Privacy Policy

This Privacy Policy explains how FairThen (“FairThen”, “the app”, “we”, “us”, or “our”) handles information when you use the FairThen mobile application and this website.

There’s nothing to agree to here. This is a notice, not a contract. It tells you what we do with your data, and your rights under data protection law apply either way. If we ever need your permission for something specific, we’ll ask you separately, and you can say no.

1. The short version

• We collect the minimum needed to make bill-splitting work.
• No third-party advertising or analytics SDKs are embedded in the app.
• We don’t access your contacts or location. The camera is used only when you choose to scan a receipt.
• The AI features run through your own API key, or on something you run yourself, and the app asks before the first scan with each provider.
• We don’t sell your data.
• You’re responsible for the accuracy of what you enter and for keeping your account secure.

2. Who’s responsible for your data

The data controller is Pandoma PLT, a limited liability partnership registered in Malaysia, registration no. 202604002010 (LLP0047250-LGN). Registered office: 10-1st, Persiaran Seksyen 4/8, Bandar Putra Bertam, 13200 Kepala Batas, Pulau Pinang, Malaysia.

Privacy questions, requests, and complaints all go to support@fairthen.com. A real person reads it.

3. Information you provide

• Account details. When you sign up, we store your email address. After your first sign-in we ask for a display name, and you can pick a username if you want one. With email sign-in you can use a password (stored securely hashed) or a 6-digit code we email you each time. If you sign in with Google or Apple, we receive your email, a basic identifier and your name if they share it, never your password. We also record when you agreed to our Terms of Service. If you sign in with Apple, we also keep a token Apple gives us so we can cut FairThen’s access when you delete your account.
• Unconfirmed sign-ups. If there’s no account for the address yet, tapping “Email me a code” saves it as an unconfirmed account so we can send the code. If it’s never confirmed, we delete that account automatically 7 days after the first code, or sooner if someone who can read that inbox moves an existing FairThen account to that address. We don’t email you about it.
• Content you create. Groups, expenses, split details, amounts, currencies, notes, member names/nicknames you add, settle-up records, and any group picture you add. You are solely responsible for the content you enter, including any personal information about other people.
• Support messages. If you email us, we’ll have your message and email address so we can reply.

You have to give us an email address to have an account at all, because that’s what an account is, and a display name so the people you split with know who you are. Everything else is up to you.

4. Information collected automatically

To keep the service running and secure, basic technical data may be processed, such as a device/app version, sync timestamps, and server logs (including IP address) generated when your app talks to the FairThen server. These logs are used for operating, debugging, and protecting the service, not for advertising or profiling. The app does not embed third-party analytics or tracking SDKs.

On this website: we store one thing in your browser, a “theme” value remembering whether you picked light or dark mode, so the page doesn’t flash the wrong colours when it loads. That’s it: today there are no cookies, analytics, or tracking pixels on this site, and that value never leaves your browser. Clear your site data and it’s gone.

5. Camera, photos & AI features

One feature uses AI today. Receipt scan reads a photo of a bill into an itemized split. It uses your camera or photo library only when you start a scan, and FairThen never accesses your camera or photos in the background.

Where the AI step happens is your choice, and the app gives you two ways to run it:

• With your own API key. If you add your own key for an AI provider in Settings → Advanced, the app calls that provider directly from your device. For a scan it sends the receipt image, the bill’s currency and how many people are on the bill, and nothing else from your groups. That goes to them instead of to us, so the request, and the key that authorises it, never pass through FairThen’s servers, and we never see it. The app asks first. Before the first scan with each provider, it tells you which provider and which web address the receipt is going to, and sends nothing unless you tap Allow. If you point a custom endpoint at a different server, it asks again. You can take that permission back at any time in Settings → Advanced, under Data sharing, and the app will ask again before your next scan. For those requests you are that provider’s customer, not ours: what they do with what you send, how long they keep it, and whether they use it to improve their models is between you and them, under the account and settings you hold with them. Worth reading their policy before you switch it on.
• On something you run yourself. You can point FairThen at an endpoint you control instead, and as on-device models become available in the app, at one running on the phone itself. Either way the work happens there and nowhere else: that request doesn’t reach us, and it doesn’t reach a company you didn’t choose. That’s the most private option there is, and depending on the hardware it can also be the slowest or the least accurate, so do check the results.

Choosing your own AI changes who does the reading, not how the app works. Only the AI step moves. The receipt photo isn’t saved to the bill and isn’t sent to our server, so “we never see it” holds for the photo too. The items and amounts it reads are different: once they’re in a bill they’re your data like any other, they sync to your devices and to our server, and sections 3, 8 and 9 cover them in the ordinary way.

Your API key stays on your device. It’s kept in the device’s own secure credential storage (the Keychain on iOS, the Keystore on Android), it’s only ever sent to the provider it belongs to as part of a request you started, and it’s erased when you log out. The app will only send it to an encrypted (https) endpoint. Treat it like a password: most providers let you create a key with a spending limit, and you can revoke it from their dashboard at any time. If you later delete your FairThen account, anything your provider kept is still theirs to hold, so ask them too.

The app still talks to our server for ordinary running-the-service things while you’re signed in, such as syncing your expenses or checking which model a provider currently offers. What it doesn’t send, when you’re using your own key or your own device, is the thing the AI reads: the receipt image. If a feature does need to go through us to work at all, the app says so where you use it.

However you run it, AI output can be imperfect, so please review the scanned items and totals before relying on them.

Receipts sometimes contain more than groceries. Have a look before you scan, and crop or skip anything you’d rather not send. Extracted items are suggestions for you to check and correct, not decisions made about you.

6. Why we’re allowed to use it

If you’re in a place with data protection law that asks us to name a legal basis (the EU, the UK, and others), here it is, purpose by purpose:

• Your account and sign-in, including holding an unconfirmed sign-up while we wait for your code. To provide the service you asked for (performance of a contract, or steps you asked us to take before one). If someone else typed your address, holding it is our legitimate interest in running sign-in, and the automatic deletion keeps that short.
• Storing and syncing your groups and expenses. Same: it’s the thing the app does (performance of a contract).
• Your own API key, or your own device. Nothing for us to name here, because there’s nothing for us to do. When you choose either of those, we aren’t processing what the AI reads at all: your device talks to the provider you picked, or to an endpoint you control. This is how every AI feature runs today.
• Server logs, security, debugging, abuse prevention. Our legitimate interest in keeping FairThen working, available, and not full of fraud.
• Recording when you agreed to our Terms. Our legitimate interest in being able to show that you did.
• Answering your support email. Performance of a contract if it’s about the service, otherwise our legitimate interest in replying to you.
• Keeping a deleted person’s display name in shared groups, marked “(deleted)”. The legitimate interest of the other people in that group, who’d otherwise be left with a ledger that no longer adds up. If you object, tell us and we’ll look at your situation specifically.

We don’t make automated decisions about you that have legal or similarly significant effects. Reading text off a receipt isn’t one.

7. Where your data lives, and where it goes

FairThen is offline-first. Your data is stored on your device so the app works without a connection, and synced to FairThen’s own server so it’s available across your devices.

We’re based in Malaysia, and the companies that help us run FairThen (hosting and infrastructure providers) operate in various countries, including the United States. So your data does cross borders. Before we send data anywhere we check that it’ll be protected properly, and we use providers who offer standard data-protection terms, including the European Commission’s Standard Contractual Clauses where they apply, along with encryption in transit and terms that stop them using your data for their own purposes. Ask us at support@fairthen.com and we’ll tell you what’s in place for a given provider.

That covers the data we send. If you use your own API key, the request goes straight from your device to whichever provider you chose, wherever they happen to be, under your agreement with them. We’re not in the middle of it, so the protections above, which are contracts between us and our providers, don’t reach it. Choosing the provider means choosing where that work gets done. Running it on something you run yourself sends it nowhere at all.

That’s about the AI step. Whatever you then keep in the app, such as the items and amounts from a scan, still syncs to our server the way the first two paragraphs describe, and crosses a border like the rest of your data, whichever AI was involved. See section 5.

8. Service providers & third parties

• Sign-in providers. If you choose Google or Apple sign-in, their handling of your data is governed by their own privacy policies.
• Hosting/infrastructure. The backend runs on cloud hosting, storage, and database providers that process data on our instructions to operate the service.
• Legal disclosure. We may disclose data if required to do so by law, legal process, or a good-faith belief that it’s necessary to protect rights, safety, or the integrity of the service.
• If the company changes hands. If FairThen is ever merged, acquired, restructured, or sold, user data would transfer with it, because the service can’t run without it. We’d tell you before it happened, and whoever takes it on is bound by this policy until they give you notice of a different one.

That’s everyone who touches your data on our side, and it stays a complete list even as we add AI features: when you bring your own key you are that provider’s customer and we aren’t in the exchange at all, so whoever you pick is named in your account with them rather than here. We don’t sell your data, we don’t share it for advertising, and there’s no data broker in the picture.

9. How long it’s kept

Your bill, expense and activity history isn’t deleted on a fixed clock. It lasts as long as the group it belongs to is still running, and groups are built to run for years rather than months. We work in cycles instead: once a group has been going long enough, it locks itself and asks someone to Start Fresh, which archives that cycle to a CSV you can download and carries every outstanding balance forward onto a clean page. If nobody does it by hand, we eventually run it for you, and that cycle’s expenses and activity are deleted at that point. The archive is then kept for a further period before it goes too.

Those windows are currently measured in years, not months, and the app warns you inside a group well before either one arrives. The exact figures we use today are on our support page, and we may adjust them as the service grows. If we shorten anything materially we’ll say so here first.

Separately, a deleted expense sits in the trash for about a month so you can restore it, then it goes for good. Copies can sit in backups for a while after any deletion before they age out. You can export any group at any time. Account details are kept while your account is active; you can ask us to delete your account and associated data at any time (see below). An unconfirmed sign-up that’s never confirmed is deleted automatically 7 days after the first code. We keep something longer only where the law makes us, or where we need it to keep the service secure.

10. Your rights

Wherever you live, and whether or not your country’s law makes us, we’ll honour these:

• Know and access. Ask what we hold about you and get a copy.
• Correction. Fix anything wrong. Most of it you can edit directly in the app.
• Deletion. Delete your account in the app (Settings → Danger zone → Delete account) or ask us by email. Deletion is scheduled and completes 30 days later, and you can call it off during that window by signing back in and choosing Cancel deletion. After that we erase your email, profile, avatar and receipts. Expenses you shared in groups are kept so others’ balances stay correct, and your name there is retained and marked “(deleted)” so those people can reconcile what was owed. See Delete your account for the full steps.
• Portability. Export your data in a machine-readable format from inside the app. If you want us to send it straight to another service, ask, and we’ll do it where that’s technically possible.
• Objection and restriction. Object to anything we do on a legitimate-interest basis, or ask us to pause processing while we sort out a disagreement.
• Withdraw consent. Where we asked for permission, you can take it back at any time, without affecting what we did before. Permission to send receipts to an AI provider is switched off in Settings → Advanced, under Data sharing.
• Sign-in revocation. You can revoke Google/Apple access from those accounts at any time.
• No penalty. We won’t degrade your service or charge you differently for exercising any of this.

Email support@fairthen.com and we’ll get back to you within 30 days, sooner if we can. We may need to check you are who you say you are first, especially for a deletion or a data copy. If you’re unhappy with how we handled a request, reply and say so, and a second look is free.

If you want to complain to a regulator, you can. In Malaysia that’s the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi). In the EU or EEA it’s the supervisory authority where you live, work, or where you think the problem happened. In the UK it’s the Information Commissioner’s Office. We’d rather you came to us first, but it’s your call and you don’t need our permission.

11. If you’re in the United States

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We haven’t in the past 12 months, and we don’t have a “Do Not Sell or Share” link because there’s nothing to opt out of. If that ever changes, we’ll say so here first and ask before doing anything with data we already hold.

The rights in section 10 (know, access, delete, correct, port, no retaliation) are offered to every user, so residents of California and other US states with privacy laws don’t need a separate process. Email us, or use an authorised agent with your written permission and we’ll verify with you. The CCPA likes these listed out, so: the categories of personal information we handle are identifiers (email, display name, account ID, IP address), internet and network activity (server logs), your own content (groups, expenses, group pictures), customer-service records, and a record of when you agreed to our Terms. Sources, purposes, recipients, and how long we keep each are in sections 3 to 9.

12. If something goes wrong

If there’s a data breach, we’ll notify the Malaysian Personal Data Protection Commissioner and any other regulator that has to hear about it, within the deadlines the law sets, and we’ll tell affected users where the breach is likely to cause real harm. We’ll tell you what happened, what data was involved, and what to do about it, in plain language and without spin.

13. Security (and your part in it)

We take reasonable measures to protect your data, including encrypted local storage and access controls on the server. However, no system is perfectly secure, and we can’t guarantee absolute security. You are responsible for keeping your device and login credentials safe and for the people you invite into your groups. If you’ve added your own AI provider key, that goes for the key as well: it lives on your device, so a locked device is what keeps it safe, and if you think it has got out, revoke it with the provider. Use FairThen at your own risk.

14. Children

FairThen isn’t directed at children. You need to be at least 13 to use it, or older if the law where you live sets a higher minimum age for using online services on your own. In parts of Europe that’s 14, 15, or 16. We don’t knowingly collect data from anyone under those ages, and if we find out we have, we’ll delete the account and its data promptly. If you think a child has an account with us, email support@fairthen.com and we’ll sort it out.

15. Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected by updating the “Last updated” date above, and we’ll flag significant ones in the app where we can.

16. Contact

Questions about privacy? Email support@fairthen.com, or start at the support page.

Pandoma PLT, registration no. 202604002010 (LLP0047250-LGN). 10-1st, Persiaran Seksyen 4/8, Bandar Putra Bertam, 13200 Kepala Batas, Pulau Pinang, Malaysia.