Privacy Policy
Last updated: 5 September 2026
Squared is an app for splitting shared expenses in a group. This policy
explains what personal data the app collects, why it is collected, who
it is shared with and what rights you have over it. It covers the
Squared iOS and Android apps and the service behind them at
kvitt.aaronclauss.se.
Squared has no advertising, no analytics or tracking SDKs, and no third-party trackers. Your data is never sold, rented or used for profiling or marketing.
Who is responsible
The data controller is Aaron Clauss, who develops and operates Squared as an individual. For any question about this policy or about your data, write to [email protected].
What is collected
Account information
When you create an account, the service stores your name, email address and whether that address has been verified. If you sign up with an email and password, only a cryptographic hash of the password is kept — never the password itself. If you use Sign in with Apple, Apple sends an identifier and an email address (which may be Apple's private relay address), and no password is stored at all.
You may optionally add a profile picture and a phone number. The picture is stored as an image file on the server. The phone number is used for one purpose only: opening a Swish payment addressed to you — see Who your data is shared with.
Sign-in sessions
Each active sign-in creates a session record holding a session token, its expiry, and the IP address and device user-agent string that the request came from. These identify the session and let sign-in attempts be rate-limited so one caller cannot lock out everybody else.
What you record in the app
The purpose of the app is to keep a shared ledger, so it stores the content you and your group create: groups and their names, emoji and currency; group membership and roles; invitation links; expenses with their description, emoji, amount, currency, exchange rate, who paid and how the cost is split; recorded settlements and settlement requests between members; and a group activity log of who did what and when.
Push notifications
If you allow notifications, the app registers a push token with the service along with the platform (iOS or Android) and when the device was last seen. The token is deleted when you turn notifications off or delete your account.
Server logs
The web server and the network layer in front of it process ordinary request data such as IP address, timestamp, requested path and user-agent, for security and troubleshooting. These logs are short-lived and are not used to build any profile of you.
Why it is collected, and on what legal basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Providing the app: your account, your groups, your ledger | Account information, group and expense content | Performance of a contract, Art. 6(1)(b) |
| Keeping you signed in and securing the service | Session records, IP address, user-agent, server logs | Legitimate interests, Art. 6(1)(f) — running a secure service |
| Sending you notifications about your groups | Push token, platform, notification content | Consent, Art. 6(1)(a) — granted in the system prompt, withdrawn any time in settings |
| Opening a Swish payment to a person you owe | That person's phone number and the amount | Performance of a contract, Art. 6(1)(b); the number is shown only to a group member who owes you money |
Who your data is shared with
Other people in your groups
Squared is a shared ledger, so the other members of a group can see your name and profile picture, the expenses you add, what you paid, what you owe, the settlements you record and your entries in the group's activity log. People who are not in a group with you cannot see any of it.
Your phone number is an exception to the app's normal rule that no user can read another user's number: it is released to a group member only at the moment they open a Swish payment to settle a debt they owe you, and only to that member.
Service providers
| Provider | What they process | Where |
|---|---|---|
| Supabase (database hosting) | The application database — everything described above | EU (Ireland) |
| The application server, self-hosted | Requests, server logs, uploaded profile pictures | Sweden |
| Cloudflare (DNS and network in front of the server) | Request metadata such as IP address and requested path | Global network, EU entry points |
| Apple (Sign in with Apple) | Your Apple sign-in, if you use it; and delivery of push notifications to iOS devices | USA and EU |
| Expo push notification service (650 Industries, Inc.) | Push tokens and the text of each notification, which can include a group member's name, an expense description and an amount | USA |
| Frankfurter (currency exchange rates) | Nothing about you — only a currency pair, requested by the server | EU |
Transfers outside the EU/EEA — push delivery, and Apple sign-in — rely on the European Commission's standard contractual clauses or an adequacy decision, as applicable to each provider. Data may also be disclosed where the law requires it.
How long it is kept
Your account and the content in your groups are kept for as long as your account exists. Sessions expire on their own. Push tokens are removed when a device stops being used or notifications are turned off.
You can delete your account from the profile screen in the app. When you do:
- your credentials are deleted — password hash, Apple connection, sessions and push tokens;
- your name, email address, phone number and profile picture are erased, leaving only an opaque identifier; former group members see “Borttaget konto” (deleted account) where your name used to be;
- groups with no other members are deleted outright, along with their expenses, splits, settlements, invitations and activity log;
- expenses and settlements in groups that other people are still in are kept, without your identifying details. They are the record of what the other members owe each other, and erasing them would silently rewrite someone else's balance. This is the balancing of rights under GDPR Art. 17(3).
If you want anything beyond that removed, write to [email protected].
Security
All traffic between the app and the server is encrypted with TLS. Passwords are stored only as hashes. Every request is authenticated against your session, and group membership is checked on every read — the server does not answer questions about a group you are not in. Uploaded profile pictures are stored on the application server, not in the database. No system is perfectly secure, but data is kept to what the app actually needs.
Your rights
Under the GDPR you have the right to access your data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, and to receive your data in a portable form. Where processing is based on consent, you may withdraw it at any time — turning off notifications in your device settings does exactly that.
To exercise any of these, write to [email protected]. If you believe your data is being handled unlawfully you may complain to the Swedish Authority for Privacy Protection, IMY, or to the supervisory authority in your own country.
Children
Squared is not directed at children and is not intended for use by anyone under 13. No account is knowingly created for a child under that age; if you believe one has been, write to the address above and it will be removed.
Changes to this policy
This policy may be updated as the app changes. The date at the top always shows the current version, and significant changes will be announced in the app.