Privacy Policy

This Privacy Policy explains what information NthCube LLC (“NthCube,” “we,” “us”) collects when you use the Zplity iOS app (“Zplity” or the “App”) and the marketing site at zplity.com (the “Site”), why we collect it, who else sees it, and the choices you have. We built Zplity to handle the minimum data needed to make shared-expense math work; nothing more.

1. Information we collect

1.1 Information you give us directly

• Sign in with Apple identifier. When you sign in we receive an opaque user identifier from Apple plus, if you choose to share them, your name and (a real or relay) email address. Apple releases your name only on your first sign-in; if it does, we save it as your profile name so you don’t have to type it.
• Your profile name. A single display name on your account, which you can add, change, or correct at any time under Settings → Profile in the App. If Apple never shared a name with us, this stays empty until you enter one — we don’t substitute a placeholder. Its only purpose is to fill in your name when you create or join a group; each group then keeps its own name for you, and changing your profile name does not rewrite the name people in your existing groups already see. You are free to use a nickname or initials.
• Your currency preference. Optional. New groups start in the currency your device’s region uses; if that isn’t the one you want, the choice you make under Settings → Preferences is stored on your account so it follows you to a new phone. We derive it from your device’s own region setting, never from your IP address or any other location signal.
• Your profile photo. Optional. If you add one under Settings → Profile, the image you crop is uploaded and stored privately in Cloudflare R2 at avatar/<your id>.jpg. It is visible only to people you share a group with: every request goes through our server, which checks that the requester is an active member of a group you’re also an active member of before returning the image. Leaving or being removed from a group ends that access. We do not run face recognition or any other analysis on it, and it is never sent to an AI provider or any other processor. Remove it at any time from the same screen — that deletes the file from R2 and members see your initials again.
• Group and expense content. The groups you create, the members you add (including shadow members entered as a name only), expenses, item-level splits, settlements, notes, and timestamps. The name you use in a group is visible to the other members of that group, as are the expenses and settlements you record there.
• Receipt scans you submit for parsing. When you tap “Scan receipt,” the image is uploaded to our server, forwarded to an AI processing provider for parsing, and the parsed JSON is returned to your device. The upload itself is discarded once parsing finishes — we keep no separate copy of the scan. Keeping that photo on the expense afterwards is a different choice, and it does store the image; see the next item. Section 4 covers what the AI provider may do with it.
• Receipt photos you attach to an expense. If you choose to keep a photo on an expense, it is stored privately in Cloudflare R2 at expense/<id>.jpg. Only members of that expense’s group can fetch the image; every request goes through our server, which enforces group membership before returning it. Deleting the expense deletes the photo, and deleting your account deletes the photos in any group that is removed with it.
• The people you keep in People. Your People list is a private address book: for each person you add, we store the name, one email address and one phone number, plus a photo if you give them one (stored in Cloudflare R2 at contact-avatar/<id>.jpg). This list is yours alone — it is never shown to anyone else, and no other account can read it. When you add one of these people to a group, their name, and their email if you recorded one, become part of that group’s member list and are visible to its members; a copy of their photo is stored for that group so everyone can tell them apart. Deleting a person from People deletes their entry and photo and leaves every group untouched.
• Purchase records. If you subscribe to Zplity Pro, we receive the subscription status from RevenueCat (linked to your Sign-in-with- Apple identifier). Apple processes the payment; we never see your card details.
• Support correspondence. If you email us, we keep the message and any attachments long enough to resolve the issue.

1.2 Information collected automatically

• Push tokens. If you grant notification permission, iOS issues an APNs device token that we store so we can notify other group members when you log an expense or settle up.
• Basic request metadata. Standard web-server logs (IP address, user-agent, timestamps) are written by Cloudflare and retained for a short window for security and abuse detection. We do not link these logs to your account.

1.3 What we do not collect

• No advertising identifiers (no IDFA), no third-party SDKs for analytics or ads.
• No location data.
• No address-book access. Adding people from Contacts runs through Apple’s out-of-process picker: iOS never grants us access to your address book and never prompts you for it, because there is nothing to grant. We receive only the entries you tap, and from each of those only the name, one email address, one phone number, and the photo if it has one. We store no address-book identifier, so nothing we keep points back at an entry on your phone.
• No photo-library access. Choosing a profile photo or a receipt runs through Apple’s out-of-process picker, which hands us only the single image you select.
• No biometric data — we do not run face recognition on profile photos.
• No tracking across other apps or websites.

2. How we use information

• To provide the App’s core function: storing groups, computing balances, sending push notifications.
• To keep your People list, so adding the same person to a new group doesn’t mean typing them in again.
• To authenticate you (verifying Apple identity tokens, issuing our own session JWTs).
• To enforce fair-use limits on the free tier.
• To respond to support requests.
• To comply with legal obligations.

We do not use your data to train machine-learning models, sell it, or share it for advertising.

3. Service providers we share data with

We use a small set of vendors that act as data processors on our behalf:

• Apple Inc. — Sign in with Apple, App Store payments, APNs push delivery. Governed by Apple’s privacy policy.
• Cloudflare, Inc. — hosts the Worker, D1 database, KV store, R2 object storage (profile photos and the receipt photos you attach to expenses), and the marketing site. Data is stored in Cloudflare’s global edge infrastructure.
• Google LLC (Gemini API) — receives the receipt images you submit for parsing and extracts line items and totals from them. This is the model Zplity uses by default.
• OpenAI, L.L.C. — receives the same receipt images when a scan falls back to an OpenAI model, either because Gemini is unavailable or because we have moved scanning there. Nothing else is sent to it.
• RevenueCat, Inc. — manages subscription entitlements (linked to your user id, with subscription status only — no personal data beyond that).

Section 4 sets out what the AI providers on this list may and may not do with an image. We do not sell personal information, and we do not share it with third parties for their own marketing.

4. AI processing

We use third-party AI services to analyze receipt images and extract information such as merchant name, date, total amount, and category. Receipt images submitted for AI processing are transmitted to our AI processing providers, such as Google Gemini or OpenAI. When using their paid API services, these providers do not use submitted content to train or improve their AI models under their applicable terms.

Only an image you submit for scanning is sent this way, and only at the moment you start the scan. A receipt photo you then keep on an expense lives in our own storage (see Section 1.1) and is not sent for AI processing again. Nothing else you keep in Zplity — group names, expenses, balances, People entries, profile photos — is sent to an AI provider at all.

5. Data retention and account deletion

Group and expense data is kept while your account is active so other group members can continue to see shared history. A receipt photo you attach to an expense is removed from R2 when the expense itself is deleted. When you tap Settings → Delete account in the App, the following happens server-side. The personal-identifier deletion below runs as a single atomic database transaction; the surrounding steps (Apple token revocation, the session-revocation marker, and photo cleanup) are coordinated alongside it on a best-effort basis.

• Apple token revocation. We ask Apple to revoke the Sign-in-with-Apple refresh token tied to your account. If Apple is temporarily unreachable, the App surfaces a one-step instruction for you to finish the revoke from iPhone Settings → your name → Sign in with Apple → Zplity → Stop Using Apple ID.
• Permanent deletion of personal identifiers. Your users record, push tokens, rate-limit counters, and all personal identifiers (email, profile name, Apple subject) are deleted from our database immediately — not soft-deleted, not queued for later, no recovery window. Your profile photo goes with them: unlike a receipt photo, it belongs to your account rather than to a group’s shared history, so it is deleted from R2 and members of your former groups see initials in its place.
• Deletion of your People list. Every person in your People list, their photos in R2, and the private links tying them to group member rows are deleted outright. Unlike your membership rows below, none of this is anonymized and kept: nobody else can see your People list, so there is no shared history to preserve. The groups those people are in are untouched.
• Group ownership transfer. For each group where you were the owner and at least one other linked member remains, ownership transfers to the longest-joined remaining member.
• Anonymization in shared groups. For each group where other members remain, your membership row is anonymized: the link to your account, your email, and your phone number are cleared. The display name you typed when joining each group is preserved so historical expenses you paid for or participated in remain attributable for the surviving members — Bob still needs to know that the dinner ledger says "Alice paid $90." From their view you appear as a former member with no contact info. Receipt photos you attached to expenses in those groups are kept for the benefit of the remaining members and stay in R2 until a remaining member deletes the expense — they are not removed by your account deletion, because the expense itself is not.
• Cascade deletion of solo groups. If a group has no other linked members after your deletion, the entire group is deleted, along with its expenses, items, settlements, and any receipt photos in R2 storage.
• Session revocation. Any session token issued to your account is added to a revocation list for the remainder of its natural 30-day lifetime, so a token that may have leaked from your device cannot be replayed after deletion.
• Audit row. A single row is written to an internal deletion_audit table holding a salted, irreversible hash of your Apple identifier and the deletion timestamp — used only to demonstrate, if asked by a regulator, that your request was honored. The row contains no reversible personal data.

After deletion you may sign in again with the same Apple ID to create a fresh account, but historical balances on past shared expenses stay attributed to the anonymized membership — they are not re-linked to your new account. This is intentional: re-linking would partially undo the deletion you asked us to perform.

Backup snapshots may persist for up to 35 days before being overwritten in the normal course of database backup rotation.

6. International transfers

Cloudflare and our AI processing providers may process data in the United States and other countries. Where required, we rely on standard contractual clauses and equivalent safeguards to lawfully transfer personal data outside your country of residence.

7. Your rights

Depending on where you live (GDPR, UK GDPR, CCPA/CPRA, and similar regimes), you may have the right to access, correct, port, restrict, or delete the personal data we hold about you, and to object to certain processing. To exercise any of these rights, email [email protected]. Two of them you can exercise directly in the App without contacting us: edit your profile name and photo at any time under Settings → Profile, and delete your account in one tap from Settings → Delete account.

California residents: in the prior 12 months we collected the categories of personal information listed in Section 1 for the purposes listed in Section 2. We do not sell or “share” personal information as those terms are defined under the CCPA/CPRA.

8. Security

Traffic to our servers is encrypted with TLS. Session tokens are signed HS256 JWTs with a 30-day lifetime, rotated on request. Receipt images you submit for parsing are kept in memory during the parsing round-trip and not written to disk. Your profile photo and any receipt photos you attach to an expense are stored privately in R2 and served only after we verify, on each request, that you share a group with the person or expense concerned. No system is perfectly secure; if we ever learn of a breach affecting you, we will notify you in line with applicable law.

9. Children

Zplity is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.

10. Changes

We may update this policy from time to time. If the changes are material, we will notify you in-app or by email before they take effect. The “Effective” date above always reflects the current version.

11. Contact

NthCube LLC
[email protected]