Privacy Policy for PlanWit

Last Updated: October 18, 2026

Welcome to PlanWit ("we", "our", or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains what information we collect, how we use it, and what rights you have concerning it.

1. What Information We Collect

We only collect information that is necessary to provide you with the PlanWit service.

• Account Information: When you register, we collect your Name, Email Address, and optionally a Profile Picture and Phone Number. We also record when your account was created, when you last signed in, and which plan your account is on, and we issue short-lived, one-time tokens to verify your email address or let you reset your password. These expire automatically and cannot be reused.
• Business Branding: If your account is on the Business plan, you may add a business name, logo, and accent colour. These are stored with your account and placed on the reports you export. The logo is stored alongside profile pictures (see Hosting & Storage below). Branding is kept if your plan lapses so it is available again if you resubscribe, and is erased with your account.
• Google Authentication: If you choose to log in using Google, we only request and store your Name, Email Address, and Profile Picture from your Google account. We do not have access to your Google password or other personal Google data.
• Financial & Usage Data: To provide the core functionality of the app, we store data you input, including event names, expense amounts, categories, receipt images you choose to attach to expenses, and the users you share expenses with.
• Activity History: Each event keeps a record of changes to its expenses, payments, settlements, members and details — who made the change, when, and what each field was before and after. Every member of the event can see it on the event's Activity tab. On the Business plan, an event's Owner and Organizers can also see it in the Audit Feed, across all the events they run, and export it as a CSV file. The record is kept for as long as the event exists; if you delete your account, your name is removed from the changes you made.
• Contacts You Pick: If you choose "Pick from contacts" (in the PlanWit Android app, or in Chrome on Android), your device's own contact picker opens and PlanWit reads only the one contact you pick — its name, phone numbers and email addresses. Your address book is never uploaded. That contact's phone numbers and email addresses are sent to our server once, to check whether the person has a PlanWit account, and are not stored. If they have one, you see their name, profile picture and a partly hidden email address. If they don't, you can create an invite link and send it yourself through your phone's share sheet (for example by SMS or WhatsApp); we store the link until it is used, with who created it and which event it is for, but not who it was sent to.
• People You Add Who Aren't on PlanWit: You can add someone to an event by name before, or without, them having an account, and optionally their email address or phone number. We store what you enter, with the events they are in and their share of expenses, payments and settlements there. Members of those events see the name; only the person who added them sees the email address and phone number. We never email, text or notify them, and nobody can sign in as them. If they later join PlanWit with that email address or phone number, the account and everything recorded under it become theirs. Anyone added this way can email [email protected] to have their name, email address and phone number removed; what they paid and owed stays in those events as "a former member", as it does for a deleted account.
• Being Found by Your Phone Number: If you add a phone number to your account, people who have that number can find your account by it — when they search for it on the Friends tab or an event's invite form, or pick you from their contacts. They see your name, profile picture and a partly hidden email address, never your number.
• Funds You Share With a Friend: If you share a fund with a friend from the Friends screen, they see its name and the currencies it holds, so they can record a payment from it in events you are both in. They see its balance, overdraft and credit limit only if you turn on "Can see balance" for that friend; it is off unless you turn it on, and you set it separately for each friend. A fund you have not shared shows to other members of your events only as its type, such as "Bank" or "Cash".
• Automated Information: We automatically collect minimal, non-personally identifiable usage data (like your device type, general location based on IP, and browser) to help us understand how the app is used and to fix crashes.
• Data Stored on Your Device: To make the app load instantly and remain usable on a poor or absent connection, PlanWit keeps a copy of the data it has loaded for you in your browser's IndexedDB — a local database built into your browser. This copy covers your events, expenses, transactions, categories, funds, friends, balances, notifications and event members, an AI budget draft you have not added yet, and changes you made while offline that are waiting to sync. Your name, email address, profile picture, default currency and plan are also kept in your browser's local storage so the app can open signed in without a connection, along with your theme and analytics choice. None of this is sent to third parties. The copy of your data is cleared automatically after 24 hours without use, and everything tied to your account is cleared when you log out. You can remove it at any time by clearing your browser's site data for planwit.app.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To Provide the Service: Syncing your expenses, calculating group settlements, and displaying your financial data to you and your selected collaborators.
• To Manage Your Account: Authenticating your login and securing your data.
• For Essential Communication: We only send transactional emails (e.g., password resets, email verification, event invitations, the copy of your data you request with Export My Data, or reminders for a scheduled payment). Payment reminders go to the person named as the payer and to the event's Organizers, and can be turned off under Account → "Payment reminder emails"; the in-app notification remains. We do not send promotional spam.
• To Improve the App: Identifying bugs and crashes so we can fix them.

3. How We Share Your Information

We do not sell your personal or financial data to advertisers.

We only share your data with trusted third-party service providers ("Sub-processors") strictly necessary to run the app:

• Hosting & Storage: Cloudflare (for hosting the website and storing profile pictures, business logos and scanned receipt images), DigitalOcean (the servers that run PlanWit's backend, which every request from the app passes through) and Neon for storing user data (secure database provider).
• Error Tracking: Sentry (used to monitor app crashes), only after you accept analytics on the consent banner. When an error happens, it records a short replay of the screen with text and inputs masked, and we remove email addresses from reports. Our server also reports its own errors to Sentry.
• Product Analytics: Mixpanel (used to see which features are popular, routed via EU servers for data residency compliance) and Cloudflare Web Analytics. Mixpanel is only initialised after you explicitly accept analytics via the consent banner shown on first visit. If you decline, no analytics data is collected or transmitted. We identify you to Mixpanel by your PlanWit user ID and plan only — never your name, email address or financial data.
• Email Delivery: Resend (transactional email provider to deliver invites, verifications, data exports and payment reminders).
• Bot Protection: Cloudflare Turnstile, on the sign-up and Forgot Password pages, to stop bots creating fake accounts and sending password reset emails. To tell people from bots, the check sends Cloudflare signals from your browser: your IP address, your browser's User-Agent and TLS fingerprint, and the site it runs on. Cloudflare uses them only to detect and block bots and to improve that detection; see Cloudflare's Turnstile Privacy Addendum. The details you type into those forms are not sent to Cloudflare; our server passes it only the one-time result of the check.
• AI Insights: Google Gemini. Only when you ask for a budget estimate or smart warnings on an event, we send that event's name, description, dates, currency, budget, and its expense titles, categories and amounts to Google's Gemini API to produce the answer. A budget estimate also includes the names of the event's members, so it can suggest who each expense is split between. No email addresses or other account details are included. The answer is stored with the event so it can be shown again. For each request we also record which model answered and how many tokens it used, to manage plan allowances and costs. Nothing is sent to Google unless you press the button.
• Receipt Scanning: When you scan a receipt, the photo is stored in Cloudflare R2 and sent, together with the event's name and currency and the app's category list, to Google's Gemini API to read the total, merchant, date and items into a draft expense. The draft is kept with the event's AI history; the photo stays attached to the expense you save until you remove it or delete the expense, when it is deleted from storage. Nothing is sent unless you choose a photo.

4. How Long We Keep Your Data

We keep your personal information for as long as it is necessary for the purposes set out in this privacy policy, or as long as your account is active.

Account Deletion & Anonymization: When you delete your account, your personal data (name, email, profile picture, phone number, business branding) is permanently erased. However, expense transactions and settlements recorded within collaborative events are anonymised rather than deleted — the user identity is removed but the financial record is preserved to maintain accurate shared histories for other participants in those events. Events that nobody else is in are deleted with your account, along with everything in them, including receipt images.

5. Your Privacy Rights

Depending on your location (including under the Indian DPDP Act or EU GDPR), you have the right to:

• Access the personal data we hold about you (viewable directly within the app).
• Correct inaccurate or incomplete data via your Profile Settings.
• Data Portability: You can get a copy of your personal data in JSON format at any time — your profile, plan and business branding, your funds and their history, your settlements, and every event you are in with its expenses, your share of each, transactions, receipts, scheduled payments and repeating expenses. Go to Account → Data Management → Export My Data; the file is emailed to the address on your account.
• Erasure (Right to be Forgotten): You can permanently delete your account and personal data directly from the app. Go to Account → Privacy & Data → Delete Account. See Section 4 for details on how collaborative financial records are handled.
• Withdraw Analytics Consent: Your consent choice is stored locally in your browser. You can withdraw it at any time by clearing your browser's local storage or site data. Usage events already recorded in Mixpanel stay tied to your PlanWit user ID, not your name or email.

6. Changes to this Policy

We may update this privacy policy from time to time. The updated version will be indicated by an updated "Last Updated" date and the updated version will be effective as soon as it is accessible.