Privacy policy

Effective 6 November 2026. MeroSplit is operated by Om Shejul. For privacy questions, contact mail@merosplit.com.

What you choose to save

MeroSplit uses a signed-in account. Your groups, people, bills and payment records are saved on the server. Your phone or supported regular browser keeps account-specific copies for offline use and queues offline changes to sync automatically when connected. Older records saved only on a phone are added to an account only after you confirm; signing in does not claim them.

We store your account email, short-lived protected sign-in challenge digests and delivery status, member names and identifiers, group membership, bills, amounts, dates, splits, notes, payment records and change history. We also store an optional UPI address, profile photo and bill attachments when you add them. A Splitwise CSV import saves the records and choices you confirm in its preview.

Why we use this information

We use these records to calculate balances, sync your account, manage invitations, display bill evidence, let members acknowledge payment records, provide exports and operate the service. Group members can see the group's records. Anyone holding a valid invitation link can see the invited person's involved bills, notes, balance, repayments and involved names on the invitation page without signing in. Share links only with intended recipients. Manual share-link joining requires a request and the organizer's approval. Email invitations reveal no ledger before the intended recipient signs in with a code sent to that exact address; verified recipients can then join that shared group. Typing a contact email does not link an account or send an invitation. A new bill that financially includes an unclaimed person may send a generic notification to the supplied address. That sign-in link verifies the mailbox only. Access to the bill still requires the organizer’s explicit invitation.

MeroSplit does not connect to your bank, read bank transactions or verify payments. A supported UPI link can open a separate payment app, where you review and authorize payment. UPI addresses and payment records are entered by people. Your saved UPI address is visible to linked members of your shared groups. Recording a payment does not send money. Opening or returning from a payment app never records payment automatically.

Bill conversations

Signed-in group members can read and post plain-text messages about a bill. We store these messages, their authors and times, unread status, chat policy acceptance, chat-only blocks and private abuse reports. Notifications go only to current people financially included in the bill, excluding the sender. Account email reminders batch unread messages after ten minutes. Generic email and push notices contain no message text. Eligible unclaimed contacts may receive an immediate generic notice that grants no access. Merely fetching a conversation does not mark it read. Blocking hides that sender's chat for you and stops future chat notices from them. It does not change shared financial records. Authorized support operators may review reports and hide abusive chat. Chat is not end-to-end encrypted. Your account export includes your chat facts, and deleting your account removes messages you authored.

Photos, files and notifications

Photo and file access begins when you choose to add a photo, attachment or import file. The API processes the file you upload, resizes images and removes image metadata before saving the optimized file in private object storage. This is not a guarantee that information visible in a photo or PDF has been redacted.

We keep account-level unread bill notices and the exact bill revisions you have seen. Expense updates in Me → Notifications control expense push and email across your devices. Phone permission controls only that device's push route; we store its installation identifier and push token linked to your account and session. Unseen bills may produce a generic push after 30 seconds. Optional email reminders arrive when a new bill is still unseen after 10 minutes, even if you use another screen or have no mobile app. Viewing the current bill on web or mobile cancels its pending reminder. Updates that are due together are grouped, and an already emailed notice is not repeated. Existing accounts keep their choice. New accounts start with email reminders off until you choose to enable them. You can turn reminders off in Me. Alerts contain no bill amounts, descriptions or names; private push routing uses account, group, bill and notice identifiers. Online opt-out suppresses pending work. An offline change waits for retry, and a request already handed to a provider can still arrive. Sign-out revokes that device's registration. Account deletion removes preferences, notices and reminder delivery records. Permission changes are checked when the app becomes active.

If a new bill includes a supplied email without usable group access, a generic notification can be sent immediately. Adding or editing the contact alone sends nothing. Each email has a Stop bill emails link with an explicit confirmation. We retain a keyed mailbox preference to honor that choice, including after account deletion. Existing verified account email and expense-update OFF settings also suppress these emails. We do not infer app installation from notification tokens.

Connected agents

Connect MCP is optional. You sign in with the existing browser flow and explicitly approve each agent connection. An agent can read allowlisted ledger records and use selected bill/payment-record commands under your existing account and group permissions. Payment tools never send or verify money. We store the client name, approved scope, credential digests, expiry, usage time and revocation state. Disconnect in Me, Connect MCP revokes both access and refresh credentials. A request already running can finish. Account deactivation or deletion stops access. Connected agents process the records you authorize under their own policies.

Feedback

Feedback you submit is saved with your account and forwarded through our notification service to our private Slack support inbox. Your export includes feedback saved in MeroSplit. Deleting your account removes that saved feedback; contact us to request removal of support-inbox copies.

Service providers and sharing

Railway hosts our API and PostgreSQL database. Cloudflare Email Service delivers new requested sign-in messages and explicit email invitations, plus enabled unread expense and chat reminders and generic new-bill notices for supplied mailboxes. Resend remains in use only for already-frozen legacy sends during migration. Cloudflare R2 stores uploaded media privately. Expo, Apple and Google process push notifications and the device identifiers needed to deliver them. For automatic category icons, Vercel AI Gateway and TypeSafe Jev receive only the bill title and fixed category definitions. Amounts, notes, participants and account identifiers are not sent for this feature. These providers process information to run the service. We do not sell your personal information, display ads or use advertising trackers in this version.

MeroSplit uses Sentry to diagnose crashes, errors and performance traces. Reports may include your account ID, technical device and runtime details, platform, build and update information, and sanitized breadcrumbs about routes, statuses, timing and sync. App-level filters remove emails, names, request bodies, authentication tokens, bill descriptions, notes, amounts, media, SQL parameters, form fields, screen text, exception messages and local variables. Session replay is disabled.

HTTPS protects information in transit. Group records are accessible to authorized members; media uses temporary access links. MeroSplit does not offer end-to-end encryption. The service may retain technical request and error information needed to operate and diagnose it.

Retention and deletion

Account and group records remain while needed for your use of MeroSplit. You can export your account or group records and delete your account from Me. Deletion removes your user account, sign-in sessions, email, UPI address and device registrations. Your uploads, including shared bill attachments, are removed from visible records and marked for physical deletion. New download links are blocked immediately. Previously issued links expire within five minutes; successful physical deletion removes the file earlier. Bill descriptions, notes and other text attributable to you are removed or replaced with neutral placeholders in current records and change history. Groups you own without another active linked member are removed.

Other members retain anonymous participant identifiers, numeric bill amounts, splits, dates and payment history so their balances remain correct. Content entered by other members remains theirs; contact us if it contains personal information about you that you want removed. A storage-provider failure can delay physical file deletion; we keep deletion markers so cleanup can be retried. Previously downloaded copies cannot be recalled. Deletion from the active service does not remove copies other people previously exported or downloaded. This beta currently has no configured scheduled database backups or point-in-time recovery.

Request account or personal-data deletion, including if you no longer have the app. Requests may require confirmation of account ownership. Deleting an account also clears its cached records and queued changes from the phone where you confirm deletion. Older phone records that you have not added to an account remain separate and can be removed by clearing the app's local data.

Browser storage

Regular supported browsers retain downloaded records, drafts and pending changes in site storage. Clearing site data removes those local copies. When a browser cannot open persistent storage, including some private windows, MeroSplit uses a temporary online-only tab. Unsent changes and drafts end when that tab closes; the app warns before leaving with unsent changes. Accepted server records remain available after signing in again.

Your choices

You can disable bill alerts, export records and delete your account. To correct bill information, edit it in the group or contact the group organizer. A person can be removed from a group once their balance is zero; their history remains, and a linked account loses access to that group. Archiving a group preserves its members' access to the records. For further privacy requests, email mail@merosplit.com.

We will update this page when how the app handles information changes.