contact

Trimtab
support@trimtab-app.com