Privacy notice · September 19, 2026

DivvyUp Privacy Notice

This notice explains the information DivvyUp uses to provide shared-expense features, communicate with you, protect accounts, and preserve accurate shared records.

Information we use

We use identity information supplied by your sign-in provider, such as your verified email address and name, plus Events, recurring contexts, protected guest contacts, Expenses, receipt files and extracted merchant details you choose to save, funding facts, allocations, reviews, corrections, and private friend rankings derived from your own shared-Expense history. If you choose text messaging, we also use the Canadian phone number you submit, its verification state, versioned SMS consent, quiet-hours preference, suppression state, and delivery status. We use native-notification installation details, optional approximate location for an active nearby-business search, and limited security and diagnostic metadata.

Why we use it

We use this information to authenticate you, provide private group features, read receipts at your request, find businesses you ask us to search for, deliver invitations and optional reminders, honour messaging choices, secure the beta, and troubleshoot problems. We do not use receipt extraction, Places, email, SMS, or push delivery to authorize or move money.

What we do not ask for

DivvyUp will not ask for your online-banking password, collect a card number or security code in the current shared-expense application, or sell personal information. Final who-owes-whom records do not grant payment authority and cannot be collected by DivvyUp. The current beta does not collect identity documents or know-your-customer (KYC) records. Before payment processing begins, DivvyUp will publish a separate payment-data notice and retention decision. The intended baseline is to keep only required KYC evidence for at least 90 days after account closure, and longer only where law, fraud, dispute, or provider obligations require it.

Receipts, Places, and Google processing

When you ask DivvyUp to read a receipt, its private file may be held for up to 24 hours so extraction can continue while you configure the Expense, leave the screen, or briefly lose connectivity. The app may keep multiple signed-in-session Expense drafts and their receipt copies on your device for up to 24 hours after their last edit; you can open or delete them from Expenses. DivvyUp uses Vertex AI Gemini in a Canadian Google Cloud region to produce suggestions. Suggestions remain drafts until you confirm them; extraction never changes an Expense or split by itself. Abandoned pending files are deleted at expiry, and completed extraction inputs are deleted after processing unless you separately attach the original receipt to an Expense.

If you explicitly request place search or a receipt-business match, Google receives the place text you entered or seller and address text extracted from that receipt, plus a temporary search-session identifier. If you separately choose Use approximate location and grant foreground permission, DivvyUp sends Google coordinates rounded to two decimal places solely to rank the active search toward nearby businesses. DivvyUp does not save those coordinates or add them to the Expense and retains only the selected Google Place ID, not Google's prediction list, address, or coordinates. Google processes this information under its privacy policy.

Email, text messages, and push notifications

Resend processes the verified recipient address and minimal fixed-template content for approved transactional email; Firebase separately handles authentication email. Resend processes email data outside Canada and stores account data, email metadata, and logs in the United States. Its retention is separate from DivvyUp's pending-email limit; deleting your DivvyUp account does not recall delivered messages. DivvyUp retains encrypted pending email data for no more than seven days and keeps keyed address hashes where needed for bounce, complaint, and suppression enforcement.

Twilio Verify processes a Canadian phone number to send and check a one-time verification code. Verification proves control of the number but does not enable reminders. If you explicitly enable SMS reminders, or if someone who knows you authorizes one expected guest invitation, Twilio Messaging receives the destination and fixed message content needed to deliver it. Reminder templates contain no amount, merchant, receipt, payment status, or free-form message. Twilio also returns delivery status and signed STOP, START, and HELP replies so DivvyUp can enforce your choice. DivvyUp stores phone numbers and pending SMS payloads encrypted, uses separate keyed digests for lookup and suppression, and scrubs sensitive pending content after a terminal outcome or within seven days. Twilio processes this information under its privacy notice. Firebase Cloud Messaging receives a native installation token and a generic “open DivvyUp” notification; lock-screen content does not include group names, merchants, contacts, receipts, or amounts.

Retention, security records, and deletion

When you remove an attached receipt before finalization, its private file is deleted and no longer available to the group; limited integrity and audit metadata may remain. Private profile, phone, device, ordinary pending-message, and protected-contact data are removed when an account is deleted. Bounded account-deletion status messages may remain encrypted for up to seven days. Keyed suppression records may remain where needed to honour STOP, bounce, or complaint choices and prevent unwanted re-sending. Delivered email and SMS cannot be recalled from recipient devices or provider systems.

Finalized shared financial records are anonymized and retained only where needed to keep other participants' records accurate or for financial, tax, fraud, legal, or security obligations. Limited security logs may retain an IP address, request metadata, correlation identifier, or keyed account pseudonym for incident detection and investigation; they do not contain receipt images, message bodies, invitation tokens, or payment credentials. Immutable deployment, canary, and recovery evidence is designed not to contain personal data. Account deletion does not rewrite legitimate security records, delivered messages, or bounded backup copies, but those records are not used to recreate a deleted profile.

Your choices

You can deny or revoke foreground location access and continue searching businesses using receipt or typed text. You can turn off optional application-activity and reminder email, push notifications, and SMS reminders. Removing your phone number withdraws SMS consent and cancels pending texts; replying STOP also suppresses future SMS, and START restores reminders only when your prior consent is still current. Essential invitation, security, and account-lifecycle email may remain on. You can ask to access or correct your information by emailing support@quoropay.ca. You can also request account deletion and check its progress online, without requiring the installed app. Required retained records no longer display your original name, email, phone number, avatar, authentication identifier, or legacy payment references.