Last updated 23 September 2026
EvenOut records who paid for what among a group of friends and works out who owes whom. This policy says exactly what we hold to do that, who can see it, and how to get rid of it.
Only what the app needs to do its job.
· Your account. When you sign in with Google or Apple, we receive a permanent identifier for you from that provider and, usually, your email address. If you use Apple’s Hide My Email, we receive the relay address Apple generates rather than your real one, and we never learn your real one. If you sign in with an email address and a password instead, we hold that address and a salted, one-way hash of your password — never the password itself, which we cannot recover or read.
· Your profile. The display name and avatar you choose, and — if you are in India and add one — your UPI ID. The UPI ID is optional, you can clear it at any time, and we never use it ourselves: we neither send money to it nor check that it exists.
· Your expense records. Amounts, currencies, descriptions and dates you enter; who paid and who owes; the groups you are in; comments and settlements. This is the product.
· Notifications. A device token so we can send a push. It identifies a device, not a person. Your phone issues it whether or not you have allowed notifications — what your permission controls is whether a notification we send is actually shown to you — and we register it either way, so that turning notifications on later in your phone’s settings simply works. Deleting the app, or your account, ends it.
· Reminders you send. When you remind someone who owes you, we keep who you reminded and when — nothing else, and only the most recent one. It exists to hold us to the limit of one reminder per person per day, and it goes when either account is deleted.
· Diagnostics. Crash reports and basic usage counts — which screens are opened and which actions succeed or fail. These carry identifiers and event names, never the contents of your expenses.
· We do not track your location.
· We do not move money, so we never see card or bank details.
· We do not use advertising or third-party analytics SDKs.
· We do not see your UPI payments. UPI is offered in India only; where it is, opening a UPI app hands over a payee and an amount and learns nothing back — not whether you paid, not when, not from which account. We hold no bank details of yours at all.
People in a group with you see your display name, your avatar, and the expenses you share with them — that is what a shared ledger is.
Someone you owe money to can send you a reminder, which reaches you as a notification from us naming them and the amount. We work the amount out from the balance you already share; they cannot write it themselves. At most one a day from any one person, and you can turn notifications off in your phone’s settings.
They can also send that reminder as an ordinary message from their own phone — WhatsApp, Messages, anywhere. That message is written by their device, not by us, and we never see it. It carries a link back into EvenOut: to the group, or to the balance the two of you share. Such a link contains an identifier and nothing else — no name, no amount — and it opens nothing on a device that isn’t already signed in and already part of that group or balance.
When you share a link inviting someone to a group, the app you paste it into usually fetches that link to build a preview card — that is how a bare link turns into a title and a picture. Building it means telling that service the group’s name, how many members it has, and the group’s generated artwork. The service sees this, not only the person you sent it to. Nothing else travels this way: no member’s name, no expense, no amount. Turning the link off, or replacing it, stops even that.
Your email address is not shown to them. It is visible to another member only if you are asked and you agree to it, one person at a time. Someone can find you by typing your exact email address; they cannot browse or search for you, and an Apple relay address is never findable this way.
Your UPI ID, if you add one, is shown to them. That is its purpose — it is how someone settling a balance with you can pay you. It is visible to people you are connected to and people you share a group with, and to nobody else: not to the public, and not to someone who merely has a balance with you from the past. Note that a UPI ID often contains a phone number, so publishing one may tell those people your number. If you would rather not share it, leave the field empty — everything else in the app works the same.
Your data is stored on servers we run in India, and a copy lives on your own device so the app works offline. We also keep regular backups with a cloud storage provider in the European Union, so that a failure here cannot lose your records. Those backups are encrypted before they leave our servers, with keys the storage provider does not have and never will — they hold data they cannot read.
We use other providers for crash reporting, for this website and its email routing, and for sending the one-time code when you sign in or reset a password with your email address. None of them is configured to receive more about you than its task needs: the crash and website providers are not sent personal data at all, and the email provider receives your address and that code, and nothing else, to deliver the message.
We do not sell your data, and we do not share it with anyone for their own purposes.
You can delete your account from within the app. We erase your email address, your sign-in credentials, your profile, your device tokens and your diagnostics, and we sign you out everywhere.
Backups are the exception. What you deleted can remain in older backups for up to 400 days, until they expire. Those copies are encrypted, are never restored into the live app, and fall away as each backup ages out.
Two things survive, and you should know why. The expenses and settlements you shared with other people stay in their ledgers, because removing them would silently change what other people are owed — which is also why deletion requires your balances to be settled first. Replacing your name with a placeholder is a change of label, not a disguise: people who shared a group with you will still recognise which entries were yours.
Comments you wrote on those entries stay too. A thread is half somebody else’s, and it is often the record of what was agreed about a payment, so we anonymise it rather than delete it. In both cases your name is replaced by a placeholder. Be aware that a comment left behind cannot be removed afterwards — not by you and not through the app — so delete any you would rather not leave before you close your account. If something needs removing after the fact, write to us at support@evenout.money.
EvenOut is not intended for anyone under 13, and we do not knowingly collect their data.
If this policy changes in a way that matters, we will say so in the app rather than quietly editing this page.
Questions, or a request to see or delete your data: support@evenout.money.