Privacy Policy

Effective October 1, 2026

Chipp helps you split expenses with friends and settle up afterwards. To do that we handle some genuinely sensitive information — who you owe, what you spent, and, if you link a bank, what you buy. This policy explains, in plain English, what Chipp Inc. collects, why, who we share it with, how long we keep it and what you can do about it.

Section 01Who we are and what this covers

Chipp Inc. (“Chipp,” “we,” “us”), a Delaware corporation, is the controller of the personal information described here. This policy covers the Chipp apps for iOS and Android, the chipp.it website, our public share pages for expenses and receipts, and our support and messaging channels (together, the “Service”).

It does not cover the practices of companies we do not control. When you tap through to Venmo, Cash App, Zelle or PayPal, or when Plaid or Stripe collects information directly from you inside their own flows, those companies handle that information under their own privacy policies — the Plaid End User Privacy Policy and the Stripe Privacy Policy are the two most likely to matter to you. Section 8 lists who they are.

Using the Service means this policy applies to you. It is incorporated into our Terms of Service.

Section 02Information you give us

Most of what we hold is what you type, upload or choose to record.

Account and profile

Your name, email address, phone number (which we verify by SMS one-time code), date of birth, an optional profile photo, your country and default currency, and your sign-in method — Google, Apple, or an email address and password. We collect date of birth because our payment processor requires it for age and identity checks on anyone who can receive money.

Payment handles

Any Venmo, Cash App, Zelle, PayPal or non-U.S. handle (UPI, Pix, PayNow, PromptPay, DuitNow, PayID, Interac) you save so friends can pay you outside Chipp. These are stored as you enter them and shown to the people you share expenses with.

What you record in the app

Expenses and their amounts, dates, categories, notes, currencies and splits; who paid and who owes; groups, friend rooms and their membership; group chat messages; budgets and goals; money pools you create or join; settlements you mark; and activity that flows from all of it.

Receipts and files

Receipt photos, camera captures and PDFs you upload for scanning, along with the line items, merchant, totals and taxes extracted from them, and any other file you attach to an expense.

Messages to us

Support emails, bug reports, feedback and anything you include in them, including screenshots.

Section 03Information from linked accounts

If you connect a bank account or card, or move money, information reaches us from our payment partners.

From Plaid

When you link an institution through Plaid we receive: the institution and account details (account name, type, masked account number, and the routing and account information needed to debit or credit the account), balances, transaction history (amounts, dates, descriptions, merchant names and categories — which is what powers splitting from a past card transaction, budgets and CFO insights), and identity information your bank holds, such as the name, address, email and phone on the account. Where you complete identity verification through Plaid IDV, we receive the verification result and the associated identity attributes. Plaid’s own handling of this information is described in the Plaid End User Privacy Policy.

From Stripe

When you send, receive or withdraw money we receive payment and payout records — amounts, currencies, timestamps, status, the last four digits and brand of a card, the masked destination account, fees, refunds, returns and chargebacks — and the status and results of identity verification for your connected account, together with the outcome of any risk or compliance review. Stripe’s own handling of this information is described in the Stripe Privacy Policy.

Section 04Information collected automatically

Like any app, Chipp records some technical information as you use it:

• Device and app: device model, operating system and version, app version and build, language, time zone, screen characteristics, and a device or installation identifier.
• Network: IP address, which also gives an approximate, city-level idea of where a request came from, and which we use for security and fraud detection.
• Diagnostics: crash reports, error logs, performance traces and, where you send one, a diagnostic report you choose to share.
• Usage events: which screens you open, which features you use, whether a flow succeeded or failed, and similar product analytics, recorded through PostHog and Google Analytics.
• Approximate location: only where the operating system requires a location permission in order to scan for Bluetooth devices. Chipp does not collect continuous or background precise location, and does not track your movements.

Section 05Contacts and Bluetooth

Contacts

If you choose to add people from your address book, Chipp asks for the contacts permission. We access your contacts only with that permission and only to help you find and add the people you select — matching the person you pick against existing Chipp users and pre-filling a name or phone number for an invite. We do not upload your whole address book for marketing, we do not sell it, we do not use it to build profiles of people who are not Chipp users, and we do not message people you have not chosen to contact. You can decline the permission and add people manually, and you can revoke it in your device settings at any time.

Bluetooth

Nearby discovery uses Bluetooth Low Energy and runs only when you open it. While it is running, your device advertises a limited, rotating identifier that lets another Chipp user’s device recognise you as discoverable and, once you both accept, connect your accounts. The advertisement does not include your name. We do not log where you are, we do not keep a history of who was near you, and the feature is entirely optional — decline the permission or leave Bluetooth off and the rest of Chipp still works. On Android, the operating system may require a location permission for any app to scan for Bluetooth devices; granting it for this purpose does not mean we use your precise location for anything else.

Section 06How we use information

We use the information described above to:

• Operate the Service — create and maintain your account, record expenses and splits, keep balances up to date, run groups and chat, scan and itemize receipts, produce budgets, charts and summaries, and deliver the activity feed and share links you create.
• Move money — initiate and settle payments, top-ups, payouts and pool contributions and refunds through our payment partners, apply and display fees, and handle returns, reversals and chargebacks.
• Verify identity and prevent fraud — confirm you are who you say you are, screen against sanctions and restricted-party lists, detect and investigate suspicious activity, enforce limits, and protect you, other users and Chipp from loss.
• Comply with law — meet financial, anti-money-laundering, tax, record-keeping and reporting obligations that apply to us and to our payment partners, and respond to lawful requests.
• Provide support — answer your questions, investigate bugs and resolve problems with a payment or an account.
• Understand and improve the product — analyse how features are used in aggregate, measure whether a change worked, fix what is broken and decide what to build next.
• Personalize insights — generate budgets, spending summaries and CFO insights from your own expense and transaction data, and time notifications sensibly.
• Send notices — verification codes, security and account alerts, payment confirmations, reminders and nudges you or a friend triggered, subscription notices, and product updates you have not opted out of.

We may create aggregated or de-identified information that cannot reasonably be used to identify you, and use it for any lawful purpose, including improving the Service and describing it publicly. We do not attempt to re-identify it.

Section 07AI processing

Chipp’s AI features — receipt scanning, Chipp AI questions and drafts, spending summaries, charts and Sankey diagrams, budget observations and CFO insights — run on Google Cloud’s Vertex AI and Gemini models.

When you use one of those features, we send Google what the model needs to answer:

• the prompt text you typed;
• the receipt image, camera capture or PDF you uploaded, when you are scanning or itemizing;
• the account context needed for the answer — for example the expenses, balances, categories, group members or, where you have linked accounts, the transaction records relevant to the question you asked or the insight being produced.

Google processes this as our service provider under its enterprise cloud terms. As we have the service configured, your prompts, files and responses are not used to train Google’s foundation models, and Google is contractually restricted to processing the data to provide the service to us. Google may retain content briefly for abuse monitoring and operational purposes as described in its enterprise documentation.

Section 08How we share information

Service providers

We share information with companies that perform work for us under contract, only as needed to do that work:

These providers are bound by contract to protect the information and to use it only for the services they provide to us.

Other Chipp users

Chipp is a shared product, so some information is visible to the people you use it with. Other users can see your name and profile photo, the expenses, splits, balances, groups and rooms you share with them, the chat messages and notes you post there, any payment handles you have saved, and whether a settlement has been recorded. Someone who searches for you by phone number or email, or who discovers you through nearby Bluetooth while you have it open, can see that a Chipp account exists and send a request. People do not see your bank details, your card numbers, your transaction history, your budgets, your CFO insights, your date of birth or expenses in groups they are not part of.

Public share links

A shareable expense link (chipp.it/e/<slug>) or receipt link (chipp.it/<slug>) that you create is viewable by anyone who has the URL, including people without a Chipp account, and links can be forwarded. The page shows the expense or receipt and the information needed to pay it. Only create a link you are comfortable being seen by whoever receives it.

Legal and safety

We may disclose information where we believe in good faith it is necessary to comply with a law, regulation, subpoena, court order or lawful government request; to enforce our Terms; to detect, prevent or address fraud, security or technical problems; or to protect the rights, property or safety of Chipp, our users or the public. Where we are permitted to tell you about a legal request, we will try to.

Business transfers

If Chipp is involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of assets, your information may be transferred as part of that transaction. We will require the recipient to honor this policy, or we will notify you before your information becomes subject to a materially different one.

With your direction

We share information in other ways when you ask us to — for example when you tap through to a third-party payment app with a handle prefilled.

Section 09Legal bases and why we need this data

Not all of the information we hold is optional, and it is worth being clear about which is which.

To perform our contract with you. Account details, expenses, splits, groups, chat, receipts and payment records are what the Service is made of. Without them we cannot provide it.

To comply with legal obligations. Identity information, date of birth, verification results and transaction records are collected and retained because financial, anti-money-laundering, sanctions, tax and record-keeping laws require it of us and of our payment partners. This information cannot be deleted on request while those obligations run.

For our legitimate interests, balanced against your rights — preventing fraud and loss, securing the Service, understanding how features are used, improving the product, and communicating with you about your account.

With your consent, which you can withdraw at any time — access to contacts, Bluetooth, the camera and photo library, push notifications, optional promotional messages, and the opt-in proactive assistant.

If you are in a jurisdiction whose law uses this framework, these are the bases we rely on. Withdrawing consent does not affect processing carried out before you withdrew it.

Section 10Your choices and rights

Controls inside the app

• Delete your account from the profile screen. This is self-serve and does not require contacting us. Withdraw any Chipp Balance and settle open payments first.
• Unlink a bank or card at any time, which revokes Plaid’s ongoing access to that institution on our behalf and stops new transaction data flowing in.
• Turn off push notifications in Chipp’s settings and in your device settings.
• Revoke permissions — contacts, Bluetooth, camera, photos — in your device settings.
• Edit or delete content — expenses, receipts, notes and your profile details.

Messages

Reply STOP to any Chipp text message to stop texts, and HELP for help. Use the unsubscribe link in a marketing email to stop promotional email. Essential account, security, legal and transaction notices continue through another channel, because we are required to be able to reach you.

Your rights over your information

Wherever you live in the United States, you can ask us to:

• Know and access the personal information we hold about you, the categories of sources, the purposes, and the categories of third parties we disclose it to;
• Correct information that is inaccurate;
• Delete your personal information, subject to the retention we are legally required to apply (see Section 11);
• Receive a portable copy of information you provided to us, in a machine-readable format;
• Opt out of any sale, sharing for cross-context behavioral advertising, or profiling with legal or similarly significant effects — none of which we do;
• Limit the use of sensitive personal information to what is necessary to provide the Service, which is already how we use it.

To make a request, email support@chipp.it from the address on your account, or use in-app account deletion for deletion. We will verify your identity before acting — usually by confirming control of your account email or phone — and will respond within the time the applicable law allows, generally 45 days, extendable once where permitted.

California residents (CCPA/CPRA)

California residents have the rights listed above, including the right to know, delete, correct, opt out of sale or sharing, and limit the use of sensitive personal information. In the preceding twelve months we collected the categories of personal information described in Sections 2–5 — identifiers, commercial and financial information, internet and device activity, approximate geolocation, audio and visual information in the form of uploaded images, and inferences drawn from expense and transaction data — for the purposes described in Section 6, and disclosed them for business purposes to the categories of recipients in Section 8. We did not sell or share personal information for cross-context behavioral advertising.

We will not discriminate against you for exercising any of these rights. You will not receive a different price, a lower level of service, or a reduced feature set because you made a request. An authorized agent may submit a request on your behalf with written permission signed by you, and we may still ask you to verify your own identity directly.

Virginia, Colorado, Connecticut, Utah and other states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have comparable rights of access, correction, deletion, portability and opt-out, and we honor them for all U.S. users regardless of the state you live in. We do not process personal information for targeted advertising, sale, or profiling that produces legal or similarly significant effects, so those opt-outs have nothing to act on.

If we deny your request

We will tell you why — most often because a financial record must be retained by law, or because we could not verify that the request came from you. You may appeal by replying to our decision or writing to support@chipp.it with the subject “Privacy Request Appeal.” A different reviewer will consider the appeal and respond, within 45 days or the period your state’s law requires, explaining the outcome and its reasons. If we deny the appeal, you may contact your state attorney general.

Section 11Data retention

We keep personal information for as long as your account is active and for as long afterwards as we need it for the purposes described in this policy.

When you delete your account, we delete or de-identify your profile, your expense and receipt content, your chat messages and your analytics identifiers on our normal schedule, and remove them from live systems promptly. Encrypted backups age out on their own cycle.

Shared content behaves differently: an expense or group you created with other people remains part of their records after you leave, because it is their financial history too. Where that is the case, we minimise what identifies you.

Section 12Security

We protect information with measures appropriate to how sensitive it is:

• Encryption in transit using TLS for all traffic between the app and our servers and between us and our providers, and encryption at rest for data stored in our databases, object storage and backups.
• Tokenization of financial credentials — we hold Plaid access tokens and Stripe payment tokens rather than bank passwords or card numbers.
• Firebase App Check and other integrity controls, so that our backend responds to our genuine apps rather than to scripted clients.
• Access controls — least-privilege access for staff, authentication requirements for administrative systems, and logging of access to production data.
• Device-level protection you control, including Face ID, Touch ID or passcode lock inside Chipp.

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. Protect your side of it: use a strong, unique password, keep a lock on your phone, turn on Chipp’s app lock, and tell us at support@chipp.it immediately if you think your account has been compromised. Where a breach affecting your information occurs, we will notify you and the relevant authorities as the law requires.

Section 13Children

Chipp is intended for adults. The Service is for people aged 18 and over, and we do not knowingly collect personal information from anyone under 18. We do not direct the Service to children, and we do not knowingly sell or share the personal information of anyone under 16 — we do not sell or share personal information at all.

If you believe a person under 18 has created an account or given us information, email support@chipp.it and we will close the account and delete the information promptly, subject only to records we are legally required to retain.

Section 14International users and transfers

Chipp is designed and offered for use in the United States, and our servers and our principal service providers are located there. Your information is processed and stored in the United States, and some providers may process limited data in other countries where they operate.

If you access the Service from outside the United States, you do so on your own initiative and you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those of your country. Non-U.S. payment rails in Chipp are handle-based only and do not involve us processing payments abroad. We do not target the Service to residents of the European Economic Area, the United Kingdom or Switzerland, and it is not designed to meet the requirements of those jurisdictions.

Section 15Cookies and similar technologies

On chipp.it and our share pages, we use cookies and similar technologies that are necessary to make the site work — keeping a session, remembering a preference, protecting against abuse — together with analytics cookies from Google Analytics and PostHog that tell us, in aggregate, how the site is used. We do not use advertising or cross-site tracking cookies.

You can block or delete cookies in your browser settings; necessary cookies are required for parts of the site to function. Some browsers send a Global Privacy Control or “Do Not Track” signal; we honor a Global Privacy Control signal as an opt-out of sale and sharing, though as noted we do not sell or share personal information in the first place.

In the apps, the equivalent role is played by SDK identifiers and event logging from PostHog, Google Analytics and Firebase, described in Section 4. You can limit tracking identifiers at the operating-system level through your device’s privacy settings.

Section 16Changes to this policy

We update this policy when the product, our providers or the law change. The effective date at the top always reflects the current version.

If a change is material — a new category of information, a new purpose, or a new kind of sharing — we will give you notice in the app, by email or by push notification before it takes effect, and where the law requires your consent, we will ask for it. Continuing to use the Service after the effective date means the updated policy applies to you.

Section 17Contact us

Questions about this policy, about what we hold, or about a privacy request — including an appeal — can be sent to us at:

Email: support@chipp.it
Mail: Chipp Inc., [ADDRESS], United States

Please write from the email address on your account where you can, so that we can verify the request quickly. Our Terms of Service explain the rest of the agreement between us.