Privacy Policy

Effective 20 October 2026 · Applies to the TripLedger Android app and trip-ledger.shantanu.tech

1. Who we are

TripLedger is developed and operated by Shantanu Jain, an individual developer based in India (“we”, “us”). For the EU and UK General Data Protection Regulation (GDPR) and India’s Digital Personal Data Protection Act, 2023 (DPDP Act), we are the controller (data fiduciary) of the personal data described in this policy.

Contact for all privacy matters, including our Grievance Officer: tripledger@shantanu.tech.

When you share a trip, the other members of that trip can see the trip’s data. Each member is responsible for what they choose to add to a shared trip, including names of other people.

2. What we collect and why

2.1 Data that stays on your device

Everything you create in TripLedger, such as trips, people, expenses, splits, settlements, payment-method labels and receipt photos, is first saved in the app’s private storage on your phone. If you never sign in, this content never leaves your device, and uninstalling the app deletes it. App preferences (default currency, theme, whether usage statistics are on) are also stored only on your device.

2.2 Data we process when you use the app

2.3 What we don’t collect or do

• We don’t access your precise location, contacts, SMS, calls or files other than photos you choose to attach.
• We don’t show ads, use advertising IDs, or track you across other apps or websites.
• We don’t sell or rent your personal data, and we don’t “share” it for cross-context behavioural advertising.
• We don’t make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.
• Exchange rates are fetched by our server from a public rates service. No personal data is sent to it.

Please don’t put sensitive information (for example health details or ID numbers) in expense descriptions or receipt photos. If a receipt contains such information, you can crop it or leave the photo out.

3. Legal bases (GDPR)

If you’re in the European Economic Area, the UK or Switzerland, we rely on these legal bases under Article 6 GDPR:

• Performance of a contract (Art. 6(1)(b)): your Google account details, trip content, receipt photos and invites, to provide the sync, backup and sharing features you ask for.
• Consent (Art. 6(1)(a)): usage statistics. Because they rely on storing an identifier on your phone, we also need your consent under Art. 5(3) of the ePrivacy Directive (and the equivalent UK and Swiss rules). They stay off until you choose Allow, and you can withdraw consent at any time by turning off Settings → Share usage analytics.
• Legitimate interests (Art. 6(1)(f)): crash reports and technical logs, for our interest in keeping the app reliable and secure. We’ve balanced this against your interests: we limit what is collected and exclude trip content. You can object, as described in Your rights.
• Legitimate interests for the names of other people that members add to a shared trip, so the group can record who paid and who owes what.
• Legal obligation (Art. 6(1)(c)): where we must keep or disclose data to comply with the law.

Outside the EEA, the UK and Switzerland, we collect usage statistics based on our legitimate interests in understanding which features are used and improving the app. We limit what is collected, exclude trip content, and let you turn them off at any time in Settings → Share usage analytics.

Under the DPDP Act, we process personal data for the specific purposes above, based on your consent when you use and sign in to the app, and for legitimate uses permitted by the Act. You can withdraw consent at any time; withdrawal doesn’t affect processing that happened before it.

4. Who we share data with

Other members of your trips. When you join or share a trip, its members see the trip’s content, including your display name and the expenses and receipts on that trip.

Service providers (processors) who process data on our behalf under contracts that require them to protect it and use it only to provide their services to us:

Legal and safety reasons. We may disclose data if required by law, court order or a valid request from a public authority, or where necessary to protect the rights, safety or property of our users, the public or us.

Change of ownership. If TripLedger is transferred to someone else, your data may be transferred as part of that transfer, and this policy will continue to apply to it unless you’re notified otherwise.

5. International transfers

Your synced data is stored in India, and some of our providers process data in the United States and other countries. These countries may not have data protection laws equivalent to those where you live. Where GDPR applies, we transfer data from the EEA, UK or Switzerland only using appropriate safeguards, mainly the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant) in our providers’ data processing agreements, or, for US providers certified under it, the EU-US Data Privacy Framework. You can ask us for more information about these safeguards.

6. How long we keep data

• On your device: until you delete it in the app or uninstall the app.
• Account and trip content: for as long as you have an account. When you delete a trip, expense or receipt, it’s hidden immediately and marked as deleted. We keep a record of that deletion so it reaches the devices of other trip members, including ones that were offline. Receipt photos are removed from storage once they’re deleted.
• After you delete your account: see Deleting your account.
• Usage statistics: up to 12 months, then deleted.
• Crash reports: 90 days (Firebase Crashlytics’ retention period).
• Technical logs: generally no more than 30 days.
• Backups: our database provider keeps automatic backups for a short period, after which they’re overwritten. Deleted data may remain in a backup until it rolls off.

We may keep data longer if the law requires it or to establish, exercise or defend legal claims.

7. Deleting your account

You can delete your TripLedger account and its associated data at any time, in either of two ways:

• In the app: while signed in, open Settings → Delete account and confirm. You need an internet connection. The deletion happens straight away, and the app then signs you out and erases everything stored on that phone, including changes that hadn’t synced yet. You can keep using the app without an account afterwards.
• By email: email tripledger@shantanu.tech from the Google email address you signed in with, with the subject “Delete my TripLedger account”. If you can’t email from that address, tell us the address and we’ll verify that the account is yours before deleting anything. We’ll confirm your request and complete the deletion within 30 days.

When your account is deleted, we:

• delete your account, Google sign-in link, email address, name and profile picture URL, and your payment-method labels. What remains is a random ID with no personal data attached, kept so that shared trips stay consistent;
• delete trips where you are the only member who has an account (people you added who never joined don’t count), including all their expenses, splits, settlements, receipt photos and invite links;
• in trips shared with others, remove your link to the trip and replace your name with “Deleted user”. The expenses and settlements stay so the other members’ balances remain correct, but they’re no longer linked to you. Receipts you uploaded to shared trips are deleted. Other members’ devices pick up these changes the next time they sync;
• have our analytics provider delete the usage statistics linked to your user ID, which it completes within 30 days. Crash reports aren’t linked to your user ID; they’re deleted automatically after 90 days.

If you were signed in on other phones, the copy of your data on them stays there (they can no longer sync) until you uninstall the app or clear its storage on each one. Deleted data may also remain in our database provider’s backups until they roll off (see How long we keep data).

To delete only some of your data without closing your account, you can delete individual expenses, receipts or trips in the app, or email us with what you’d like removed. Data stored only on your device is deleted when you uninstall the app or clear its storage.

8. Your rights

Depending on where you live, you may have the right to:

• Access your personal data and get a copy of it;
• Correct inaccurate or incomplete data;
• Delete your data (“right to be forgotten”);
• Restrict how we process your data;
• Data portability: receive your data in a structured, machine-readable format. You can export any trip’s expenses as CSV from the trip’s settings;
• Object to processing based on legitimate interests, including usage statistics outside the EEA, the UK and Switzerland (or simply turn them off in Settings);
• Withdraw consent where processing is based on consent, including usage statistics in the EEA, the UK and Switzerland (turn them off in Settings);
• Nominate another person to exercise your rights if you die or become incapacitated (India);
• Complain to a data protection authority (see Contact and complaints).

To exercise any right, email tripledger@shantanu.tech. We’ll respond within one month (which we may extend by up to two more months for complex requests, with notice), and we may need to verify your identity first. Exercising your rights is free, and we won’t treat you differently for doing so.

9. Region-specific information

European Economic Area, UK and Switzerland

We are based outside the EEA and UK and haven’t appointed a representative there. Please contact us directly at tripledger@shantanu.tech. You can also complain to the data protection authority where you live or work, or where you think an infringement happened. In the UK, that’s the Information Commissioner’s Office (ico.org.uk).

India

Our Grievance Officer is Shantanu Jain, reachable at tripledger@shantanu.tech. If you aren’t satisfied with our response to a grievance, you can complain to the Data Protection Board of India.

California and other US states

In the last 12 months we collected the categories of personal information described in section 2: identifiers (name, email, account IDs, IP address), internet or electronic network activity (usage statistics and logs), and other information you choose to provide (trip content and receipt photos). We use it only for the purposes in section 2 and disclose it only as described in section 4. We don’t sell or share personal information for cross-context behavioural advertising, and we don’t use or disclose sensitive personal information to infer characteristics about you. You have the right to know, access, correct and delete your personal information, and not to be discriminated against for exercising these rights. You may use an authorised agent to make a request.

10. Security

Data travels between the app and our servers over encrypted HTTPS connections, and our database and file storage are encrypted at rest. Access rules on the database ensure each trip’s data can be read and written only by that trip’s members. Invite tokens are stored only as one-way hashes. On your phone, data is kept in the app’s private storage, which Android protects from other apps. Use a screen lock to protect it if your phone is lost. No system is perfectly secure, but if a data breach affects your personal data, we’ll notify you and the relevant authorities as the law requires.

11. Children

TripLedger isn’t directed at children. You must be at least 18 years old to create an account, or the age of majority where you live if that is higher. We don’t knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we’ll delete it.

12. This website

trip-ledger.shantanu.tech doesn’t use cookies, analytics or advertising trackers. Our hosting provider records standard server logs (IP address, time, requested page, browser type) to serve and protect the site. The home page loads its typeface from Google Fonts, which means your browser sends your IP address to Google when you view it. Invite links (/i/…) only open the app or Google Play. The invite code in the link is never stored by this website.

13. Changes to this policy

We’ll update this page when our practices change and update the effective date at the top. If a change materially affects how we use your personal data, we’ll tell you in the app or by email before it takes effect, and ask for your consent where the law requires it.

14. Contact and complaints