Privacy Policy

1. Controller

The controller of your personal data is NoExceptions Bartosz Ładniak, a sole proprietorship registered in Poland. The address and registration numbers are shown at the top of this page.

For anything related to your personal data, write to help@spendwithfriend.com. We have not appointed a data protection officer.

2. What data we process, why and on what legal basis

Your account

Your email address, your password (we store only a cryptographic hash of it, never the password itself), your name, your preferred language, the date of registration and of confirming your email address, the date and version of the Terms of Service and Privacy Policy you accepted, and the date and version of the latest notice about changes to them that you were shown.

We use this data to create and run your account, let you log in, send you the confirmation link and other messages about your account, and provide the Service in line with the Terms of Service. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). We keep the record of your acceptance of the Terms to be able to prove it: Art. 6(1)(f) GDPR (our legitimate interest).

Signing in with Google or Apple

Where the Service offers it, you can create an account or sign in with your Google or Apple account instead of a password. Google or Apple then send us your name, your email address and an identifier of your account with them; we do not get your Google or Apple password. If you choose to hide your email address when signing in with Apple, we get an address created by Apple that forwards our messages to you. For a Google Workspace account we also get the domain of your organisation, which we use only to check whether Google confirms your email address. Google also sends a link to your profile photo; we do not store or use it. We use this data to create your account and let you sign in.

If an account with the same email address already exists, we connect your Google or Apple sign-in to it and send you an email that we did. When Google cannot confirm that the address still belongs to you (for example an address in a domain that is not managed by Google), we do not connect it automatically: we first ask you to log in with your email and password. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (our legitimate interest in the security of your account).

Signed-in devices

For each device on which you stay signed in to the app: the device model name reported by the app (for example "iPhone 15"), the time you signed in and when the session expires. The session key itself is stored only as a cryptographic hash. We use this data to keep you signed in, to protect your account and to let you see your signed-in devices and sign them out in your account settings. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (our legitimate interest in the security of your account).

Profile and wallets

Data you may add in your settings: your phone number and your wallets, i.e. the wallet type (for example Revolut or BLIK) and its number or tag (for example a Revolut username or a phone number used for BLIK), your bank account number, and the identifiers of other settlement methods. We use it to show the members of your groups how they can pay you back. Legal basis: Art. 6(1)(b) GDPR. Adding it is optional.

Groups, expenses, payments and lists

The groups you create or join, your membership and role in them, expenses (name, amount, who paid and how it is split), payments between members and their confirmations, balances, shopping list items, invitations and join links, and the dates of these entries. We use it to provide the main features of the Service. Legal basis: Art. 6(1)(b) GDPR.

Travel notes

What the members of a group save in its travel note: trip dates and destinations, accommodation (name, dates, link and details), trip plans (what, when and a note), links with descriptions and quick notes, the identifiers of places picked from Google Maps, the code of the airport LOT flies to nearest to each destination, and the dates of these entries. We use it to let the members of the group plan their trip together. Legal basis: Art. 6(1)(b) GDPR.

Members can also attach files to a travel note, for example reservations and booking confirmations, plane, train or bus tickets, museum and event tickets, and confirmations of accommodation and of car or other vehicle rentals. Such files often contain the names of travellers, booking numbers, dates, prices and sometimes contact details, seat numbers or document numbers, also of people other than the member who added the file. With each file we store its name, type and size, the member who added it and the date it was added. Files are visible to all members of the group. We use them only to let the group keep its travel documents in one place; we do not read, analyse or share their content. Legal basis: Art. 6(1)(b) GDPR, and for the data of other travellers contained in the files Art. 6(1)(f) GDPR (the legitimate interest of the group in organising the trip together).

Place search

When you type a place in a travel note (for example a destination), the Service suggests matching places from Google Maps. For this our server sends Google the text you typed (once it has at least 3 characters), the language of the Service and a random identifier of the search; it does not send your name, email address or IP address. If you pick a suggestion, we save the Google identifier of that place with the entry, so that it can be opened in Google Maps. We do not save the coordinates of places. Legal basis: Art. 6(1)(b) GDPR. You do not have to use the suggestions; you can always type a place yourself.

People invited or added by users

When a user invites someone by email, we process that person's email address and send them an invitation. A user can also add a group member by a nickname only, for example someone who does not have an account yet. In these cases we get the data from the user who entered it.

We use it to deliver the invitation and to let the group keep its shared records. Legal basis: Art. 6(1)(f) GDPR (the legitimate interest of the users and of the Provider in using the group features). A person who has not created an account can ask us to delete their data at help@spendwithfriend.com.

If an invitation is declined after the invited person was already included in expenses or payments, we delete their email address from the invitation but keep a nickname based on their name or on the part of their email address before "@" on those entries, so that the balances of the group stay correct.

Partner offers (affiliate links)

Where the Service offers partner offers (see the Terms of Service): your confirmation that you are at least 16 years old, whether you have turned partner offers on or off, the dates of these choices and the version of the information you were shown. We use this data to open partner offers only for people who have agreed to them and confirmed their age, and to be able to prove it. Legal basis: Art. 6(1)(a) GDPR (your consent) for opening partner offers for you and passing your search to CJ and the partner, and Art. 6(1)(f) GDPR (our legitimate interest in being able to prove consent) for keeping the record of your choices.

When you open a partner offer, your browser goes through the servers of CJ Affiliate (see "Who can see your data") to the partner's website. CJ and the partner then receive directly from your browser: your IP address, information about your browser and device, cookie identifiers, the time of the click and the address of the page you came from, and, if you buy or book something, information about the order (for example its number, value and time). They use it to recognise that the purchase came through us and to calculate our commission, to prevent fraud, and for the other purposes described in their own privacy policies.

For hotels and holiday homes, a partner link contains the search: the destination, the dates, and the number of adults, children (with their ages) and rooms. They are filled in from the group's travel note, and you can change them before opening the offer. For flights with LOT Polish Airlines, the link opens LOT's page for the airport nearest to the trip's destination (or LOT's home page) in the lot.com country version that matches your departure airport (if you have not chosen one, the language of the Service; otherwise the UK version in English); it contains no dates or numbers of travellers. For car rental and flights on Booking.com, the link contains the trip's first destination and its dates; for car rental also the destination's map location, which our server looks up from the Google place identifier when you open the offer and keeps only in its memory, for up to 30 days, without saving it; for flights your departure airport, the airport nearest to the destination and the number of people in the group. Every partner link also contains a random identifier of the click and the name of the place in the Service where the offer was shown. Our server builds the link from these details and does not store them. We do not give CJ or partners your name, email address, account identifier or any other data of your group.

Flight offers from LOT Polish Airlines: if you choose a departure airport, we save it on your account; you can change or remove it in your settings. To decide whether to show you a LOT offer and which one, our server uses your departure airport (or, if you have not chosen one, the language of the Service) and the destination and dates from the group's travel note. We show LOT offers only for flights from Poland or to Poland. To find the airport nearest to a destination picked from Google Maps, our server sends Google the identifier of that place when the travel note is saved and receives its location; we save with the destination only the code of the nearest airport LOT flies to (within 150 km), and do not save the location. Nothing is sent to LOT or CJ until you open an offer. Legal basis: Art. 6(1)(b) GDPR for the departure airport you choose, and Art. 6(1)(f) GDPR (our legitimate interest in showing partner offers that fit your trip) for choosing which offer to show.

We record which partner offers you open: the kind of offer (for example hotels or flights), the partner, the place in the Service where it was shown and the time, linked to your account. We do not record the search sent to the partner. We use this record for our own statistics on how partner offers are used and to improve them, and we do not pass it to CJ or partners. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in running and improving partner offers). You can object to it (see "Your rights").

CJ may give us reports on clicks, purchases and commissions that do not contain your name or contact details. We use them only for our own statistics and to settle commissions with CJ. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in running and settling partner offers).

Contact form and correspondence

Your email address, your name (optional), the reason and content of your message, and our correspondence with you. We use it to answer your message and to handle complaints and requests. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in communicating with you) and, when the message concerns your account, Art. 6(1)(b) GDPR.

Technical data and security

Your IP address, the date and time of requests, the address requested, the type of browser or device, the operating system and its version, the version of the app, a pseudonymised identifier of your account, error information and failed login attempts, recorded by our servers. We use it to keep the Service secure, to prevent abuse (for example to limit the number of login attempts, registrations and messages), to find and fix errors and to prepare aggregate statistics on how the Service is used (for example the number of active users or of expenses added per day). These records are kept on our own server. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in the security, proper working and development of the Service).

Legal claims and obligations

We may also process the data above where it is necessary to establish, pursue or defend legal claims (Art. 6(1)(f) GDPR) or to comply with a legal obligation, for example to answer a lawful request of a public authority (Art. 6(1)(c) GDPR).

3. Do you have to give us your data?

Giving your email address, password and name is voluntary, but it is necessary to create an account; without it we cannot provide the Service to you. If you sign in with Google or Apple, you do not set a password with us. Your phone number and wallets are entirely optional, and so is turning on partner offers: if you do not turn them on, or turn them off, you can use the rest of the Service in the same way.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects for you or similarly significantly affect you. Calculating balances is simple arithmetic on the data entered by users.

4. Who can see your data

• Other members of your groups: your name, email address, nickname and wallets, and the expenses, payments, balances, list items and travel notes in the groups you share with them.
• People who open a group's join link: the group's name, currency and colour, and the nicknames of members who have not joined yet.
• Our service providers, who process data on our behalf and only on our instructions, as far as necessary: OVH SAS (OVHcloud), which provides our servers, website hosting, databases, file storage and email service in data centres in the European Union.
• If you have turned on partner offers and open one: CJ Affiliate, that is Epsilon International UK Ltd (1st Floor, 2 Television Centre, 101 Wood Lane, London W12 7FR, United Kingdom) and Commission Junction LLC (United States), part of Publicis Groupe, and the partner whose offer you open (for example Booking.com or Polskie Linie Lotnicze LOT S.A.). They process the data described in "Partner offers" as independent controllers under their own privacy policies, not on our behalf. CJ's privacy policy: www.cj.com/legal/privacy-policy-services-uk.
• Public authorities and courts, when the law requires us to disclose data.

The login page of the website loads the sign-in service of Google Ireland Limited as soon as it opens, so that it can show its sign-in button; Google then receives your IP address and information about your browser and may read its own cookies to show which Google account you can continue with. The sign-in service of Apple Distribution International Ltd. is loaded only when you click "Continue with Apple", and Apple then receives the same kind of information. If you sign in with Google or Apple, they also learn that you are signing in to SpendWithFriend. They process this data as independent controllers under their own privacy policies, not on our behalf.

Place search in travel notes uses Google Maps Platform, provided by Google. Google receives the text typed into a place field, the language and a random identifier of the search (see "Place search") and processes them as an independent controller under the Google Privacy Policy (policies.google.com/privacy). The map icon next to a picked place opens Google Maps; Google then processes your data under its own privacy policy, as on any other visit to Google Maps. For flight and car rental partner offers, Google also receives the identifier of a trip's destination place and returns its location (see "Partner offers").

We do not sell your data, do not give advertisers or partners your account, profile or group data and do not use it for marketing. When you open a partner offer, CJ and the partner receive only the data described in "Partner offers".

5. Transfers outside the European Economic Area

We store and process your data in the European Economic Area and do not transfer it outside it, except as described in this section. The text typed into place search in travel notes is sent to Google (see "Who can see your data"), which may process it outside the European Economic Area, for example in the United States. Google relies on the EU–US Data Privacy Framework and on the standard contractual clauses approved by the European Commission. If anything else changes, we will make sure an appropriate safeguard required by the GDPR is in place and will update this Policy.

If you open a partner offer, CJ processes the data described in "Partner offers" in the United Kingdom, for which the European Commission has adopted an adequacy decision, and may transfer it to Commission Junction LLC in the United States on the basis of the standard contractual clauses approved by the European Commission (www.cj.com/legal/model-clauses). Partners may also process data outside the European Economic Area under their own privacy policies.

When you download the mobile app from the App Store or Google Play, or sign in with your Google or Apple account, Apple or Google process your data as independent controllers under their own privacy policies. They may transfer it outside the European Economic Area, for example to the United States, using the safeguards described in those policies.

6. How long we keep data

• Account, profile and group data, including travel notes: as long as you have an account. After the account is deleted, we delete or anonymise the data within 30 days. Entries in shared groups (for example expenses and payments) may remain in anonymised form, no longer linked to you, so that the other members' balances stay correct.
• Accounts whose email address has not been confirmed: they may be deleted 30 days after registration.
• Signed-in devices: until the session expires, which is at the latest 90 days after the app last used it and 180 days after you signed in; then the record is deleted. A session you sign out of or sign out remotely is deleted 30 days later.
• Invitations: until they are accepted, declined or withdrawn, or the group is deleted.
• Files attached to travel notes: until a member of the group deletes them or the group is deleted. If you delete your account, the files you added to a group stay available to its other members, like the other entries of the group; you can delete them yourself before deleting your account.
• Contact messages and complaints: as long as needed to handle the matter, and then until any claims related to it become time-barred.
• Record of accepting the Terms: as long as the account exists, and then until any claims become time-barred.
• Your age confirmation and partner offer choices: as long as you have an account; after you turn partner offers off or delete your account, the record of your earlier choices until any claims become time-barred, so that we can prove your consent.
• Records of the partner offers you open: up to 2 years after you open the offer; if you delete your account, we delete or anonymise them within 30 days.
• Your departure airport for flight offers: until you change or remove it, or delete your account.
• Data that CJ and partners collect when you open a partner offer: for the periods set out in their own privacy policies.
• Technical logs: as a rule no longer than 30 days, unless they are needed to investigate a security incident.

If the Service is closed, all data may be deleted, as described in the Terms of Service.

7. Your rights

Under the GDPR you have the right to:

• access your data and get a copy of it (Art. 15);
• have your data corrected (Art. 16);
• have your data deleted (Art. 17);
• restrict processing (Art. 18);
• data portability, i.e. receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller (Art. 20);
• object, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21);
• withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7(3)); you can do it by turning off partner offers in your settings.

You can change your name, phone number, language and wallets yourself in "Your settings". To use any other right, write to help@spendwithfriend.com, preferably from the email address of your account. We will answer within one month; in complex cases we may extend this by two more months, and we will tell you so. We may ask you to confirm your identity. For data processed by CJ or partners, you can also exercise your rights directly with them, as described in their privacy policies.

You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You may also complain to the supervisory authority of the EU country where you live or work.

8. Storage on your device and cookies

Neither the website nor the mobile app uses cookies or other tools of its own for advertising, analytics or tracking, and neither contains third-party trackers. The website keeps in your browser's local storage only what is necessary to provide the service you asked for:

• ftt_auth_token and ftt_auth_token_expiration: your login session; removed when you log out;
• ftt_selected_group_id: the group you selected;
• ftt_language: the language you chose;
• ftt_pending_join_token: a group join link you opened before logging in; removed once it has been used.

The mobile app keeps in your device's secure storage (Keychain on iOS, Keystore on Android):

• your login session, so that you stay signed in; removed when you log out;
• the theme and the group colour setting you chose.

Because these items are strictly necessary for the service you requested, the Polish Electronic Communications Law does not require your consent for them. You can delete the website's items at any time in your browser's settings, and the app's items by logging out or deleting the app; you will then be logged out.

The sign-in buttons of Google and Apple on the login page (and, for accounts without a password, in the account deletion step) are provided by Google and Apple. They connect to their servers, and Google may use its own cookies there, under their own privacy policies (see "Who can see your data"). We do not get access to these cookies.

If you have turned on partner offers and open one, it opens in your browser (in the mobile app, possibly in the browser built into the app). There CJ and the partner set their own cookies or similar identifiers on their own websites, so that they can recognise that a purchase came through us. We do not place or read these cookies. You can delete them in your browser settings; CJ describes how to opt out in its privacy policy. We ask for your consent before the first partner offer opens for you (see "Partner offers").

9. Security

We protect your data with appropriate technical and organisational measures, among others: encrypted connections (HTTPS), storing passwords only as hashes, limiting login attempts, emailing you when a new sign-in method is added to your account, asking you to sign in again before your account is deleted, and restricting access to servers and databases to authorised persons. No system is completely secure, so please also look after your password and devices.

10. Children

The Service is meant for people aged 13 and over. A person under 18 may use it only with the consent of a parent or legal guardian. If you believe a child under 13 has created an account, write to help@spendwithfriend.com and we will delete it. Partner offers are only for people aged 16 or over who confirm their age; if we learn that someone under 16 has turned them on, we will turn them off.

11. Changes to this Policy

We may update this Policy, for example when the Service or the law changes. The current version is always available on this page, with the date it applies from. We will tell registered users about important changes by email or in the Service.

This Policy is available in Polish and English. If the two versions differ, the Polish version prevails.