Privacy Policy

untilt · Last updated 26 July 2026

untilt is a free, local-first bill-splitting app. It has no accounts, no analytics, no telemetry, no advertising, and no third-party tracking. Your data lives on your device; when you share a group, its contents are end-to-end encrypted before they sync. A little connection data (a push token, your device's IP address) is necessarily visible to the services that carry the traffic, as any networked app requires. This policy explains exactly what is handled and why.

What we don't do

Data stored on your device

Your groups, expenses, balances, members, and settings live in a database on your phone, encrypted at rest (SQLCipher). The encryption key is held in your device's platform secure storage (Android Keystore / iOS Keychain) and never leaves the device. When you share a group, an end-to-end-encrypted copy of its history is also held by the relay so other members can sync (see below) — the relay can never read it; only group members' own devices can decrypt it.

Syncing with other group members

When you share a group, its activity syncs between members through a relay server (a Cloudflare Worker). Every item is end-to-end encrypted on your device before it is sent: for group content the relay only ever stores and forwards opaque ciphertext it cannot read. It also keeps the push tokens described below (so it can route notifications) — but no readable group, expense, or member data. The group's decryption key travels only inside the invite link's URL fragment (#…), which browsers and servers never receive.

Push notifications

When you use a shared (synced) group, untilt registers an opaque device token with the relay via Google Firebase Cloud Messaging (FCM) so it can send a nudge when there's new activity. These nudges are content-free — they carry no names, amounts, or message text, only a signal to wake the app and sync. The token is registered to keep this background sync reliable: the app asks for notification permission for the visible alert, but the background token is registered for your synced groups whether or not you allow notifications. If you'd rather no token be registered at all, use untilt offline (don't sync a group); you can also turn off notification display any time in your device settings. Google's handling of FCM tokens is covered by the Firebase Privacy and Security terms.

Receipt scanning

When you scan a receipt, the photo and its recognized text are processed entirely on your device (on-device OCR). They never leave your phone and are never uploaded or saved into your groups — only the structured line items you choose to add become part of the group, and those sync as encrypted data like everything else. (A camera capture may remain in the app's temporary cache until the system evicts it; it is never uploaded or added to your data.)

Exchange rates

For multi-currency groups, untilt fetches public exchange-rate data from third-party rate providers. The request carries only currency codes (and, for a backdated expense, the date being converted) — no account, group, or amount data — though, as with any direct web request, the provider necessarily sees your device's IP address.

Cloud key backup

On iPhone and iPad you can turn on cloud key backup, which is off unless you choose it. With it on, your identity key, your group keys, and the settings that live only on your device — your saved categories and payment methods (including any payment handles), language, theme, favourite currency, whether groups are shown in it, archived groups and the last currency you used in each group — are kept in your iCloud Keychain, which Apple end-to-end encrypts so that Apple cannot read it. Unlike the Android version below, this is continuous rather than setup-only: a group you join on one device appears on your others, and a new iPhone picks them up during setup. Deleting works the same way round — a group you delete is deleted on your other Apple devices too, as each one next opens the app. That reaches only your own devices: the other members keep their copies, as described under "Deleting your data" below. It carries no bills or balances: those come back from the relay. Two things deliberately stay on the device whatever you choose — the key that encrypts the app's database, and the small index the app keeps so notifications can name what happened, which contains group and member names and expense descriptions. Turning the setting off stops further items from being placed in iCloud, but leaves the ones already there: unlike the Android copy below, that item is shared by your Apple account rather than owned by one phone, so removing it would also take it away from your other devices, which may still be relying on it. To clear it you would turn off iCloud Keychain in your device's system settings, which removes it for all of them at once.

On Android you can turn on cloud key backup, which is off unless you choose it. With it on, a copy of your identity key (and a short list of keys it has replaced, so the people you already are in your groups still resolve to you), your group keys, and the settings that live only on your device — your saved categories and payment methods (including any payment handles), language, theme, favourite currency, whether groups are shown in it, archived groups and the last currency you used in each group — is placed in your Google account's backup so a new phone can restore during setup. It carries no bills or balances: those come back from the relay. The copy is end-to-end encrypted by Google's Block Store using your device screen lock — which is why untilt will not enable it without one — so Google holds ciphertext it cannot read. Turning the setting off asks Google to delete that copy and stops any further upload; both steps are best-effort, and the app retries the withdrawal on each later launch. With the setting off, no copy of your keys goes to your Google account. They still leave the device in the two ways you choose directly: a recovery code you export yourself, and — for one group at a time — the group's key inside an invite link you share, which travels in the link's #… fragment as described above.

Deleting your data

Uninstalling untilt deletes its on-device database. The keys — and, on iPhone and iPad, the saved categories and payment methods described above — can outlive it: on Android the keys are also held by Google Play services' Block Store, which is designed to survive an uninstall and reinstall (and, if you turned on cloud key backup, to reach a new device); on iOS they live in the system Keychain, which can likewise survive an uninstall — and, if you turned on cloud key backup there, in your iCloud Keychain, which you can clear from the system settings. In both cases reinstalling may restore your groups until those entries are cleared. Because the relay only holds encrypted ciphertext keyed by a random group id and expires idle groups automatically, there is no personal account to close.

Deleting a single group erases everything untilt holds about it on your device, and — on iPhone and iPad with cloud key backup on — on your other Apple devices as each one next opens the app. It does not reach the other members: there is no account to delete from, so their copies stand and the relay's encrypted copy stays until its own idle expiry. Rejoining from a fresh invite would bring the group back.

Children

untilt is not directed to children and does not knowingly collect personal information from them. As described above, it builds no personal-data profile of any user; the only data it handles are the group contents you create (end-to-end encrypted) and the connection metadata — a push token and your IP address — needed to sync and notify.

Changes to this policy

If this policy changes, the updated version will be posted here with a new "last updated" date.

Contact

Questions about privacy? Email privacy@letsuntilt.app.