Parta Privacy Policy

DRAFT. This text was checked against Parta's code and against EU and UK data-protection law with the help of an AI review on 5 November 2026. No lawyer has reviewed it yet. It may change before Parta is publicly released.

Last updated: 6 November 2026. First drafted: 1 October 2026.

Who is responsible

Andrei Baluta, an individual developer based in Romania, decides why and how Parta uses your personal data. In data-protection law he is the controller. Contact: andrei.baluta@yahoo.com.

We have not appointed a data protection officer, because the law does not require one for a service like Parta.

The short version

Parta helps a group on a trip share its bills. Someone posts a bill, each person answers for their part, and they pay each other. We use your account and trip information to provide that service. The people on your trips see what you add to them. We do not sell your data, use it for advertising, track you across apps, or send marketing.

Why we use your data

You can object to any use based on legitimate interests; see Your rights.

iOS asks your permission before Parta uses the camera or shows notifications. These permissions control your phone. They are not the legal basis for our use of your data. Parta also asks you in the app before it sends a receipt photo to an AI provider, because Apple requires it. That question is not the legal basis either; see Camera and receipt photos.

Parta does not use Firebase Analytics, Crashlytics or Performance Monitoring.

What data we use

• Sign-in. You sign in with Apple. Apple gives us an account identifier and, if you let it, your name. Firebase Authentication keeps the identifier and when you signed up and last signed in. We use the name only to suggest your display name. Parta does not ask Apple for your email address. An account made with a test version before 5 November 2026 may have one on file; we do not use it and do not write to you at it.
• Profile. We store the display name you choose. People on your trips see it.
• Trips. We store the trip's name, its one currency, who is on it, who owns it, whether it is open or closed, and who closed it.
• Bills. For each bill we store its title, total, when it was posted, who posted it, who paid, who was there, and any items read from the receipt. We store each person's answer: the part they typed, the items they picked and how many pieces, a vote to split evenly, or "I wasn't there". We store fixes to the total or to who was there, who made them and the reason they gave, and whether a bill was deleted and by whom.
• "I sent it". When you tap "I sent it", we store who sent how much to whom. This records what you say you sent. Parta does not check it with a bank.
• Close-up and reminders. When a trip closes, the app works out the fewest transfers from these records. When someone taps Remind, we store who reminded and when.
• Payment details. If you add a Revolut Revtag, a PayPal.me name, an IBAN, a RoPay phone number or a note, we keep one copy for your account. It is used on all your trips.
• Receipt photos. See Camera and receipt photos.
• Notifications. See Notifications and the widget.
• Service and security records. When your phone calls our servers, Google's request logs record the time, your IP address, the app's version information and the result. Our own records add the operation, a request ID, how long it took, a limited error code, and whether App Check was present. They never hold your bills, names or amounts. We also keep short-lived counters per account, to limit abuse.

Write only what the trip needs in titles, notes and reasons. Avoid health or other sensitive details, because everyone on the trip can read them.

Camera and receipt photos

Parta asks iOS for camera access only when you snap a receipt. If you decline, you can type the bill instead.

Reading the receipt. Before Parta first sends a receipt photo to be read in the cloud, it asks you. If you agree, the app sends a smaller grayscale copy of the receipt, without location data, to our server in the EU. The server passes it to OpenAI, a provider in the United States, which reads the items and the total and returns them. OpenAI acts as our processor. It receives the photo and a fixed reading instruction, and a code derived from your account, never your name or trip records. It does not use the photo to train its models. It may keep it for up to 30 days to detect abuse. Neither we nor OpenAI keep the photo for our use.

If you say no, the receipt is read only on your phone, by Apple's on-device text recognition, which works without an internet connection and sends nothing. The phone also reads it by itself when it is offline or the cloud reading fails. You can change your answer in Profile at any time. Either way the reading only suggests figures. You can change them before you post, or type the bill by hand.

Sharing the photo. When you post a bill with a receipt, your phone uploads a smaller grayscale copy and a thumbnail, without location data, to Google Cloud Storage in Belgium. Everyone on the trip can open it, including members who left the trip, because their debts stay. Other phones download the thumbnail with the bill, and the photo when it is opened, and keep a copy in the app's cache. A receipt can show other people's details, such as a waiter's name, or yours, such as the end of a card number. You can post a bill without a photo.

On your phone. Until you post or cancel, the photo as the camera took it and the bill you are typing are saved on your phone, so you don't lose them. They are protected by iOS file protection and are not included in device backups. A photo waiting to upload stays on your phone until it uploads, for at most 30 days.

When photos are deleted.

• 90 days after its trip closes. If the trip reopens within those 90 days, the photo stays. A trip that never closes keeps its photos.
• When its bill is deleted. From that moment nobody can open it. It is erased about an hour later, which leaves time for Undo.
• When you delete your account, the photos you posted are erased at once.

Google Cloud Storage may keep an erased file for up to 7 days before it is gone for good; nobody on the trip can open it then. The bill keeps the items read from the photo and says the photo was removed. A copy another member's phone already downloaded stays in that phone's cache until the app sees the removal.

Notifications and the widget

Parta sends three kinds of notification: a new bill you are on, a Remind from someone on the trip, and a 9:00 daily summary when something waits on you. You can turn new bills and the daily summary off on the You screen, or turn all notifications off in iOS Settings. We store your two switches with your profile.

To send them, our server keeps, for each phone you use (at most five): its push token, an installation ID, a hash of a secret the phone keeps, its time zone, its language, and when it registered and was last seen. The time zone sets your 9:00, and the language is the one the notification is written in. We also keep when your next summary is due, a short record per trip of what the last summary showed, so the next one can say what changed, and when you last received a Remind, so nobody gets more than five a day.

Notifications go through Google's Firebase Cloud Messaging and Apple's push service. They carry the trip name, the bill title, amounts and names. Google and Apple see this content and the token in order to deliver it. Notification previews can show on your lock screen; iOS Settings controls this.

A phone stops receiving notifications when you sign out. We delete its record then, or when the token stops working, or when a sixth phone replaces the oldest.

The Home Screen widget reads a small file the app keeps on your phone, shared only with the widget. It holds the number of bills waiting on you, at most one trip's name, and a short code derived from your account. It never leaves your phone. Anyone who sees your Home Screen can see the widget.

Who can see your data

People on a trip can see its members' names, its bills and photos, each person's answers, fixes and their reasons, "I sent it" statements, reminders, and the close-up. They see only the trips they share with you.

Your payment details are shown only to people who owe you money on a shared trip: on a bill you paid that they were on, or in a transfer to you when the trip closes. So that they can pay without a connection, their phone keeps the details it last fetched for at most 30 days; a change or removal reaches it the next time it connects. Parta shows details for a manual transfer and can open Revolut or PayPal. It does not move money. Once someone copies your details or shares them, Parta cannot take that copy back.

We share data with service providers only so they can run Parta for us, as described in the next section. We do not give it to anyone else, unless the law requires it.

Service providers and where your data is

We use these processors. Each may use your data only to provide its service to us.

• Google (Firebase and Google Cloud): sign-in, database, server functions, photo storage, notification delivery, App Check, the invitation link pages, and server logs. For a customer in Romania, Google's contracting entity is Google Cloud EMEA Limited, in Ireland.
• OpenAI: receipt reading, only if you agree in the app, as described above.

Apple delivers notifications to iPhones and provides Sign in with Apple under its own terms with you.

Our database is in Google's eur3 region, which uses Belgium and the Netherlands, with Finland as a witness region. Our server functions and receipt photos are in Belgium. Some Google services are global: Firebase Authentication, Cloud Messaging, App Check, Hosting and Cloud Logging. Their data may be processed outside the European Economic Area.

When data goes to the United States, Google relies on the EU–U.S. Data Privacy Framework and its UK Extension, and otherwise on the European Commission's Standard Contractual Clauses and the UK's equivalent safeguards. OpenAI processes data in the United States and elsewhere it operates, under the transfer safeguards in its data processing terms; we do not use its EU data residency option. You can ask us for a copy of these safeguards.

The UK and the EU recognise each other's data-protection law as adequate, so data can move between them.

How long we keep data

Records with an expiry date are removed by Google's automatic deletion, usually within a day of that date.

Your account and its deletion

On the You screen, Delete account deletes your account. We then:

• delete your sign-in account, your profile and your payment details;
• erase the receipt photos you posted;
• delete your notification records, your counters and the records that stop retried actions from applying twice, keeping only the deletion's own record, without your identifier, for 90 days;
• replace your name in your trips with a pseudonym such as "Former member 3", and pass ownership of any trip you owned to another member.

What you added to shared trips stays, so the other members' history is not rewritten: the bills, your answers and payments, and the titles, item names and reasons you typed. They are linked to a random identifier, not to your name. People who were on the trip may still remember who you were. The app clears your data on this phone. Your unsent work must sync first.

Your rights

You have the right to:

• get a copy of your personal data and information about how we use it;
• have wrong data corrected; you can change your display name and payment details yourself;
• have your data deleted;
• restrict how we use it, or object to a use based on legitimate interests;
• receive the data you gave us in a machine-readable format (portability).

On the You screen, Save my data saves a JSON file with your profile, your payment details, your notification switches, each phone's time zone, language and dates, and, for each of your trips, the bills you posted, paid, were on, answered or fixed, and the "I sent it" statements you made or received. It never holds a push token. It does not include receipt photos or our other records about you. You can open photos on their bills, and you can email us for a copy of them or of anything else we hold.

For any request, email the controller at the address above. We answer within one month. If a request is complex, we may take up to two more months, and we will tell you why within the first month. We may ask for information that shows the request comes from you. Requests are free unless they are clearly unfounded or excessive.

These rights have limits set by law. For example, deleting your account does not erase shared trip records that other members rely on, as described above.

Parta makes no decisions about you by automated means alone that have legal or similarly significant effects. The close-up only adds up what the members entered.

Complaints

You can complain to us first by email, and we will try to fix the problem. We acknowledge a complaint within 30 days. You can also complain to a data-protection authority. In Romania, that is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, dataprotection.ro. In the UK, that is the Information Commissioner's Office (ICO), ico.org.uk. In another EU country, you can complain to the authority where you live or work.

Security

Data travels encrypted between your phone and our servers. Access rules let only the people on a trip read it, and only our server change it. Data on your phone is protected by iOS file protection. We limit who can access our servers. No system is perfectly secure. If a breach puts you at high risk, we will tell you without undue delay.

Age

Parta is not for people under 16 in the EU and EEA, or under 13 in the UK. Parta does not ask for a date of birth. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

When the app or our data practices change, we update this page and the date at the top.

Contact

For privacy requests, email andrei.baluta@yahoo.com.