Split Boss Logo
Split Boss India
Back to App
Official Policy Effective: October 24, 2026

Privacy Policy

Your privacy, data rights, and financial security are the cornerstone of Split Boss. This policy explains what information we collect, how it is stored, and how your payments are handled.

Zero-Financial-Storage Architecture

Split Boss is an expense tracking and balance settlement utility. We are not a bank, wallet, or payment aggregator. We never collect, store, or have access to your bank accounts, debit/credit cards, UPI PINs, CVVs, or OTPs. All settlements occur peer-to-peer via official, NPCI-regulated UPI applications (such as Google Pay, PhonePe, Paytm, or BHIM) installed directly on your personal device.

1 Information We Collect

To provide accurate group debt tracking and collaborative expense calculation, we collect only the minimum required information:

Account Profile

Your display name, email address, optional mobile number (E.164 format), and a cryptographically hashed password (via salted Bcrypt). We never store raw passwords.

Group & Expense Records

Group titles, expense amounts (in INR), categories, split shares, settlement status, and payer records.

UPI Virtual Payment Address

Your public UPI ID (e.g., name@okhdfcbank) if you voluntarily save it to your profile so group members can trigger one-tap UPI payments to you.

Diagnostic & Security Data

IP addresses, basic device metadata (OS version, app build), and timestamps strictly for API rate limiting, session authentication, and DDoS prevention.

2 Device Permissions & Clipboard Usage

Split Boss adheres strictly to the principle of least privilege regarding device access:

  • Internet Access: Required to synchronize expenses, balances, and settlements securely with our cloud servers.
  • Clipboard Access for Invitations: When the app launches, it checks the local clipboard solely to verify if a valid Split Boss invite link (such as https://split.udhaar.store/join/...) is present. No personal, sensitive, or unrelated clipboard text is ever read, recorded, or transmitted to any server.
  • No Contacts or SMS Scraping: We do not scan your address book, read your text messages, or access personal media without explicit, real-time user action.

3 How We Handle UPI Settlements

When you tap "Settle via UPI" in Split Boss, the app formats a standard NPCI UPI Deep Link intent:

upi://pay?pa={UPI_ID}&pn={NAME}&am={AMOUNT}&cu=INR&tn={TRANSACTION_NOTE}

This deep link hands off execution directly to your preferred UPI app. The payment transaction, authentication, and UPI PIN entry take place entirely inside your secure banking app. Split Boss receives neither your transaction confirmation nor your bank credentials.

4 Data Sharing & Third-Party Disclosure

We respect your privacy and will never monetize your personal or financial data:

  • We Do Not Sell Data: Split Boss never sells, rents, monetizes, or shares user data with third-party advertisers or data brokers.
  • Group Member Visibility: Within a group you join or create, other verified members of that group can view the expenses you logged, balances owed, and settlement receipts.
  • Service Providers: Encrypted data is hosted on secure, certified cloud infrastructure solely for uptime, authentication, and database redundancy.
  • Legal Obligations: We may disclose data only if required by valid law, legal process, or court order under the laws of the Republic of India.

5 Security & Encryption

We deploy bank-grade security protocols to safeguard your account records:

  • End-to-End Transport Security: All data transmitted between the mobile application and backend APIs is encrypted using Transport Layer Security (TLS 1.3 / HTTPS).
  • Hardware-Backed Storage: Authentication tokens (JWT) are stored using encrypted Android Keystore and iOS Keychain secure hardware storage on your mobile device.
  • Bcrypt Password Protection: All user passwords are irreversibly hashed using multiple salt rounds before database persistence.

6 Account & Data Deletion (User Rights)

Under India's Digital Personal Data Protection Act (DPDPA 2023) and Google Play Developer Policies, you retain complete sovereignty over your information:

Request Full Account & Data Deletion

You may request complete and permanent deletion of your account, personal details, and associated group memberships at any time. Upon receiving your verified request, all personal identifiers, email associations, and profile records are expunged from our active databases within 14 business days.

Submit Online Deletion Request Request via Email

7 Children's Privacy

Split Boss is intended for individuals aged 18 and older, or minors who have received consent from a parent or legal guardian to participate in shared family expenses. We do not knowingly collect personal data from children under 13 years of age.

8 Grievance Officer & Contact Information

In accordance with the Information Technology Act, 2000 and the Rules made thereunder, the Grievance Redressal contact details for Split Boss are provided below: