Privacy policy
Privacy policy
Last updated 15 November 2026
The short version
- No accounts, no logins, no phone numbers, no email addresses.
- Your trips, names, expenses and UPI IDs are stored on the phones in the trip. They are never stored on a SplitWagon server.
- No ads, no trackers, no cookies, no analytics on this website or in the app.
- The only data we can receive is an optional, anonymous count that you must switch on yourself.
What stays on your phone
SplitWagon keeps everything about a trip in your browser's storage on your device: the trip name, the people's names, expenses, payments, UPI IDs you or your friends enter, and the keys that sign and protect the trip. We have no copy and no way to see it, recover it or delete it for you.
Because of this, a lost or wiped phone means lost trips unless you made a backup. Backups are encrypted on your phone with your passphrase (Argon2id and AES-GCM) before the file is saved. We never see the file or the passphrase and cannot recover it.
How phones talk to each other
Phones in a trip sync directly with each other over an encrypted peer-to-peer connection (WebRTC). Trip data sent this way is encrypted with a random trip key that only approved phones receive. To find each other, phones use two kinds of public service:
- Public Nostr relays pass short connection messages so two phones can meet. The messages are sealed with the trip key and signed with a throwaway key, and do not contain the invite secret in plain text. The relays we use are relay.primal.net, relay.snort.social, nostr-pub.wellorder.net and relay.nostr.net. They are run by other people, not us.
- STUN servers (stun.cloudflare.com and stun.l.google.com) help phones work out how to reach each other. They are told your phone's public IP address, which is how any internet connection works.
These services can see your IP address when your phone contacts them. They do not receive your trip data. We don't run them and can't control their own logging. See their own policies for details.
If a live connection fails you can share a sync update as a link or QR code. It is encrypted, and its secret sits after a # in the link, so browsers never send it to a server.
This website and the app's hosting
Both are static files served by Cloudflare. We set no cookies and run no analytics or advertising scripts. We load no third-party scripts, fonts or images: even the Outfit font is served from our own files. Like any web host, Cloudflare processes technical request data such as your IP address to deliver pages and protect against abuse, under Cloudflare's privacy policy. We don't have access to a log of who opened the app.
Invite and sync-update secrets are kept after the # in a link. Browsers do not send that part to the server.
Optional anonymous counts
Settings has a switch, off by default, for sending anonymous counts. If you turn it on, after each live connection attempt the app sends exactly one word to a small Cloudflare Worker we run: connect-ok or connect-failed. The Worker stores that word as one data point. It does not read the request headers, and it stores no trip data, names, phone IDs or IP addresses. We use the totals to decide whether sync needs improving. The request still passes through Cloudflare's network like any web request. Turn the switch off and nothing is sent. Without it, the app sends nothing.
Camera, UPI and links
- Camera. Used only to scan an invite or sync-update QR code. Images are processed on your phone and never leave it. You can decline the permission and paste a link instead.
- UPI. Pay opens your UPI app with the receiver's UPI ID, amount and a note. The payment happens in your UPI app under its own terms. SplitWagon cannot see whether a payment went through. Only your “I paid” and “Got it” taps record it.
- Outside links. Any link that leaves SplitWagon, such as a Buy me a coffee page, is a normal link. Opening it sends us nothing, and the site you open follows its own policy.
Who can see a trip
Everyone you approve into a trip can see all of it, including each person's name, balance and UPI ID, and can edit any expense. The organiser approves every phone and can cut off a phone. Cutting off a phone stops its future changes being accepted, but it can't erase data that phone already holds. Only approve people you trust.
Your choices and control
You are in control of your data because you hold it. You can edit or delete expenses, remove a person where balances allow, archive a trip, or delete a trip from your phone (this removes it from that phone only; other phones keep their copy). Clearing your browser's site data deletes everything SplitWagon stores on that phone. Because we hold no personal data about you, there is nothing for us to export or erase on a server.
Children
SplitWagon is for general audiences and collects no personal information from anyone, including children.
Changes to this policy
If the way SplitWagon handles data changes, we'll update this page and its date before the change ships. Anything that would send trip data off your phone would be a major change, and we do not plan it.
Contact
Questions about privacy: [YOUR CONTACT EMAIL]