Privacy Policy

Information we process

When you sign in, we process the name, email address, profile image, authentication provider, and account identifier supplied by Google, Apple, or Firebase Authentication. Guest mode uses an anonymous Firebase account and requires the display name you provide.

We store the information you choose to add: group names and membership, invite codes, expenses, payer and participant shares, settlements, notes, categories, in-app activity, and notification or widget preferences. A guest may add up to five expense or settlement transactions before signing in.

Sumelle does not request Contacts access. Add friends by name and email or scan a Sumelle profile QR code. This code contains the profile name and verified email, not a login credential. Anyone who can see the code can read those details, so share it only with intended friends. Camera scanning is processed on your device. Review the scanned details before saving. Adding a friend sends one email invitation; shared expenses connect when the recipient signs in with that verified email. Private receipts remain private unless separately shared.

When you choose Scan, Photo, or PDF, Sumelle uses on-device text recognition and may send the selected file—or up to three ordered screenshots of the same receipt—to Google Firebase AI Logic to suggest receipt metadata. Suggested metadata can include merchant, date, currency, receipt, store and transaction numbers, payment method, purchased items, quantities, unit and line prices, subtotal, tax, tip, fees, discounts, total, return details, detected receipt barcodes, and confidence. Original files are not saved in Sumelle's receipt database. Temporary device copies may remain until device or operating-system cleanup; Google processes submitted files under its service retention and security controls. We do not promise immediate deletion or zero retention by the processing provider. Metadata is saved only after you review and approve it. Optional tax records include the category, tax year, business-use percentage, and purpose you enter; these are organizational records, not a determination that an expense is tax-deductible.

Firebase and the authentication provider process technical service data such as IP address, account and device identifiers, security events, usage data, and diagnostic logs to operate, measure, and protect their services. Google Sign-In may estimate approximate location from an IP address for fraud prevention. Sumelle does not request GPS location or use this information for advertising tracking. See Firebase's SDK disclosures.

How we use information

• Authenticate you and restore your private receipt inbox, saved friends, direct ledgers, and groups.
• Let you retrieve selected friends when creating direct splits or groups.
• Synchronize direct and group expenses, splits, settlements, and activity.
• Suggest receipt metadata when you explicitly request analysis.
• Present approved receipt barcodes for a return, subject to the merchant's policy.
• Deliver requested alerts and widget updates.
• Protect the service, investigate failures, and comply with law.

Sharing

Saved receipt metadata stays in your private receipt inbox. When you choose to split a receipt, the approved item names, prices, assignments, expense total, payer, shares, and related activity become visible only to the friend or group you choose; the original receipt image and private return pass are not shared. We use Google Firebase for authentication, database hosting, app integrity checks, and requested AI-assisted receipt extraction. We do not sell personal information or share it with advertising networks.

Retention and deletion

Private receipts remain until you delete them or delete your account. Profile → Settings lets you delete account data and the full private receipt inbox. Expenses and settlements you created are removed from shared groups when account data is deleted. If you are the final signed-in member of a group you created, that group and its invite are deleted; records created by other remaining members may remain. Guest accounts and their data can also be deleted in the app.

Your choices

A group owner can permanently delete a fully settled group. This removes that group's shared expenses, settlement history, group update messages, and invite access for everyone. Private receipt records, return codes, and private tax records are not removed by group deletion.

You may decline camera or notification permission, sign out, delete activity identity, or delete your account. Camera permission can be changed in iOS Settings; manual email entry is available without camera access. To request access, correction, or help with deletion, email allevate.support@gmail.com.

Security and children

Data is encrypted in transit and protected by Firebase access rules. No system is completely secure. Sumelle is a general expense-sharing service and is not directed to children under 13; a parent or guardian should manage group access for children.

International processing and changes

Service providers may process data in countries other than yours. We may update this policy as the product or law changes. Material changes will use a new consent version in the app.

Messages

Messages and conversation details are stored with Google Firebase and are not end-to-end encrypted. Direct chat starts after a connection request is accepted, and its history is available to the two participants. Current registered group members can read the group’s automatic update history, including earlier updates. Blocking stops new direct messages but keeps existing history. Deleting your app data or account removes your direct conversations from Sumelle for both participants; shared group update history may remain. We retain a minimal record of declined or blocked connections to prevent new requests after a data reset.

Message reports

When you confirm a message report, the selected message text, reason, sender and reporter identifiers, conversation and message identifiers, and report time are saved for authorized support review. The rest of the conversation is not copied into the report, and the other participant is not notified. Reports are not readable by app users. Reports you submit are removed when you delete your account data; copies submitted by someone else may remain for safety review. A minimal account restriction may be retained to prevent a data reset from bypassing a messaging suspension.

Automated server-side screening checks message text and certain shared labels for a limited set of abusive patterns without sending that text to another moderation provider. Authorized support may inspect the selected report and its referenced shared label, remove reported content, and restrict messaging. Financial amounts are not changed by moderation. Minimal audit records retain the decision, reason, time, operator identity, and hashed references, without message text or private receipt details, to document enforcement and prevent duplicate actions or incorrect reversals.

For message safety concerns or follow-up on a report, contact alluvenkata5@gmail.com. New reports can generate an operational alert that a report needs review; report text and participant contact details are not included in that alert. Choosing email support opens a draft only after your action, and you decide what to send.

Saved notifications

When a requested expense or payment alert is accepted by the push service, Sumelle saves its text, type, and sent time in your private notification inbox. This does not confirm that your phone displayed it. We also store when you mark an alert read or clear it. Clearing hides the alert from the inbox without deleting activity, messages, or expenses; a cleared record is retained so it does not reappear. Deleting your account data removes your notification history.

Contact

Allevate · allevate.support@gmail.com

Read the Consent Notice