PayBack — Privacy Policy

Last updated: 17 August 2026

PayBack ("the app") is a bill-splitting tracker. It records who owes what after a shared bill — it never moves money and never touches a payment network. This policy describes the little data the app handles.

Accounts are optional

PayBack works fully without an account. On first launch the app generates a random identifier for your device — no name, no email, no phone number. A device never holds an email address at all; only an account can, and only if you add one.

You may optionally create an account so your splits survive changing phones. An account stores only: your full name, a username, a one-way hash of your 6-digit PIN (never the PIN itself), your optional payout details, and — only if you add one — an email address. We never ask for a phone number. To block PIN guessing, too many wrong PINs in a row temporarily locks the account.

A forgotten PIN cannot be reset, and adding an email does not change that. The address is used to send you notifications and for nothing else: it is not a recovery channel, and there is no way to sign in with it. That is deliberate — an inbox that could unlock an account would make the PIN decorative.

Data you may choose to provide

• Full name (only if you create an account) — shown to the people you split bills with, same as a display name.
• Username (only if you create an account) — used to sign in. It is not shown to the people you split bills with.
• Display name (optional) — shown to people you split bills with.
• Payout details (IBAN and account-holder name) (optional) — shown only to participants of your bills so they know where to send their share. PayBack never uses these details to move money.
• Profile photo (optional) — a small 300×300 version, stored with our image host Cloudinary, who process it on our behalf. Your phone shrinks the photo before it's sent and we don't keep the original. It's shown to the people you split bills with — and, if you link yourself to a seat in someone's group, to that group's owner. Removable at any time from the You screen: we delete it from our records straight away and ask Cloudinary to delete their copy.
• Email address (optional, account holders only) — used only to send you notifications about your own splits: someone sends you money, someone confirms you are square, a group session lands, or somebody asks to link you to their group. We confirm the address first by sending it a link, so nobody can sign you up for mail you did not ask for. It is never shown to the people you split bills with, never shared, never sold, and never used for marketing. Every email carries an unsubscribe link, and you can remove the address entirely from the You screen. We do not use read receipts, tracking pixels or click tracking in any email we send. Our email provider, SendGrid (Twilio), processes the message on our behalf in order to deliver it.
• Support messages (only when you write to us) — if you use Help & Support on the You screen, we store what you typed, the email address you gave us so we can reply, which phone and account it came from, and whether you were on iOS, Android or the web. That address is used for one thing only: answering you. It is never added to any mailing list, never shown to the people you split bills with, and nothing else in PayBack ever sends to it. Unlike the address above, you do not need an account to write to us — so this one is not confirmed, and it is not used for anything that would matter if it were mistyped.
• Bill data — amounts, titles, and payment confirmations for the splits you create or join.

What we don't do

• No advertising and no ad networks.
• No analytics or tracking SDKs.
• No selling or sharing of data with third parties.
• The camera is used to scan a bill's QR code, and — only if you choose to add a profile photo — to take one. A QR scan is never stored. You can also pick an existing photo from your library instead; we only ever receive the one photo you pick.
• No access to your contacts or location.

Where data lives

Bill data is stored on our server (hosted on Railway) so that everyone at the table sees the same live status. Data is transmitted over HTTPS.

Deleting your data

Deleting the app removes the device identifier from your phone. If you never created an account, that permanently orphans your data on our server — email us at the address below with your device name and we will remove it.

If you have an account, deleting the app is not the same as deleting your data: your splits stay with your account and come right back the moment you sign in again on any device, including a fresh install. To delete the account itself, open You → Edit → Delete Account and confirm with your PIN. It happens immediately and cannot be undone.

Deleting your account erases your name, username, PIN, bank details and profile photo, unlinks every device signed into it, and removes you from any group ledgers you were linked to.

What it does not do is alter the splits you were part of. Those belong to the other people at the table as much as to you: the amounts, who paid and what is still outstanding all stay exactly as they were, so nobody's record of who owes what changes because you left. We keep an empty placeholder record so those splits still add up, holding no information about you — on them your name reads "Deleted account".

A profile photo, if you added one, is included in either deletion — we remove it from our records and ask Cloudinary to delete their copy too.

If you would rather we handled it, or you have lost access to your PIN, email us at the address below and we will do it for you.

Contact

Questions or deletion requests: en.ahmed.samy@gmail.com