Privacy Policy

1. Zero-Account-Required Design

Pumpkin Slices is built from the ground up for frictionless privacy. We do not require account registration, email sign-ups, or social logins to create or manage expense-splitting groups. Group security relies on optional passcode protection.

We offer an optional account feature using Google or Apple Sign-In for users who want cross-device group sync. Creating an account is entirely voluntary and does not affect core functionality.

2. Information We Collect

When you create or participate in a group, we store minimal operational data necessary to calculate expense balances:

• Group Data: Group title, member names, expense items, amounts, categories, and timestamps.
• Security Hashes: Group passcodes are stored as salted one-way hashes (`passcode_hash`) and cannot be decrypted by anyone.
• Payment Data: Payment details for tier upgrades are handled exclusively by Stripe. We never collect, transmit, or store credit card numbers.
• Account Data (optional): If you choose to sign in, we store your display name, email address, profile photo URL, and a list of group IDs you have linked to your account. This data is sourced from your Google or Apple identity provider and stored privately in Firebase Firestore under your unique user ID.

3. Data Retention & Group Cleanup

To maintain database hygiene and privacy, inactive groups undergo automated lifecycle cleanup:

• Free Tier Groups: Retained for up to 1 year of inactivity before automatic permanent cleanup.
• Unlocked Tier Groups ($1.99): Retained for up to 2 years of active access.

4. Data Sharing & Third Parties

We do not sell, rent, or trade your group data or member information to advertisers or third parties. We utilize trusted infrastructure providers:

• Stripe: Payment processing infrastructure for group tier upgrades.
• Firebase Authentication: Google and Apple Sign-In identity verification for optional accounts. Firebase Auth receives your name, email, and profile photo from your identity provider.
• Firebase Firestore: Cloud database hosting for real-time group sync and account data storage.

5. Data Security & Encryption

We implement industry-standard safeguards to protect your group data:

• Transport Encryption: All traffic to and from the platform is encrypted using 256-bit SSL/TLS secure protocols.
• One-Way Passcode Hashing: Group passcodes are cryptographically hashed on our servers, preventing plain-text access or recovery by anyone.
• Payment Handling: PCI Service Provider Level 1 integration ensures credit card details never pass through or get stored on Pumpkin Slices servers.

6. Account Data & Deletion

If you create an optional account, you may unlink individual groups from your profile at any time via the Account page. To request full account deletion (including your profile and all group associations), please contact our support team. Account deletion does not affect the underlying group data, which remains accessible to other group members via passcode.

7. Contact Us

If you have questions regarding this Privacy Policy or data retention, please contact our support team at Support Page.