LoopSplit
← Back to LoopSplit

Privacy Policy

Effective date: October 30, 2026 · 生效日期：2026 年 10 月 30 日

简体中文

LoopSplit is provided by Jiajun Zhang, an individual developer based in the United States (Google Play developer name PeterZhang). It is an app for Android, iPhone and iPad for sharing expenses with other people. This policy explains what information the app collects, why, who can see it, and how you can delete it. We collect information to run your account and shared books, provide notifications, and support the technical operation of the app. We don’t show ads or sell your information. We use the usage statistics and crash reports described below to understand and improve the app.

Information we collect

Account information

  • Sign-in details. When you sign in with Apple, Google, Microsoft or email, we receive an account identifier and your email address from that service. If you use Sign in with Apple and hide your email, we receive Apple’s relay address instead. If you sign up with email, your password is handled by our sign-in provider (Firebase Authentication); we never see it.
  • Profile. The name you choose, and an optional profile photo or emoji.

What you add to books

  • Book names, members and currency.
  • Expenses, income and payments: titles, amounts, dates, categories, who paid and how each one is split.
  • Loops (recurring expenses) and their schedules.
  • Receipt photos. Photos you choose to attach to expenses are stored with the shared book. Taking or choosing a receipt photo is optional.
  • Email addresses you enter to invite people to a book. If that person doesn’t use LoopSplit yet, we keep the address with the book as a pending invite.
  • Contacts you add within LoopSplit and their account identifiers, used to find and invite people to shared books. We do not read your device’s address book.
  • Invite codes for your books, which include the book’s name.
  • A record of changes made in a book (who added, changed or deleted an expense, or who joined), used to send notifications to the other members.

Receipt scanning

On iPhone and iPad, receipt text recognition runs on your device using Apple Vision. On Android, receipt text recognition runs on your device with bundled recognition models. Selecting an image for scanning does not by itself upload it to a cloud recognition service. Photos you choose to save as receipt attachments are uploaded to the shared book and become visible to its members. Recognized amounts and any merchant or date suggestions become part of the book only when you save the entry.

Notifications and subscriptions

  • Notification token. If you allow notifications, we store a push token for your device with your account so we can tell you when someone changes a book you’re in. Your notification choices are stored with your account. Reminders for due Loops are scheduled on your device.
  • LoopSplit Pro. If you subscribe through Google Play or Apple, that store handles payment; we do not receive your card details. Our subscription service processes store transaction identifiers or purchase tokens, subscription status and expiry, and an account identifier used to bind the verified subscription to your LoopSplit account. Google Play receives an obfuscated identifier derived from your LoopSplit account, not your email address. We use this information to verify and restore purchases, prevent the same purchase being assigned to another account, handle renewals or refunds, and unlock Pro for eligible shared books. Purchase tokens remain private on the service and are not shared with book members.

Technical information

To keep accounts secure and deliver data and notifications to your device, our service providers process technical information such as your IP address, basic device and app information, and installation identifiers. On Android, Google’s ML Kit SDK also collects installation identifiers, device and app information, performance metrics, feature events and error codes for diagnostics and SDK usage analytics. Receipt recognition stays on your device; these technical metrics are separate from the receipt image and recognized text. See Google’s ML Kit data disclosure and Firebase’s data disclosure.

Usage statistics and crash reports

Starting with version 1.1, normal released versions of LoopSplit use Google Analytics for Firebase and Firebase Crashlytics to understand feature use, monitor stability, and diagnose problems. These services receive app and device information, such as app and operating-system versions, device model, session information, and installation or app-instance identifiers. Analytics may also use platform identifiers, such as the vendor identifier on Apple devices. These reports can be associated with an app installation or device even when no account name is attached.

  • Usage statistics. Analytics records app lifecycle activity, feature-use events, and purchase or subscription measurements, including StoreKit events on Apple devices, such as the product identifier, product name and price. On Android it can also record screen activity. Our custom events record categories such as sign-in method, entry type, split method, whether an entry was added offline, and use of search, the calculator or Pro features. They do not include the text of your searches, book or entry titles, receipt content, expense amounts, email address or LoopSplit account ID.
  • Crash reports. Crashlytics receives crash stack traces, relevant app state, device and app diagnostics, installation identifiers, and session information. When Analytics is available, recent app interaction events can be included as breadcrumbs to help explain what happened before a crash.
  • Approximate region. Analytics can infer a coarse location, such as a country or region, from a masked IP address. This is separate from precise device location; these features do not request GPS or precise-location access.

We use these reports for app usage analysis, stability and product improvements, rather than to display or target advertising. Android advertising-ID collection is disabled, and the Apple app does not request access to the advertising identifier. This does not disable the installation, app-instance or vendor identifiers described above. See Google’s Android Analytics data disclosure, Google’s Apple Analytics data disclosure, and Firebase’s privacy information.

Privacy choices

The 1.2 series on iPhone, iPad and Android provides separate controls for usage statistics and crash reports in Account → Privacy & Diagnostics and from the privacy entry point before sign-in. Each choice is saved on this device, persists across sign-out and restart, and is not synced to other devices; version 1.1 and earlier do not provide these controls. For devices reliably identified in the EU/EEA or UK, and when the region cannot be reliably determined, each control is off by default. In other reliably identified regions, each is on by default. A fresh coarse regional classification is obtained through Google Firebase Remote Config and may be based on an approximate country or region inferred from the IP address. A saved choice on this device for each control takes precedence. No mandatory first-launch pop-up is shown. These controls apply only to optional LoopSplit usage statistics and crash-report submissions. Turning off usage statistics stops LoopSplit usage-event reporting and clears analytics data stored on this device; it does not delete data previously sent to the server. When crash reports are turned off, the app stops new report submissions and requests deletion of reports that have not been sent. We do not receive confirmation that deletion completed; reports already submitted or in transit cannot be recalled. Reports are submitted only when the setting is on and the app’s eligibility checks permit sending. The controls do not disable essential Firebase Authentication, App Check, Firestore synchronization or Firebase Cloud Messaging notifications. Android ML Kit’s separate technical metrics are not controlled by these switches.

What we don’t collect

We don’t read your device address book or collect your browsing history. We do not require bank account or payment card details, connect to your bank, or process money transfers. Apple and Google Play handle store payments and do not provide us with your full card information. Content you choose to upload, including receipts and notes, may contain personal or financial information; please review it carefully before sharing it with book members. The approximate region and technical identifiers described above are separate from these account and bookkeeping features.

How we use your information

  • To create and secure your account, including verifying your email address.
  • To store your books and keep them in sync between members and devices.
  • To calculate balances, suggest payments and show recurring expenses when they are due for you to check and record.
  • To notify you about changes in your books and remind you about due Loops, if you allow notifications.
  • To give you and the members of your books the features of LoopSplit Pro while a subscription is active.
  • To let people join a book with an invite link or code, and to let book members add you by email.
  • To understand how features are used, diagnose crashes and errors, and improve the app’s stability and usability.
  • To reply when you contact support.

LoopSplit does not display ads. The usage and crash-reporting features described here support app analysis and improvement, not advertising or marketing.

Who can see your information

  • Members of your books can see your name, profile photo or emoji, whether you have LoopSplit Pro, and everything recorded in books you share with them, including attached receipt photos. Information you include in shared book content or invitations can be visible to the people with access to those records. They do not see your Apple or Google Play billing account, purchase tokens or payment details.
  • Anyone with a book’s valid invite link or code may see whether the invitation is valid and the book’s name before signing in; joining and accessing the shared book require signing in and confirming the join. Codes expire after 30 days or can be replaced or revoked. A book name already shared in a message cannot be recalled from its recipients.
  • Service providers. We use Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions and Cloud Messaging) to run the app and send notifications, which are delivered through Firebase Cloud Messaging on Android and Apple’s push notification service on iOS. Your account and shared-book information is stored on Google’s servers in the United States and processed on our behalf under Google’s terms. Google Analytics for Firebase and Firebase Crashlytics also process the usage and diagnostic data described above. Their handling and retention of that data are governed by our service configuration and Google’s applicable terms and privacy information. If you sign in with Apple, Google or Microsoft, that company handles the sign-in under its own privacy policy.
  • Legal reasons. We may disclose information if required by law or to protect the safety and rights of our users.

We don’t sell or rent your personal information.

On your device

LoopSplit keeps some information on your device so it can work without a connection: a copy of your books, expenses you added offline that are waiting to sync, profile and receipt photos it has already downloaded, and an invite code you opened before signing in.

Keeping and deleting your information

To request deletion of your LoopSplit account without using the app, email LoopSplit Support from the email address linked to your account, with the subject “LoopSplit account deletion”. Tell us which account you want deleted. We may verify ownership before processing the request. Do not send your password.

We keep your information while you have an account. You can edit your name and photo at any time in Account.

  • Leaving a book removes your access. Entries you recorded stay in the book so the other members’ balances remain correct.
  • Deleting your account (Account → Delete Account) requests removal of your profile and sign-in account and departure from your books. Cleanup and access revocation can take time and may need retries; previously shared links and copies can remain accessible. If you used Sign in with Apple, we also revoke LoopSplit’s access to your Apple ID. Entries in shared books, including their receipt photos, remain for the other members. If you’d also like books that no one else uses deleted, email us.

Receipt photos still referenced by a book, including a recoverable deleted entry, remain with that book. Unreferenced receipt files may remain in storage; an automated cleanup is being prepared but has not been deployed. Contact support about a deletion request. After an image is deleted from the app’s storage, our storage provider may retain a recoverable copy for up to seven more days under its current soft-delete policy. Other retention obligations and technical conditions can affect deletion.

If you cannot use the app, email us and we will help delete your data. Deleting your LoopSplit account does not cancel a store subscription; cancel it separately in Google Play or Apple. Shared book entries remain for the other members until those records or the book are deleted. Private purchase-verification records may be retained as needed to prevent purchase reassignment, handle outstanding subscription events, and meet legal obligations. Permanent account-deletion markers may be retained indefinitely to prevent restoration of a deleted account. These records are not used to recreate a deleted public profile.

Usage statistics and crash reports are retained according to the relevant service settings and may not be tied to the account information used by the account-deletion process. Deleting your LoopSplit account does not necessarily delete every historical usage event or diagnostic report. Contact us for questions or requests about this data; we will assess what can be identified and deleted under the applicable service controls and legal requirements.

Profile images hosted by a sign-in provider remain subject to that provider’s access and privacy practices. Version 1.2.0 uses authenticated access checks for LoopSplit-hosted book covers, receipts and profile images. Book covers and receipts require current book membership; avatars may be visible to contacts and people with a shared ledger relationship, including retained history. Historical direct download links covered by our access migration have been revoked. Older app versions or previously saved links may stop displaying these images. Cached images and copies already obtained may remain accessible and cannot be recalled.

Security

Information is encrypted in transit and stored with Google Cloud. Access controls are intended to restrict book records to members. Previously obtained images and shared copies have the limitations described above, and security controls cannot guarantee that previously shared copies are inaccessible. Current members have equal collaboration permissions, including editing or deleting records, recording entries on behalf of members, replacing receipts and managing membership; another member may change content you add. No method of storage is perfectly secure, but we work to protect your information.

Children

LoopSplit is not directed to children under 13, and we don’t knowingly collect information from them. If you believe a child has given us information, contact us and we’ll delete it.

Your choices and rights

You can view and correct your information in the app, and delete it by deleting your account. Depending on where you live, you may have other rights, such as asking for a copy of your information. To make a request, email us.

Changes to this policy

If we change this policy, we’ll update the date at the top of this page. For significant changes, we’ll also let you know in the app.

Contact

Questions about privacy? Email LoopSplit support.

隐私政策（简体中文）

生效日期：2026 年 10 月 30 日。

服务与信息

LoopSplit 由美国个人开发者 Jiajun Zhang 提供，Google Play 开发者名称为 PeterZhang。我们处理信息以提供账号、共享账本、通知、订阅和技术支持，不展示广告或出售个人信息。

登录时我们接收账号标识和邮箱；使用 Apple 隐藏邮箱时接收转发地址。Firebase Authentication 处理邮箱密码。个人资料包括姓名及可选照片或表情。账本包含名称、成员、币种、收支、还款、金额、日期、分类、分摊、循环计划、附件和操作记录。邀请可能包含邮箱或账本名称。应用内联系人不是设备通讯录，我们不读取设备通讯录。用户上传的收据、备注和照片可能含个人或财务信息，请在共享前检查。

收据识别在设备上进行；保存附件时照片会上传并与账本成员共享。Apple 或 Google Play 处理付款，我们不接收完整银行卡信息；我们处理交易标识或购买令牌、订阅状态、到期时间及账号标识，以验证、恢复和防止重复绑定。通知授权后，我们保存推送令牌；到期提醒在设备上安排。

技术信息和选择

服务提供商处理 IP 地址、设备和应用信息及安装标识，用于运行、安全和通知。Android ML Kit 另行处理安装标识、设备及应用信息、性能指标、功能事件和错误代码，以支持诊断和 SDK 使用分析；它不因此上传收据图片或识别文字。

从 1.1 版起，正常发布版本使用 Google Analytics for Firebase 和 Firebase Crashlytics 分析使用情况及诊断崩溃。它们处理设备、应用、会话及安装或实例标识；Analytics 可通过掩码 IP 推断大致地区，并记录功能、购买或订阅事件，包括商品标识、名称和价格；崩溃报告可包含堆栈、应用状态和交互事件。自定义事件不含搜索文字、账本或条目标题、收据内容、金额、邮箱或 LoopSplit 账号 ID。我们不用这些数据投放广告。Android 广告 ID 收集已关闭；Apple 应用不请求广告标识符，但其他上述标识仍可能使用。

iPhone、iPad 和 Android 的 1.2 系列已提供以下控制，可在“账号 → 隐私与诊断”及登录前的隐私入口分别设置使用情况统计和崩溃报告。每项选择保存在本机，退出登录或重新启动后仍保留，不会同步到其他设备；1.1 及更早版本没有这些控制。在可可靠识别为欧盟/欧洲经济区或英国的地区，以及无法可靠判断地区时，两项控制均默认关闭；在其他可可靠识别的地区，两项均默认开启。应用通过 Google Firebase Remote Config 获取最新的粗略地区分类，该分类可能依据 IP 地址推断的大致国家或地区。每项设置均以本机已保存的选择为准。首次启动不会强制弹出选择窗口。这些控制只适用于 LoopSplit 的可选使用情况统计和崩溃报告提交。关闭使用情况统计会停止发送 LoopSplit 使用事件，并清除保存在本机的分析数据；不会删除此前已发送到服务器的数据。关闭崩溃报告后，应用会停止提交新报告，并请求删除尚未发送的报告；我们不会收到删除完成的确认，已提交或正在传输的报告无法撤回。只有设置已开启且应用的资格检查允许时，报告才会提交。这些控制不会关闭必要的 Firebase Authentication 登录、App Check 安全检查、Firestore 同步或推送通知（Android 使用 Firebase Cloud Messaging，iOS 使用 Apple 推送服务）；Android ML Kit 的独立技术指标也不受这些开关控制。

共享与保存

账本成员可查看共享账本内容、收据和成员资料。你在共享账本内容或邀请中填写的信息，可能对有权访问相应记录的人可见。头像还可能对联系人及与你存在共享账本关系的人可见，包括保留的历史关系。有效邀请链接或代码的持有者可能在登录前查看邀请是否有效及账本名称；加入并访问共享账本需要登录并确认加入。代码在 30 天后过期，也可被替换或撤销。已通过消息分享的账本名称无法从接收者处撤回。Firebase 和推送、登录及商店提供商按其服务角色处理相关信息；账号与账本数据存储在美国的 Google 服务器上。法律要求或保护用户安全与权利时可能披露信息。设备也可能缓存账本、待同步条目和图片。

退出账本后，所记条目仍可供其他成员使用。删除账号会请求移除个人资料和登录账号并退出账本；清理和访问撤销可能需要时间或重试，先前分享的链接和副本可能仍可访问。共享账本中的条目和收据可能保留。未被引用的收据文件可能仍存于存储中；自动清理正在准备，尚未部署。删除图片后，存储服务当前软删除策略可能再保留可恢复副本最多七天；备份、缓存、法律义务和其他技术条件也可能影响删除。购买验证记录和防止恢复已删除账号的标记可能按需要保留。历史统计和诊断不一定关联到账号，删号不一定删除它们；请联系我们评估可识别及可删除的数据。

由登录服务提供商托管的头像仍受该服务提供商的访问和隐私做法约束。1.2.0 版对由 LoopSplit 托管的账本封面、收据和头像使用经过身份验证的访问检查。账本封面和收据要求访问者当前仍为账本成员；头像可能对联系人及与你存在共享账本关系的人可见，包括保留的历史关系。我们已撤销访问迁移所涵盖的历史直接下载链接。旧版本应用或此前保存的链接可能无法再显示这些图片。缓存的图片和已取得的副本可能仍可访问，无法撤回。

此前已取得的图片和分享的副本仍有上述限制。访问控制旨在限制账本记录，不能保证此前分享的副本不可访问。信息传输时加密并存储于 Google Cloud；没有任何存储方式能保证绝对安全。

权利与联系

你可在应用中查看或修改资料并申请删除账号；无法使用应用时，请从账号关联邮箱联系 LoopSplit 支持，我们可能核验账号归属，请勿发送密码。删除账号不会取消商店订阅，请在购买商店单独取消。依所在地法律，你可能有访问、复制、更正或删除等其他权利，可通过支持提出请求。服务不面向 13 岁以下儿童；如认为儿童提供了信息，请联系我们。重大政策变更将在应用中通知。