Privacy Policy

1. Who is responsible for your data

The controller for the personal data described in this notice is TNV NextGen, a sole proprietorship (eenmanszaak) at Hollywoodlaan 58, 1325 HS Almere, the Netherlands, registered with the Dutch Chamber of Commerce (KVK) under number 98216260, VAT number NL005316081B12 ("MySharedXP", "we", "us"). You can reach us at privacy@tnvnextgendigital.com.

The controller is established in the Netherlands, so no EU representative under Art. 27 GDPR is needed. For any question about your personal data, write to privacy@tnvnextgendigital.com.

2. What this notice covers

This notice applies to the MySharedXP apps for iOS and Android, the MySharedXP web app at app.mysharedxp.com and the website mysharedxp.com. It is written to meet Articles 13 and 14 of the General Data Protection Regulation (GDPR).

3. The data we process

Depending on how you use MySharedXP we process the following categories of personal data:

• Account and identity data: email address (your login), first name, last name, display name, optional phone number (used only if you enable SMS two-factor authentication), profile picture, short bio, time zone, default currency, verification status and last login time. If you sign in with Apple or Google we receive an identity token and the name and email address the provider shares with us.
• Financial and group data: the expenses you record (amount, currency, category, title, notes, date), how they are split, settlements and payments, budgets, recurring expenses, and the groups you belong to. Together this is a record of your spending and of who owes whom.
• Payment details (optional): to make settling up easier you can add up to 10 ways to be paid in Settings > Payment details: a bank account (IBAN, the account holder's name and, outside the euro area, the BIC), a payment app name or link (for example PayPal.me), or a phone number used by a payment app. Only a member who owes you money in a settlement plan sees the details you switched on, prepared by our server as a transfer to copy, a QR code or a link; a group admin sees them too when recording that member's payment for them. You can also attach a one-off payment request link (for example Tikkie or Payconiq) to an amount someone owes you, which only the two of you see. When a payment is recorded we store how it was made (for example bank transfer, cash or a payment app). MySharedXP never moves money and never receives bank logins or card details. Changing payment details needs a recent sign-in, and the app tells you when they change.
• Receipts: images you attach to expenses. A receipt often contains more than the expense itself, for example a merchant address or the last digits of a payment card. Only attach receipts you are comfortable storing. Photos are re-encoded before upload, which removes camera metadata such as GPS coordinates.
• Receipt scanning (Pro): the text on a receipt photo is read on your device, and only the recognised text is sent to our server to pick out the shop, total and date. If your device cannot read the photo, or the result is wrong, you can choose to have the photo read by our cloud provider’s AI reading service in the EU; it is never sent there unless you choose to. That service does not keep the photo and does not use it to train its models. If you report that a receipt was read wrong, we record which fields were wrong, which reader read it (your device or the AI service), which app you used and what the app noticed about the photo (for example that it was dark or had to be straightened). When you report a wrong total from your device’s read, we also record the words printed next to the amounts on the receipt, without the numbers (for example “TOTAL” or “SUMA PLN”), so we can teach the reader words it does not know yet. These words are stored apart from your account and checked by us before they are used.
• Subscription data: your subscription tier, expiry date, product identifier and the store transaction identifier, as reported by Apple, Google or Stripe. We never receive or store payment card details; the app stores handle payment.
• Support and feedback: the subject and text of support tickets and feedback you send us, your rating if you leave one, and what you choose to attach: screenshots and, if you tick "Include device logs", a log with the app version, operating system, device model, language and the app's recent technical messages. The log does not contain your expenses, receipts or passwords.
• Activity and notifications: an activity log and notifications attributed to you (for example "you added an expense").
• Friends and referrals: the people you are friends with in the app, friend requests you send or receive, and, if you use a referral code, who invited whom and when. Other people can find you to send a friend request only as your profile visibility setting allows: "Everyone" by name or email address, "Friends Only" by exact email address only, "Private" not at all. Search results show your public profile, never your email address.
• Invitations: when you invite someone who is not yet on MySharedXP by email, we store that email address with your invitation so that the person is linked to you if they sign up. The person invited is not contacted by us; you share the invitation yourself. If you invite someone, make sure they are happy to hear from you.
• Push notification tokens: if you allow notifications, the device token issued by Apple or Google is stored with your account so we can deliver notifications to that device. When someone else signs in on the same device, the token moves to their account. It is deleted when you sign out or delete your account.
• Consent records: the version of the Terms and this notice you accepted, your confirmation that you are 16 or older (18 in India), and each time you switch usage statistics on or off, with a timestamp. We keep these to prove consent (Art. 7(1) GDPR).
• Usage statistics (opt-in only): Settings has a "Share Usage Data" switch, off by default. When it is on, the app records anonymous events such as which screens you open, which features you use (for example receipt scanning or export), when a Pro feature was shown as locked, which error messages you saw, and whether you allowed notifications. Each event carries only a fixed name and a fixed value from a list our server checks, plus a random install identifier, never your account. Events contain no names, titles, notes, amounts or free text. They are deleted automatically after 13 months; because they are not linked to your account, deleting the account does not affect them and we cannot find or return them for you.
• Service statistics: once a week we count, on our servers in the EU, how the service is used as a whole, for example how many accounts were created, how many groups recorded a settlement, how many invitations were accepted and how many support tickets were opened. Only the totals leave this calculation; no list of people is created or kept.
• Advertising: adverts come from Google AdMob (Google Ireland Limited for the EEA and UK). Free accounts see a banner on the Dashboard and Groups screens, an occasional inline banner and a full-screen advert after a settlement is recorded (at most one every 30 minutes and two a day). To serve and measure ads the Google Mobile Ads SDK processes the vendor identifier of your device, your approximate location derived from your IP address, the adverts you see and tap, and technical diagnostics. We do not request the advertising identifier (IDFA / Android Advertising ID), so ads are not personalised across other companies' apps by us and we do not use tracking as defined by Apple's App Tracking Transparency framework. In the EEA and UK Google's consent form is shown before the first advert and your choices can be changed at any time in Settings > Ad privacy options. Coffee and Pro subscribers see no ads; the ad SDK is started for them only if they choose to watch a rewarded advert. Rewarded adverts are optional: an account without Pro can choose to watch one to earn one receipt scan or one group export, valid for 30 days. If you choose to watch one, we pass your MySharedXP account identifier to Google AdMob so that Google can confirm to us that the advert was watched and we can add the reward to your account.
• Siri and Shortcuts (Pro, iPhone and iPad): when you ask Siri or run a Shortcut, Apple turns your request into the action's details, for example an amount and a group, under Apple's own privacy terms. MySharedXP receives only those details, never your voice, and handles them like the same action in the app. For Pro members, the names of your groups and of the people in them are also added to your device's own search (Spotlight), which stays on the device and is cleared when you sign out.
• On-device data: preferences such as notification settings and feature flags are stored on your device and are not sent to us. Face ID / Touch ID / fingerprint unlock uses the operating system; no biometric data reaches us.
• Web app: the web app keeps your sign-in session, your display preferences (theme, text size, language), the split you used last and whether you accepted these documents in your browser's local storage. This is needed for the web app to work and is not used for tracking; signing out removes the session.
• Website: with your consent (the cookie banner) the website uses Google Analytics 4 to count visits and see which pages and languages are read and where visitors come from. Until you accept, no analytics script is loaded and nothing is sent to Google; declining leaves the site as it is. Our hosting provider (AWS) records the IP address and requested URL of each visit in short-lived server logs to operate the service.

4. Why we process it and on what legal basis

• Providing the service you signed up for (accounts, groups, expenses, splits, settlements, receipts, subscriptions, support): performance of a contract, Art. 6(1)(b) GDPR.
• Settling up through your payment details (showing them to a member who owes you, payment request links, recording how a payment was made): performance of a contract, Art. 6(1)(b) GDPR, and only for the details you choose to add.
• Keeping the service secure (login, verification codes, optional two-factor authentication, abuse prevention, server logs): our legitimate interest in a secure service, Art. 6(1)(f) GDPR.
• Reading receipts with optical character recognition (Pro feature): performance of a contract, Art. 6(1)(b), triggered only when you tap "scan".
• Anonymous usage statistics: your consent, Art. 6(1)(a) GDPR, given by enabling the toggle and withdrawable at any time by disabling it.
• Service statistics (weekly totals computed from the data above): our legitimate interest in understanding and improving the service, Art. 6(1)(f) GDPR. You can object, see your rights below.
• Advertising on free accounts: in the EEA and UK, your consent given through Google's consent form, Art. 6(1)(a) GDPR, withdrawable in Settings > Ad privacy options; elsewhere our legitimate interest in funding the free tier, Art. 6(1)(f) GDPR. Subscribing removes advertising entirely.
• Complying with legal obligations, for example tax and accounting rules for subscription revenue: Art. 6(1)(c) GDPR.
• Providing your data is not required by law. Without an email address and the data needed to record expenses we cannot provide the service.

5. Who receives your data

Other members of your groups see your display name, profile picture, the expenses you record in that group and your balance in it. That is the purpose of the app; please keep this in mind before adding someone to a group.

We use the service providers ("sub-processors") listed in the table below. We do not sell personal data. The only advertising network is Google AdMob, used for free accounts only as described in section 3. The iOS and Android apps contain no third-party analytics or crash-reporting SDK; crash reports reach us only through Apple's and Google's own opt-in reporting (App Store Connect and Android vitals in the Play Console). Push notifications on Android, a paid-plan feature, are delivered through Google's Firebase Cloud Messaging. The website uses Google Analytics only after you accept cookies (section 12).

Each provider processes personal data under a data processing agreement or, where it acts on its own account (for example Apple and Google for sign-in and store payments), under its own data protection terms. The apps contain code for a second sign-in provider that is switched off and receives no data.

6. International transfers

All account, financial and receipt data is stored in AWS data centres in Frankfurt, Germany (eu-central-1). Some providers have parent companies in the United States and may access data from there for support or operations. For those transfers we rely on the EU-US Data Privacy Framework, under which these providers are certified, and on the European Commission’s Standard Contractual Clauses. The European Central Bank receives only currency codes and dates, never personal data.

7. How long we keep it

We keep personal data only as long as the purposes above need it:

• Account and profile data: until you delete your account. Deletion takes effect at once: you can no longer sign in, and within a few minutes your data is erased, your sign-in removed and your profile replaced by an anonymous placeholder.
• Payment details: until you remove them in Settings > Payment details or delete your account; they are deleted with it. Payment request links: 30 days, after which they are deleted automatically, or earlier when you delete your account.
• Invitations to people who are not on MySharedXP: 90 days, after which they are deleted automatically, or earlier when the person signs up or you delete your account.
• Inactive accounts: if you have not signed in for more than 24 months we may delete your account as described above, after telling you by email at least 30 days beforehand.
• Expenses you delete: they disappear from the app at once and are erased for good 30 days later (the time other devices need to learn of the deletion); a receipt image is deleted at once. Settled expenses: when everyone in a group has been settled up for 30 days, and the group’s owner is on the Free plan, the settled expenses, their receipt images and the payments recorded between members are deleted in the same way (the group shows the date it was settled up); if the owner is on a paid plan (Ad-free or Pro), only the receipt images are deleted and the expenses stay as the group’s history until the group is deleted. The group shows the date of this clean-up beforehand, and any new expense or payment restarts the 30 days.
• Expenses, splits and settlements you share with others: when you delete your account they are anonymised (your name is removed and cannot be restored) so that other members’ records stay correct. Entries in a group’s activity written while you were a member (for example “Added Alex to the group”) stay visible to that group’s members.
• Receipt images: deleted with the expense they belong to or with your account, whichever comes first.
• Reports of wrongly read receipts: 90 days, after which they are deleted automatically, or earlier when you delete your account.
• Support tickets, their attachments and feedback: until you delete your account; they are deleted with it.
• Notifications and your personal activity log: until you delete your account; they are deleted with it. Activity in a group stays with that group for its members.
• Anonymous usage events: at most 13 months. They are not linked to your account.
• Subscription records: our copy is deleted with your account. Apple, Google and Stripe keep their own payment records as tax law requires; for web purchases Stripe keeps the invoices we must retain for seven years under Dutch tax law.
• Push notification tokens: until you sign out or delete your account.
• Consent records: after account deletion, in anonymised form (linked only to an internal identifier, not to your name or email), for as long as we may need to show what was agreed, at most five years (the Dutch limitation period for claims).
• Backups: at most 35 days, after which deleted data is gone from backups too.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict processing in certain cases (Art. 18);
• receive your data in a portable, machine-readable format (Art. 20);
• object to processing based on legitimate interests (Art. 21);
• withdraw consent at any time, without affecting processing that happened before you withdrew it (Art. 7(3));
• lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. Our lead supervisory authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

9. How to exercise your rights

• Export your data: in the app, go to Settings > Account > Export Data to download a JSON file with the data you entered: your profile and settings, your groups with their expenses and members, friends, budgets, recurring expenses, your support messages and your consent choices, with people and groups by name. For a complete copy of all personal data we hold about you, including the records the app keeps itself (activity, notifications, purchase history), email privacy@tnvnextgendigital.com.
• Delete your account: in the app, go to Settings > Danger Zone > Delete Account; in the web app, Settings > Danger zone > Delete account. This removes your account and personal data as described in section 7.
• Correct your data: edit your profile in Settings.
• Withdraw consent to usage statistics: switch off "Share Usage Data" in Settings.
• Everything else, or if you cannot access the app: email privacy@tnvnextgendigital.com. We answer within one month; we may ask you to confirm your identity first.

How to delete your account, with or without the app

10. Automated decision-making

The settlement optimiser suggests the smallest set of payments that clears a group’s balances. It is a calculation you can ignore or override, has no legal or similarly significant effect on you, and we do not profile users. No decisions under Art. 22 GDPR are made.

11. Children

MySharedXP is not directed at children. You must be at least 16 years old to create an account. In India you must be at least 18, because Indian law treats people under 18 as children. If you believe a child under 16 has created an account, contact privacy@tnvnextgendigital.com and we will delete it.

12. Cookies, local storage and tracking

The website sets analytics cookies (Google Analytics 4, Google Ireland Limited) only after you choose "Accept" in the cookie banner. "Decline" sets nothing and the site works the same. Your choice is kept in your browser's local storage for 12 months and can be changed at any time with "Cookie settings" in the footer. With your consent Google receives a truncated IP address, the pages you view, your approximate location and device details; Google Signals and advertising features are switched off and the data is kept for 2 months. The website loads no other third-party scripts or fonts.

The web app stores only what it needs to work in your browser (see section 3, "Web app"). Storage that is strictly necessary for a service you asked for does not require consent under the Dutch Telecommunications Act (art. 11.7a); we use none for tracking or advertising.

13. Security

Data is encrypted in transit (TLS) and at rest on AWS. Access to production systems is restricted and logged. You can add two-factor authentication to your account and lock the app with Face ID, Touch ID or fingerprint.

14. Additional information for people in the United States, Canada and India

The rest of this notice applies to everyone. This section adds what the laws of these countries ask for. If anything here conflicts with the rest of the notice, this section applies to people in that country.

15. Changes to this notice

When we change this notice we update the date at the top of this page. If a change materially affects how we use your data we will also tell you in the app or by email before it takes effect.

This notice is also available in other languages. Those versions are AI translations; if they differ from this English text, the English text prevails.