Privacy policy

Effective 29 September 2026

The short version: Chip In stores only what you put into it, to run your plans. People in a plan see that plan. Your payment details are shared only with the plans you pick. We count how the app is used, without advertising IDs, to improve it. There are no ads, we don't track you across other apps or websites, and we don't sell your data.

What we store

An anonymous account ID. Chip In signs you in without an email or password. The ID keeps your plans on your device.
Your Google or Apple account, if you sign in. Signing in is optional. If you continue with Google or Apple, Chip In receives your name and email address from that account and keeps them in your private profile, so you can get your plans back on a new phone. Apple may give a private relay address instead of your email.
Your display name, which you choose and can change in Profile.
What you add to plans: plan names, dates, emoji and colour; list items and amounts, and who's bringing what; expenses (amount and description); and payments between members (who, how much, and whether it's confirmed).
Receipt photos you attach to expenses.
Plan activity: a history of changes in each plan (who added, claimed, paid or confirmed what), shown in the plan's Activity tab.
Messages: what you write to the group in a plan's Activity tab. Other members of that plan get it as a notification.
Notifications: if you allow notifications, a push token for your device, and an in-app inbox of the notifications sent to you.
Payment details you add, such as a PayNow number or UEN, a KBZPay or WavePay number, bank details, a PayPal.me username, or a note. These are kept in your private profile, and are copied into a plan only when you choose to share them there.

App usage. In the Android and iPhone apps, Google Analytics for Firebase records which screens are opened and a few actions, such as creating or joining a plan, logging an expense or marking a payment as paid, along with an app-instance ID and basic device information (model, OS version, country). It never records names, amounts, plan contents or payment details, and it doesn't use advertising IDs. This usage data is kept for up to 14 months.

Like any online service, our hosting provider handles technical data such as your IP address and device type in order to deliver the service.

Who can see it

Members of a plan see that plan: its list, expenses and receipt photos, payments, activity and messages, member names, and the payment details each member chose to share with it.
Anyone with an invite link sees a preview: the plan's name, emoji, date, the host's name and how many items are on the list. They need the exact link, and plans can't be searched or listed. The host can reset the link at any time.
Your private profile, including your full list of payment details, and your notification inbox are visible only to you.

Payments

Chip In doesn't move money or process payments. It shows who owes whom and the details to pay with, and you pay in your own banking or wallet app. PayNow QR codes are generated on your device.

Service providers

We use Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging, Hosting and Google Analytics for Firebase) to store data, send notifications, measure usage and run the service. Google processes this data on our behalf under its Firebase privacy terms. We don't use advertising tools.

How long we keep it

Plan data is kept while the plan exists. A host can delete a plan that has no expenses, which removes its list, members, activity and messages, receipt photos and invite.
Deleting an expense also deletes its receipt photo.
Inbox notifications are deleted automatically after 60 days.
Delete account (in Profile) deletes your private profile, including your saved payment details and push tokens, and your account (and, for Apple, Chip In's access to your Apple ID). In every plan you were in, your name is replaced with "Deleted user", in the plan and its activity, and your shared payment details are removed. Expenses, receipt photos, payments and messages you were part of stay in those plans, so other members' balances remain correct. Your inbox notifications are deleted within 60 days. See Delete your account.
Leaving a plan removes you from it and puts anything you'd claimed back on the list.

Your choices and rights

You can change your name and payment details at any time, choose what each plan sees, leave plans, and delete your account in the app. For any other request, including a copy of your data, email support@otito.app.

Children

Chip In isn't directed at children under 13, and we don't knowingly collect their data.

Changes

If this policy changes, we'll update this page and the date at the top. For significant changes, we'll also say so in the app.