Who we are
EvenIt is operated by Ali Asghar. Questions about this policy or your data can be sent to privacy@aliasghar.me.
What we collect
Your name, email, and the expenses and balances you create — including any notes or comments you write, the categories you make, and how you choose to split an expense line by line. If you choose to set a profile picture, we store that photo; it is optional and EvenIt works fully without one. If you add a way to be paid back — a Venmo or PayPal handle, a UPI ID, or bank details you type yourself — we store exactly what you enter so the person paying you can see it. We never ask for and never store card numbers, and EvenIt does not move money.
Scanning a receipt
When you scan a receipt, the photo is read on your phone and then discarded. The image is never uploaded and we never store it. Only the text your phone recognises is sent to us, to work out the merchant, date and amounts — and only the parts you accept are saved, as an ordinary expense with its line items. If you cancel, nothing is saved at all.
Importing from another app
If you import a file exported from another expense app, its contents are sent to us so we can show you what would be created and, if you continue, create it. Those files usually name other people. We use them only to reconstruct your shared history, we never email anyone because they appeared in an import, and we do not keep the file itself once the import is done.
How we use it
To calculate balances, show your activity, and send the account emails EvenIt needs to work — verifying your address, resetting your password, and balance reminders. We never sell your data or use it for advertising.
Balance reminders
If someone you split with has an open balance with you, you can send them a reminder and EvenIt emails them on your behalf. The email says who sent it and that a balance is open — it never includes an amount. You can send at most one reminder to the same person every 24 hours. You can turn reminders off entirely in the app (Account → Reminders), which stops anyone from sending you one, or block an individual on the Friends screen.
How we keep it secure
All traffic between the app and our servers uses HTTPS, and release builds refuse to connect over plain HTTP. Passwords are stored only as argon2 hashes — never in readable form. Sign-in tokens are held in your device’s system keychain, and on the web in cookies that JavaScript cannot read. Access to production data is limited to the people who operate the service.
Data retention & deletion
You can delete your account any time — in the app (Account → Delete account) or on this website (Delete account). Your access is revoked immediately, and within 30 days we permanently delete your name, email and password, your profile photo, your comments, your payment handles, your categories and recurring schedules, your invitations, and your activity history. We also remove your name and email from the contact lists of people who had added you. What stays is the shared ledger — the expenses and settle-ups between you and other people — because deleting those would silently change what your friends owe each other. Your name is replaced with “Deleted user” everywhere it appeared.
Why we are allowed to hold it
We process your name, email and password because we need them to give you the account you asked for — that is the contract between us. The same goes for the expenses, groups and settle-ups you record: they are the service. We keep security and abuse logs because we have a legitimate interest in the service not being broken into or misused. We do not run advertising, we do not profile you, and we do not sell or share your data with anyone for their own purposes. Where the law asks for consent — the data disclosure you accept when you first sign in — we ask for it plainly and you can withdraw it by deleting your account.
Your rights
You can ask us for a copy of the data we hold about you, ask us to correct anything wrong, ask us to delete your account, object to how we are using something, or ask us to hand your data over in a portable form. Deletion you can do yourself, immediately, in the app or on this site. For anything else, email privacy@aliasghar.me and we will respond within 30 days. If you are in the UK, EU or EEA and you think we have handled your data badly, you can also complain to your national data protection authority — but please tell us first, because we would rather fix it.
Where your data is held
Our servers and database are hosted in Europe. Two services we rely on may process your data outside your country: the email provider that sends your verification and password-reset messages, and the storage provider that holds profile photos. Both are bound by standard contractual clauses covering international transfers. Nothing else leaves our own infrastructure — in particular, a receipt photo never leaves your phone at all.
Children
EvenIt is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, email privacy@aliasghar.me and we will remove it.
Changes to this policy
If we change how we handle your data in a way that affects you, we will update the date at the top of this page and tell you in the app before the change takes effect. We will not quietly widen what we collect.
Contact
Questions about your data, or want to exercise any of the rights above? Email privacy@aliasghar.me.