NeXsplit — Privacy Policy

Effective: 14 October 2026

Supersedes: the version effective 9 October 2026. What changed is summarised at the end of this policy.

NeXsplit is published by NEXT EXTRAORDINARY INTELLIGENCE COMPANY (CR 7054324269), Riyadh 13326, Kingdom of Saudi Arabia. In this policy, "we" and "our" mean that company, and "the app" means NeXsplit on iOS and Android.

Which version of the app this describes

The version currently published on the App Store and Google Play keeps everything on your device and transmits nothing. Our store listings say so: no data collected, no data shared.

This policy describes the full product, including the shared-group sync that arrives in a later version, so that you can read what we will hold before we hold it rather than after. Where a section describes something that reaches our server, it applies from the version that enables sharing a group across devices. We will update the date at the top of this policy when that version ships.

The short version

NeXsplit splits shared expenses. It does not move money, hold money, or connect to your bank.

We do not ask for your name, your email address, your phone number, or any other way of identifying you. There is no account to create and no password to forget.

We do operate a server, in the European Union, and when you share a group across devices your entries are stored there. The previous version of this policy said we did not. That was wrong, and this version says where everything goes.

Your records are yours. You can export them at any time, and you should — the export is also how you recover them if you lose your device.

What we do not collect

Being specific about this is the point; "we respect your privacy" is not information.

The app does not collect or ask for:

• your name, email address, phone number, or postal address
• your date of birth or any government identifier
• payment card or bank account details — purchases go through Apple's and Google's in-app purchase systems and we never see your payment details
• your contacts, calendar, photos, or camera — the app has no photo picker
• your precise location
• advertising identifiers; there is no advertising, analytics, attribution, or crash-reporting SDK in the app
• any biometric data

We do not sell data, and we have nothing to sell: we hold nothing that identifies you.

What identifies you instead

Two values stand in for an identity, and both are created on your own device.

A member token, generated locally the first time you open the app. It is how other members of a group refer to you and how your entries are attributed. It is not derived from anything about you. It is not secret — the people in your groups can see it, by design.

A device identifier, a hash of a signing key the app generates on your device. It does not survive reinstalling the app, and it cannot be linked to any identifier used by another app or by the operating system.

What the app holds

What you type: a display name of your choosing for each group, group names, expense descriptions and notes, amounts, currencies, dates, per-person shares, payment status, and — for a shared kitty — check-ins and votes.

We ask for a nickname rather than a real name and do not enforce it. Whatever you type is what the other members of that group see.

Alongside that, the app reads two settings from your device, and they are not the same as each other.

Your region — a two-letter country code such as SA, read once when you first open the app and used only to suggest a currency from a list held in our own code. It never leaves your device.

Your time zone — the IANA name, such as Asia/Riyadh. This is more precise than a country code. It is stored on the group so that check-ins fall on the right day, which means it travels to our server with that group's entries.

Also your language and currency preference.

On Android the app declares storage permissions. They exist so you can save and reload your own export file. They are not photo or media access.

The log, and why it is append-only

Entries are recorded as a signed, append-only log. Each entry is signed on your device, so a record cannot be altered after the fact without the signature failing. Corrections are added as new entries rather than edits — this is what lets two people who are not looking over each other's shoulders trust the same balance.

The local copy on your device is not encrypted by the app itself. It is protected by your device's screen lock and the operating system's own storage encryption.

Where our server is, and what the logs hold

Our application server and its database run in the European Union (Netherlands), operated for us by Railway Corporation. When you share a group across more than one device, the signed entries for that group are stored there so the other devices can see them. If you only ever use one device and never share a group, those entries stay on your device.

Entries reach the server over TLS 1.3. The server refuses any entry that is not correctly signed.

Our own application logs record which route was called, as a pattern, plus the response status and how long it took. They contain no member token, no group identifier, and no content. We keep identifiers out of web addresses deliberately, because the only reliable way to keep a value out of a request log is to not put it in the address.

Traffic reaches us through Railway's edge network, which writes its own request log in the United States (US West), and that log includes the IP address your request came from. We cannot change where Railway writes it. We would rather tell you it exists than describe a system we do not have.

Who else processes your data

Railway Corporation — hosting, the database, and its own operational backups, under a data processing agreement executed with us on 12 October 2026. We also keep our own daily dump of the ledger, in storage we control, in the European Union (Ireland). Railway uses its own sub-processors, which it publishes and may change; we keep a dated record of that list each time we review it and review it at least monthly.

Apple and Google — the stores you obtained the app from and, if you buy additional group capacity, the processors of that purchase. We do not receive your Apple or Google account identity.

There is no analytics provider, no advertising network, no crash-reporting service, and no support platform holding your messages.

International transfers

If you are in Saudi Arabia or elsewhere in the GCC, using a shared group means your entries are transferred to and stored in the European Union, and that the edge request log described above is written in the United States. We rely on the transfer mechanisms in our agreement with Railway, which incorporate the European Commission's standard contractual clauses.

Deleting your data

You can delete a group, or clear the app's data entirely, from inside the app at any time. Uninstalling removes the local copy.

What deletion cannot reach is an export. An export is a file, sitting on someone's device or in their own storage, and a file cannot be recalled. If you share an export, or if another member exported a group before you deleted it, that copy stays with them and nothing we build can remove it. This is the price of the export being your recovery route, and you should know it before you export rather than afterwards.

On the server, the position needs to be precise rather than reassuring.

The existence of an entry cannot be erased, because the log is append-only — that is what makes the balances verifiable, and removing entries would let anyone rewrite a shared debt. What we can and do remove on request is the text you typed: your display name, the group name, expense descriptions, and notes. Those are stored separately from the signature, so removing them leaves the signature valid and the arithmetic unchanged, and leaves no readable text behind.

Removal takes effect immediately in our live database.

Copies also exist in a second place we control. We take a dump of the ledger daily, encrypt it with a key we hold, and store it in our own storage account under a retention lock, so that a record cannot be quietly altered or lost. Those copies expire on a fixed schedule rather than being deleted on request, which means a redacted field can persist in an older archive copy for a short, bounded period after you ask for it. We will state that period here as a number once we can observe the final copy being removed, rather than inferring it from a configuration setting.

You can also ask us to remove your record from the member registry. That does not rewrite a shared ledger, because the balances belong to the group as much as to you.

We answer requests within 30 days. Write to the address below. Because we hold nothing that identifies you, we will ask you to send the request from inside the app — it is the only way we can tell which record is yours.

Your copy of your own records

The app exports everything it holds as a single file, from the settings screen. The export contains your ledger in readable form, so keep it somewhere you trust.

Export it. There are two reasons, and the second is the important one.

It is your data and you should have a copy. And it is how you recover your records if your device is lost or replaced. The operating system does not back up the app's data — that is our choice, so that nothing of yours is copied into a cloud backup you did not ask for. The consequence is real and we would rather say it plainly than leave you to discover it:

If you lose your only device and have never exported your data, we cannot recover it for you. There is no account to restore and no third party who can vouch for you, because we never learned anything about you. The export is the recovery. The previous version of this policy suggested a server backup would restore a lost ledger; that was not accurate and we have removed it.

Children

NeXsplit is not directed at children and is not intended for anyone under 18.

Changes to this policy

When the app's behaviour changes in a way that affects this policy, we update the policy before the change ships, and we say what changed rather than silently replacing the text.

Changed in this version, against the version of 9 October 2026:

• Corrected the statement that we do not operate a server. We do, in the European Union, and this policy now names the operator and the region.
• Disclosed Railway's edge request log, written in the United States, and that it includes your IP address.
• Named Railway Corporation as our processor and the date of our agreement with them.
• Stated that entries travel over TLS 1.3 and that unsigned entries are refused.
• Removed the claim that a server backup restores a lost ledger. It does not. The export does.
• Removed the claim that deleting a shared group propagates the deletion to other members' devices, and said instead what is true: an exported copy cannot be recalled by anyone.
• Separated the two device settings the app reads, because a country code and an IANA time zone are not the same precision and only one of them stays on your device.
• Replaced "we are building the ability to remove typed text" with what the system now does.
• Corrected the description of backups. We take a daily dump of the ledger, encrypt it with a key we hold, and keep it in storage we control — not only our hosting provider's operational backups. An earlier draft of this policy understated that, and the earlier published version referred to archive providers without naming what they held.

Contact

Questions, deletion requests, and reports of abuse or misuse by another member of a group:

privacy@nei.sa

NeXsplit is operated by a very small team. We read every message ourselves.