Privacy Policy for PeerSplit

1. Overview

Peerloom Labs develops PeerSplit (com.peersplit.app), an Android application for recording and sharing group expenses. This policy describes the current app. PeerSplit is currently free, with no advertising, in-app purchases, or subscriptions.

2. Information Used by the App

PeerSplit creates a local cryptographic identity instead of requiring email/password registration. This identity includes persistent public identifiers (Ed25519 public keys) and a private signing key stored in the Android KeyStore or app sandbox. Your local profile can include a display name, optional phone number, and UPI address.

The app stores group names, member details, expenses, descriptions, notes, amounts, splits, balances, settlements, preferences, and signed operation history on your device. It uses these records to calculate balances, display history, synchronize groups, and provide exports and backups. Adding another person's information makes it available to the relevant group; only include information you are entitled to share.

Peerloom Labs does not operate a central expense database for this app. This does not mean data never leaves your phone: group synchronization, SDK diagnostics, and actions you choose can transfer data as explained below.

3. Group Synchronization & Public Nostr Relays

Group operation payloads are encrypted with group-scoped 256-bit AES-GCM keys before transmission through public Nostr relays. Group members with the necessary keys can decrypt shared records. Cryptographic signatures help verify authorship and detect changes; they do not establish that an expense or payment claim is truthful.

Relay operators can observe connection information such as your IP address, public signing identifiers, event identifiers, timestamps, routing tags and other envelope metadata, as well as encrypted payloads. This service is not anonymous. Configured relays include relay.damus.io, nos.lol, relay.primal.net, nostr.mom and relay.snort.social; the configured set may change with app updates.

These independently operated services may store and replay events. Their retention, availability and handling of connection logs are controlled by their operators. Relays are not merely temporary routers, and Peerloom Labs cannot guarantee removal of their copies. Removing a member or rotating a key cannot revoke information or keys already obtained by that member.

4. Receipt Recognition & SDK Diagnostics

When you select a receipt image, text recognition is performed directly on your device using Google's bundled ML Kit text-recognition SDK. PeerSplit does not upload your image to any cloud OCR service for recognition.

ML Kit also collects technical information for diagnostics and usage analytics. Google's disclosure describes device and app information, installation identifiers, performance and error events, and recognition configuration and input/output size metadata. On-device recognition therefore does not mean the SDK sends no diagnostic data. Google documents HTTPS protection for this telemetry. See Google's ML Kit data disclosure and Google Privacy Policy. SDK practices and retention are governed by Google; Peerloom Labs does not provide a deletion control for Google's independently handled diagnostics.

5. Files, Contacts & Sharing You Choose

Android's system pickers let you choose receipt or QR images, import files, save exports and backups, or select a contact. Contact selection accesses the contact information you explicitly pick, rather than uploading your address book. The current app does not request camera, broad storage, contacts, SMS or location permissions. Internet and network-state access support synchronization; Android background-work components may use system scheduling permissions.

CSV exports are not encrypted by PeerSplit. Exports, reminders, QR codes and invitations may reveal financial details, member information, payment addresses or group access information to the recipients you choose. Treat invitations and group keys as sensitive. Apps, messaging services and document/cloud providers you select handle their copies under their own policies.

6. UPI Payments & External Handoffs

For INR payment handoffs, PeerSplit can open a compatible UPI app (such as Google Pay, PhonePe, or Paytm) or generate a payment QR code containing recipient and payment details. The payment provider receives those details.

PeerSplit does not hold or transfer funds, request your UPI PIN or OTP, or independently verify that a bank transfer succeeded. Recording a settlement in PeerSplit is an informational ledger entry, not proof of financial transfer. Confirm recipient details and payment status directly in your payment app.

7. Storage, Security & Backups

Local records are stored in the app's Android sandbox. Network relay connections use secure WebSockets (WSS), and group payloads use application-level encryption. No security system can guarantee protection against a compromised device, leaked keys or an authorized group member copying records.

Android automatic cloud backup is disabled in the app manifest. You can explicitly create password-encrypted PeerSplit backups. These contain your private signing identity, profile, group keys and group history. Anyone with the backup file and password may recover that identity and its data. Keep them secure; Peerloom Labs cannot recover a lost backup password or a lost identity.

8. Retention, Deletion & Your Choices

Local information remains until removed through the app, cleared in Android settings, or removed when uninstalling. To remove this installation's data and local identity, use Android Settings > Apps > PeerSplit > Storage > Clear storage, or uninstall the app. Delete exported files, backups and shared copies separately from their destinations.

Deleting a local group does not erase other members' devices or public relay copies. Edits and voids update the ledger's effective state while retaining signed history. Peerloom Labs cannot perform a global deletion of this distributed history or recover copies held by others.

9. Children & Audience

PeerSplit is intended for people aged 13 and above, with initial availability planned for India and global release tracks. The app does not verify a user's age. Peerloom Labs does not knowingly solicit children's personal information for marketing. Avoid entering children's personal information in shared group records. For concerns about a child's information submitted directly to Peerloom Labs, contact the privacy email below.

10. Contact Information

For questions about this privacy policy, data practices, or support requests, please contact: