Privacy Policy

1. Who we are

BillBahaa is a bill-splitting app for groups who eat together. It lets a group record a bill, claim what each person had, and keep track of who owes whom. BillBahaa is run from the Maldives and is responsible for the personal information described here.

This policy explains what we collect, why, who else sees it, how long we keep it, and the choices you have. It applies to the BillBahaa website and the app you install from it. Questions go to [email protected].

2. Information we collect

Account information

• If you sign in with Google: your name, email address, profile picture, and the Google account ID that links your sign-in to your BillBahaa account.
• If your account was set up with a username and password: the username, and your password, which is stored only as a secure hash and never in readable form.
• The display name and avatar you choose in the app.

Information you and your group add

• The groups you belong to, your role in each (admin or member), and the invites you create or accept.
• Bills: the place, date, meal, total, line items, service charge, GST, who paid, who took part, and who claimed each item.
• Bank details you add so others can pay you: bank name, account number, and account name.
• Payments you record, the transfer slips you upload, and whether a payment was confirmed or disputed.
• Notes or reasons you give, for example when a bill is deleted or a payment is flagged.
• Group settings, such as whether reminders are on and after how many days they are sent.

Photos

Photos of receipts and bank transfer slips that you upload. These can show the place, items, amounts, dates, names, account numbers, and transaction references printed on them.

Notifications

The in-app notifications we create for you. If you turn on push notifications, your browser gives us a push subscription (an address on your browser's push service) so we can send them to your device.

Technical information

• Cookies that keep you signed in (see section 7).
• Basic request information, such as IP address, browser type, and time of request, which our hosting provider records in server logs to run and secure the service.
• Anonymous page-view statistics from Vercel Analytics in production.

We do not collect your location, contacts, or anything from your device beyond what is listed here, and we do not collect payment card details. BillBahaa never moves money.

3. How we use it

• To create your account and sign you in.
• To show your group its bills, claims, balances, and payments, and to work out who owes whom.
• To read receipts and transfer slips, suggest line items, and match a slip to the payment it covers.
• To send notifications and reminders, for example when a bill needs your claim, when someone pays you, or when a debt is still open. Group reminders go out in the morning, Sunday to Thursday, if your group has them on.
• To show you your own spending over time on the Insights page. Only you see your Insights.
• To keep the service secure, prevent misuse, and fix problems.
• To reply when you contact us.

We do not sell personal information, use it for advertising, or build profiles of you for anyone else. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Automatic slip matching only suggests that a payment arrived, and the person being paid can dispute it.

4. Google user data

When you sign in with Google we receive only your basic profile (name, email address, and profile picture). We use it to create your account, sign you in, and show your name and picture to your groups. We do not request access to your Gmail, Drive, contacts, or calendar.

BillBahaa's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or transfer it to anyone except as needed to run the app (section 6).

5. Reading receipts and slips with AI

When you upload a receipt or transfer slip, the photo is sent to Google Gemini, an AI service, to read the text on it. For receipts, you review the reading before anything is saved. For slips, the reading is compared with the payment it was uploaded for. If a reading fails because the service is busy, we try again automatically, including during the morning reminder run.

Depending on the Gemini plan in use, Google may keep submitted photos for a limited time and, on unpaid plans, may use them to improve its products. Google's own terms and privacy policy govern that use. If you would rather a photo was not read by AI, you can enter a bill by hand instead of uploading a receipt.

6. Who can see your information

Your group

Everyone in a group can see that group's members, bills, claims, balances, payments, the bank details members have added, and the receipt and slip photos. They cannot see groups they are not part of, and nobody else can see your Insights. Think about this before you add details or photos to a group.

Service providers

We use these companies to run BillBahaa. They process information on our behalf and for no other purpose:

• Supabase, for sign-in, the database, and private file storage.
• Vercel, to host the app, run scheduled reminders, and provide page-view analytics.
• Google, for Google Sign-In and for reading photos with Gemini (section 5).
• The push service built into your browser (for example from Google, Apple, or Mozilla), if you turn on notifications. Notification text passes through it on the way to your device.

Legal reasons

We may disclose information if the law requires it, to respond to a valid legal request, or to protect the safety, rights, or property of our users, the public, or BillBahaa.

If BillBahaa changes hands

If BillBahaa is transferred to someone else, your information may go with it. They will have to honour this policy, and we will tell you before your information becomes subject to a different one.

7. Cookies and local storage

We use cookies that are needed to sign you in and keep you signed in. If you turn off “Keep me signed in”, a session-only cookie tells us to forget your sign-in when you close the browser. The app may also save small preferences, such as your theme, in your browser.

We do not use advertising or cross-site tracking cookies. Vercel Analytics counts page views without cookies. Blocking the sign-in cookies will stop you from signing in.

8. Where your information is stored

Our service providers store and process information on servers outside the Maldives, including in other countries in Asia, Europe, and the United States. By using BillBahaa you understand that your information will be transferred there. We choose providers that protect it with security measures in line with industry practice.

9. How long we keep it

• Account information: while your account exists.
• Bills, claims, payments, and debts: while the group exists. A deleted bill is hidden from the group but kept with a record of who deleted it and why, so balances can be explained later.
• Receipt and slip photos: for at least a year, and while the bill or payment they belong to is kept.
• Push subscriptions: until you turn off notifications or your browser ends the subscription.
• Server logs: for the short period our hosting provider keeps them.

When you ask us to delete your account, we delete or anonymise your personal information. Because a bill involves other people, we may keep the parts of a shared bill that your group still needs, such as an amount owed, with your name removed or replaced, unless the group is deleted too.

10. How we protect it

• All traffic to BillBahaa is encrypted with HTTPS.
• Database rules limit each person to the groups they belong to.
• Photos are kept in private storage and shown only through links that expire after an hour.
• Passwords are hashed, and access to production systems is limited.

No system is perfectly secure. If a breach affects your personal information, we will tell you without undue delay and say what we are doing about it.

11. Your choices and rights

You can, at any time:

• Change your display name, avatar, and bank details on your profile.
• Remove a bank account you added.
• Turn push notifications on or off in the app or in your browser settings.
• Leave a group, or ask its admin to remove you.
• Remove BillBahaa's access from your Google account settings.

You can also ask us to:

• Give you a copy of the personal information we hold about you.
• Correct information that is wrong.
• Delete your account and personal information (section 9).
• Stop or limit a particular use of your information.

Email [email protected] from the address on your account. We may need to confirm it is you, and we will reply within 30 days. Depending on where you live, you may also have the right to complain to a data protection authority.

12. Children

BillBahaa is not meant for children under 13, and we do not knowingly collect their information. If you believe a child under 13 has an account, email us and we will delete it.

13. Changes to this policy

When this policy changes, we update the date at the top of this page. If a change materially affects how we use your information, we will tell you in the app before it takes effect. The current version is always at /privacy, and the Terms of Service are at /terms.

14. Contact

For any question or request about your privacy, email [email protected].