Privacy policy

The controller of your data is Thecon SRL, with its registered office at Aleea Lalelelor nr. 10, Galați, Romania, registered with the Trade Register under no. J17/1962/05.12.2006, tax identification code RO19302026.

For any question or request about your data, write to us at [email protected].

Account data:

• your name and email address;
• your password, which we keep only as a cryptographic fingerprint (hash) from which the password cannot be read;
• if you sign in with Google, the identifier of your Google account, and the name and email we receive from Google;
• your profile photo, if you choose to add one;
• the language and theme you choose;
• security data: when the account was created, when the password was last changed, failed sign-in attempts and any temporary locks they cause;
• if you turn on two-step verification: the secret key of your authenticator app, kept encrypted, your recovery codes, kept only as hashes, and the devices on which you chose not to be asked for a code again.

Device data: for each device you are signed in on, we keep the IP address, the type of browser or app (user agent), the device name sent by the phone app, when you signed in and when the device was last used.

Data in shared spaces:

• space names, currency, parties (for example a family's name and number of people), members and their roles;
• expenses: date, merchant, category, amounts, tip, notes and how they are split;
• receipt photos, together with any other data printed on them;
• the amounts filled in by each member, the transfers marked as done, and who created or changed each record and when;
• invitation codes.

Communication data: a record of the automated emails we send you (address, type of message, date and delivery result, without their content) and the messages you send us.

Technical data: server logs, with the IP address, date and time, the address requested, the result of the request and the user agent. Passwords, authentication tokens and cookies are not written to these logs.

Site usage data, only if you accept analytics cookies: the pages you visit, without the identifiers of spaces, expenses or accounts, where the visit came from, the type of device and browser, the approximate country and a randomly chosen code for your browser, collected through Google Analytics. We do not send Google your name, email, amounts or the content of your spaces.

Your cookie choice: what you chose, the cookie policy version and the date. If you have an account, we also keep it on your account, as proof of consent.

If you turn on push notifications, we also process your device's notification identifier.

We do not ask for location data, phone contacts, bank details or special categories of data, such as health data. If such data appears on a receipt, cover it before you upload the photo.

We receive most data directly from you. Other members of your spaces may enter some data about you, for example your family's name or an expense you paid. We receive Google sign-in data from Google, only if you choose to sign in that way. Technical data is generated automatically when you use the service.

If a member has entered data about you in Huba Split, even if you do not have an account, you have the rights described in section 9 and you can write to us at any time.

• Creating and managing your account, signing in and the features of the service (spaces, expenses, calculations, invitations, export): to enter into and perform the contract between us, the Terms of use, under Article 6(1)(b) of Regulation (EU) 2016/679 (GDPR).
• Emails about your account (activation, password reset, notices that your password was changed, that a Google account was connected or that your account was deleted): to perform the contract and to keep your account secure.
• Security of the service (sessions, limits on sign-in attempts, technical logs, preventing abuse) and defending our rights in case of a dispute: our legitimate interest in providing a secure service, under Article 6(1)(f) GDPR.
• Data about people without an account entered by members, such as a family's name: the legitimate interest of the space's members and ours in keeping track of shared expenses, under Article 6(1)(f) GDPR.
• Answering your requests and requests from authorities: performing the contract, our legitimate interest or our legal obligations, under Article 6(1)(c) GDPR.
• Push notifications, only if you allow them in your phone settings: to perform the contract. You can turn them off at any time in your phone settings.
• Site usage statistics (Google Analytics), only if you agree through the cookie banner: your consent, under Article 6(1)(a) GDPR. You can withdraw it at any time from the Cookie settings link at the bottom of the page, without affecting what was processed before.
• Keeping your cookie choice, if you have an account: our legal obligation to be able to demonstrate consent, under Article 7(1) and Article 6(1)(c) GDPR.

We do not use data for advertising, we do not sell it and we do not build marketing profiles. We do not make decisions based solely on automated processing that produce legal effects on you or affect you in a similarly significant way. Balances are arithmetic calculations on the data entered by members, not assessments of you as a person.

We do not send you marketing emails. If we ever want to, we will ask for your consent separately.

• The members of your spaces see the content of those spaces, including your name, your profile photo, the party you belong to and what you added or changed.
• Thecon staff, only as far as needed to run the service, to provide support you ask for, for security or to meet legal obligations, and bound by confidentiality.
• The providers that help us run the service and process data only on our instructions, under contract: our hosting provider, with servers in Romania, and the provider we use to send automated emails.
• Google, if you choose to sign in with your Google account. For your Google account data, Google is an independent controller and its privacy policy applies.
• Google Ireland Limited, for the Google Analytics statistics, only if you agree, as a processor acting on our instructions.
• Public authorities, only when the law requires us to.

We do not sell or rent personal data.

Account and space data are stored on servers in Romania and we do not transfer them outside the European Economic Area. If you accept analytics cookies, Google may also process site usage data in the United States. The transfer relies on the European Commission adequacy decision on the EU-U.S. Data Privacy Framework, under which Google LLC is certified. If another provider ever processes data outside the European Economic Area, we will only use the mechanisms GDPR allows and update this policy beforehand.

• Account data: for as long as the account exists. When the account is deleted, the name, email, profile photo, password and the link to Google are removed immediately.
• Unconfirmed registrations: deleted after 30 days if the activation link has not been used.
• The activation link is valid for 24 hours and the password reset code for 15 minutes.
• Sessions, with the IP address and device data: deleted automatically after 30 days without use and, in any case, at most 90 days after signing in.
• Trusted devices for two-step verification: 30 days from when you chose them. All of them are deleted when you change your password, turn off two-step verification or delete your account.
• Two-step verification data: for as long as it is turned on. It is deleted when you turn it off or delete your account.
• The record of automated emails: 90 days from sending.
• Server technical logs: at most 30 days.
• Content of spaces: for as long as the space exists. What you added to a shared space stays there after your account is deleted, without your name, until the owner deletes the record or the space.
• Backups: at most 30 days, after which they are replaced by new backups.
• Correspondence with us: as long as needed to resolve the request and, after that, at most 3 years, to defend against possible disputes.
• Usage data in Google Analytics: 14 months, after which Google deletes it automatically.
• Your cookie choice: on your device, 6 months, after which we ask again; if you have an account, the record of your choices for 3 years, as proof of consent.

Connections to the service are encrypted (HTTPS). Passwords are kept only as hashes, sessions use short-lived tokens that can be revoked, and repeated sign-in attempts are limited. You can turn on two-step verification with a code from an authenticator app, and important actions, such as deleting the account, ask for your password again if you signed in more than 10 minutes earlier. On phones, sign-in data is kept in the system's secure storage (Keychain on iOS, Keystore on Android). Access to the servers is limited to the people who need it.

No system is completely secure. If a security breach occurs that may affect your rights, we will notify you and the supervisory authority, as required by law.

Under the GDPR, you have the right:

• to find out what data we process about you and to receive a copy of it;
• to have inaccurate data corrected; you can change some data directly in your account;
• to have your data erased;
• to have processing restricted;
• to receive the data you provided to us in a structured, commonly used format and to send it to another controller (portability);
• to object to processing based on legitimate interest;
• not to be subject to a decision based solely on automated processing;
• to lodge a complaint with the supervisory authority.

To exercise your rights, write to us at [email protected], preferably from your account's email address. We reply within one month; for complex requests this can be extended by two more months, in which case we will let you know. Exercising your rights is free. We may ask for additional information only if we need to confirm your identity.

The supervisory authority in Romania is the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, postal code 010336, Bucharest, www.dataprotection.ro, [email protected].

You can delete your account at any time, from the Account section of the app or by writing to us at [email protected].

If you own spaces, you first need to transfer them to another member or delete them. On deletion, we immediately remove your name, email, profile photo, password and the link to Google, and we end all your sessions. Expenses and transfers you added to shared spaces remain visible to the other members, without your name, so that their balances stay correct. We then send you an email confirming the deletion.

Removed data may remain in backups until they are replaced, and your email address remains in the record of sent emails until its 90 days have passed, as described in section 7.

Huba Split is intended for people aged at least 18. We do not create accounts for minors and we do not knowingly collect their data. The number of people in a family can include children without entering their personal data. If you find out that a minor has created an account, write to us and we will delete it.

Strictly necessary cookies keep the site working and, under Article 4(5) of Romanian Law no. 506/2004, do not require your consent. We use analytics cookies (Google Analytics) only if you agree.

Strictly necessary:

• __Host-hs_access: keeps you signed in; expires after at most 15 minutes and is renewed automatically while you are signed in, without you noticing.
• __Host-hs_refresh: renews your sign-in without asking for your password again; expires after 30 days without a visit, is extended on every visit up to at most 90 days after you signed in, and is deleted when you sign out.
• __Host-hs_google: set only if you choose to sign in with Google; while you choose your account at Google, it remembers that the sign-in started on this site and where to bring you back; it expires after at most 10 minutes and is deleted when you come back.
• __Host-hs_2fa: remembers, while you enter the code, that your password has already been checked, only if two-step verification is on; expires after at most 5 minutes and is deleted once you enter the code.
• __Host-hs_trusted: set only if you choose not to be asked for a code again on this device; expires after 30 days and stays after you sign out, because that is its purpose. You can undo that choice at any time from your account.
• NEXT_LOCALE: remembers the website language, only if you pick a different one from your browser; deleted when you close the browser.
• __Host-hs_consent: remembers whether you accepted or refused the analytics cookies; expires after 6 months, when we ask again.

Analytics, only with your consent, set by Google Ireland Limited:

• _ga: a randomly chosen code for your browser, which tells visitors apart so we can count visits; it is not linked to your account, name or email; expires after 13 months.
• _ga_<ID>: remembers the current visit and how many visits came from this browser, for the Google Analytics statistics; expires after 13 months.

You can refuse analytics cookies or withdraw your consent at any time from the Cookie settings link at the bottom of any page; on withdrawal we delete them from your browser. The full list, with the purpose and duration of each, is on the Cookies page.

The theme you choose (light, dark or system) is kept in your browser's local storage (localStorage), not in a cookie.

The phone app keeps your sign-in data in the system's secure storage and your preferences (language, theme) in the app's storage. To work without an internet connection, the app may also keep a copy of the data in your spaces on the phone. Sign-in data and that copy are deleted when you sign out, and everything is deleted when you uninstall the app. If you choose not to be asked for a two-step verification code again in the app, a marker of that choice stays on the phone for 30 days, also after you sign out.

The app asks for access only when you use the feature that needs it:

• the camera, to take a photo of a receipt;
• the photo library, to choose a receipt photo or a profile photo;
• notifications, to let you know, for example, when you have an amount to fill in or when someone marked a transfer to you.

You can refuse or withdraw these permissions at any time in your phone settings; the features that depend on them will no longer be available. The app does not ask for access to your location or contacts.

We may update this policy, for example when we add features or new providers. The version and the date of the last update appear at the top of the document. For important changes we will notify you by email or in the app before they apply.