Privacy policy
The part of a URL after # is its fragment. Browsers do not include it when requesting the page, so Settlo puts the invitation key there. Our server can see group and sync metadata, but cannot decrypt group names, amounts or notes. Share invitation links carefully: they grant access.
The browser demo keeps data in browser storage and does not share groups, sync with devices, register notifications or call the Settlo API. Clearing this site’s data removes that local copy.
On Android and iOS, sharing sends encrypted events, public device keys, an opaque group identifier, roles and sizes to the sync service. The feedback form sends your message and app version when you submit it.
Service logs contain a request identifier, route pattern, coarse outcome and duration. They do not contain group identifiers, content, amounts or invitation tokens.
Local database rows are encrypted with a key in the device’s secure storage. Removing a local copy, leaving a group and the owner deleting the cloud copy are separate actions. Settings → Delete everything on this device removes the local database and device identity.
No account needed
No email address, phone number, social login or account password is required. There is no online account to manage, but invitation links still need to be kept private.
Bank details are not group data
Your bank-account holder name and account details stay on your device until you approve a payment request. The reply goes only to the requesting device, not the group. It is removed from Settlo after three days, or sooner when the settlement is recorded or the group is archived or left. Payment codes are excluded from exports and backups.
Encrypted before syncing
Group content is encrypted on your device with AES-256-GCM. The group key is shared with invited members, not the server, which stores only encrypted group content.
No tracking
No analytics or attribution SDKs, third-party crash reporting, advertising identifiers or feature-usage counters. Groups you keep local are not uploaded for sharing.
Invitations expire
General group invitations expire after three days; personal invitations after one day. They are then deleted from the server and can be revoked earlier. Each invitation uses a 256-bit secret designed to resist guessing.
Server data has an expiry date
An inactive, fully settled group is deleted from the server after 30 days. An inactive group with outstanding debts gets three months, followed by a warning and a final week. A group with no members is deleted after seven days.
Your local history stays with you
Deleting the server copy does not delete the expenses, notes or lists on your device. You can still view and export them. Leaving a group does not erase other members' history; removing your own archived copy is a separate action.
Export and back up your data
Export a group or create a backup protected by your own passphrase. You keep the file and decide where to store it.