Privacy Policy

What Quota collects, why, where it stores it, who it shares it with and how you can delete it.

Updated on 28 October 2026

This is a translation. If it differs from the Italian version, the Italian version prevails.

1. Data controller

The data controller is Giuseppe Ferrara, developer of Quota. For any privacy request, write to gferrara8596@gmail.com. We have not appointed a data protection officer (DPO): given the size of the service, the law does not require one.

2. What data we process

What we don't process: card numbers, banking credentials, passwords (sign-in is passwordless), address book contacts, location, advertising data (IDFA or Android advertising ID), health or biometric data. In-app purchases are handled by Apple and Google Play: we don't see your payment details. Please don't write special categories of data (health, religion, political opinions and the like) in descriptions and messages.

3. Where and how we store data

• Service database: accounts, groups, expenses, balances, messages, payment details, notifications and feedback are stored on Supabase, in an Amazon Web Services data center in London (United Kingdom, eu-west-2 region).
• Attached receipts and profile photos: stored on Cloudflare R2, in storage under European Union jurisdiction. Apps downloaded before version 1.1 may still read older receipts from Supabase storage, also in London.
• On your phone: the app keeps a temporary copy of what you see and of expenses entered offline, so it works without a connection. It's cleared when you sign out. On Android phones the app's automatic backup is turned off.

How we protect it. Data is encrypted in transit (TLS) and on the providers' disks. Payment details are encrypted a second time in the database. Every read goes through access rules: you only see the groups you belong to, and every change goes through server functions that check who you are. Receipts open through temporary links, valid for ten minutes, that the server only issues to group members; profile photos through links valid for one hour, issued only to people allowed to see them. Access to the administration tools is restricted to the controller.

Your first name, last name and nickname can only be seen by the people you share a group or event with and, for your nickname and personal code, by people who search for you according to your profile's discoverability settings (“Who can find me”). To find you by email, people have to type it in full: we don't show partial results. You can change this data at any time from your profile.

Your profile photo can be seen by you and only by the people you share an active group or event with; people who find you through search see your initials until you're in the same group. You can change or remove it at any time from Profile → Edit profile: the previous photo is deleted right away.

4. Other people's data and content

What you see of others. In groups and on people's pages you see data that we didn't write and don't control: other members' names, nicknames, profile photos and bios, the names they gave to people without the app, expenses and their descriptions, the receipts they attached, the messages they send you and those that come with payments, the payment details of people asking you for money. They are entered by the people who use the app, under their own responsibility: Quota stores them and shows them to you, but doesn't verify them and can't guarantee they are true, correct or appropriate.

What others see of you. Everything you write in a group (expenses, descriptions, receipts, payments) is visible to the other members of that group: that's the purpose of the service. Members of your groups and events can see your profile photo. Messages are only seen by the person you write to. Payment details are only seen by people who owe you money in a group with you. Nobody sees your “Personal” expenses.

People without the app. You can add someone who doesn't have the app to a group, giving their name and, if you want, their email to invite them. Only do this if you have reason to believe that person agrees: in this case it's you who gives us their data. If you gave their email, they receive an invite with a summary; when they sign up with that email they can “claim” their place in the group. Anyone added without knowing it can write to us to have their email removed.

Responsibility and reports. We don't review content before it's published and we are not responsible for content entered by other users, including violent or offensive content, content inciting hatred or otherwise unlawful content. If you find any, report it from Profile → “Report a user or a problem” (also from Settings → Privacy): your mail app opens with an email ready for quotaapp@icloud.com, to which you can attach screenshots. The report doesn't go through Quota's servers: you send it yourself, from your own address. Screenshots may contain other people's data: only attach them if they help the report. We review it and may remove the content and suspend or close the account of whoever entered it, as set out in the terms of use. We don't tell the reported person who reported them.

5. Why we process data and on what basis

• Providing the service: account, groups, expenses, balances, messages, notifications, receipts, payment details, invites. Basis: performance of the contract (art. 6.1.b GDPR).
• Managing Quota Pro subscriptions bought in the past (none are sold today). Basis: contract.
• Reading receipts when you ask. Basis: contract (see §6).
• Email invites to people without the app, when a member provides their address. Basis: the members' legitimate interest in keeping the group's accounts (art. 6.1.f), with the right of the invited person to object.
• Security, abuse prevention, crash reports and fault diagnostics. Basis: legitimate interest (art. 6.1.f); you can object by turning off crash reports in the settings.
• Usage statistics to understand which features are useful and how fast the app is. Basis: your consent (art. 6.1.a GDPR and art. 122 of the Italian Privacy Code), which you give by turning on the switch in the settings and can withdraw whenever you want.
• Handling reports, including using other people's data contained in the report and in the screenshots. Basis: legitimate interest in keeping the service safe and legal obligations on unlawful content (art. 6.1.f and 6.1.c).
• Responding to your feedback and requests. Basis: legitimate interest in improving the app and, for requests about your rights, legal obligation.
• Legal obligations, for example tax rules for subscriptions (handled by Apple and Google) or replying to requests from authorities. Basis: legal obligation (art. 6.1.c).

We don't make automated decisions about you with legal effects. Balances are calculated automatically, but it's just arithmetic on the expenses you entered.

6. Receipt reading

When you scan a receipt on iPhone, Quota reads it on your device, with Apple's models; if that fails it may use Apple Intelligence in Apple's cloud (Private Cloud Compute), under Apple's rules. On Android, Quota reads the amount and date on the phone with Google ML Kit text recognition.

For reading, the image is not sent to our servers and Quota doesn't keep it. The server only receives a log of the reading: which method did it, how reliable it is and the result read (merchant, date, amount, line items). We remove the result after 30 days; the log stays to count readings. If you choose to attach the photo to the expense, it's saved as an attached receipt (see §3).

Quota also has a cloud reading with Anthropic's Claude, which today is turned off for everyone: no image is sent to Anthropic. If we turn it back on, we'll update this policy first and tell you in the app.

The result may contain errors: always check it before saving the expense.

7. Usage statistics and crash reports

Quota uses Google's Firebase. In the settings (Profile → Settings → Privacy) you'll find two separate switches:

• Usage statistics (Firebase Analytics and Performance Monitoring), off until you turn them on: usage events with types and counts, for example “expense added, split equally, 3 participants”, the screens opened, loading and network response times;
• Crash reports (Firebase Crashlytics), on until you turn them off: the type of error, the server function involved and the state of the phone when the fault happened, without the content of requests.

They come with a pseudonymous identifier of your account (a random code, not your name or email), an installation identifier, device model, system and app version. Never names, emails, descriptions, amounts, messages or payment details. We don't collect the advertising ID and don't use this data for advertising or profiling. The app works the same with everything turned off.

8. Providers that process data on our behalf

Data processing agreements (art. 28 GDPR) apply with the providers that process data on our behalf. For sign-in and the stores, Apple and Google also process data as independent controllers, under their own policies. We don't sell data and don't share it with third parties for advertising. We may disclose it to authorities only when required by law.

9. Data outside the European Union

The database is in the United Kingdom, which benefits from an adequacy decision of the European Commission: under the GDPR, data there is protected as in the EU. For providers in the United States, transfers are based on the EU-US Data Privacy Framework, where the provider participates, or on the standard contractual clauses approved by the Commission.

Quota is available worldwide. If you use it outside the European Union and the United Kingdom, your data is transferred to and stored in the United Kingdom, the EU and, for the providers listed, the United States, with the same safeguards described here, which we apply to everyone in the same way.

10. How long we keep data

• Account, content, messages and feedback: as long as you have an account. On deletion, see the next section.
• Scan images: not kept. The reading result: 30 days.
• Attached receipts: as long as the expense they are attached to exists.
• Profile photo: until you change or remove it, or as long as you have an account.
• Reports: as long as needed to handle them and at most 12 months after they're closed; longer only if needed to protect a right or by law.
• Notifications received: as long as you have an account. The push notification sending queue (device token and text): 30 days.
• Notification tokens: as long as you stay signed in on that device; they're deactivated when you sign out.
• Outgoing emails (sign-in links, invites): the sending log with recipient and content, 30 days.
• Technical connection data: according to the providers' log cycle, usually a few days.
• Statistics and crashes: according to Firebase's retention settings, at most 14 months for usage events and 90 days for crashes.
• Backups of the database provider: overwritten according to their cycle.

11. Deleting your account

You can delete your account from the app: Profile → Settings → Delete account. Before you confirm, the app shows you what will disappear. Then:

• your personal data (profile, profile photo, email, payment details, devices, notifications, feedback, “Personal” expenses) is deleted;
• the messages you wrote or received are deleted, for the other person too;
• in groups where other people remain, the expenses and payments you entered stay for them but are anonymised: “Removed user” appears instead of your name, in their notifications too. Removing them would change the accounts of people who didn't ask for anything. From payments made to you we remove the payment details you had shown (IBAN or username);
• groups where you were the only member are deleted with all their expenses and receipts;
• receipts attached to shared expenses remain visible to the people who split that expense with you.

If you can't use the app, you can request deletion by writing to gferrara8596@gmail.com from your account's address. Deleting your account doesn't cancel a subscription bought in the past: cancel it from your Apple ID settings (iPhone) or from Google Play → Payments and subscriptions (Android).

12. Your rights

Under the GDPR you can ask to access your data, correct it, delete it, restrict its processing, receive it in a readable format (portability), object to processing based on legitimate interest and withdraw your consent at any time, without affecting what was done before. You can do many of these things directly in the app: edit your profile, change or remove your photo, export expenses, turn off statistics and crash reports, delete your account. For anything else write to gferrara8596@gmail.com: we reply within one month.

These rights apply wherever you live. If the law of your country grants you others (for example in the United Kingdom, Switzerland, California, Brazil, Japan, Korea or Turkey), we respect them in the same way. We don't sell your personal data and don't share it for targeted advertising, including within the meaning of California law.

You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or with the authority of the country where you live.

13. Children

Quota is not intended for people under 14, the minimum age in Italy to consent to online services, or under the minimum age in your country, if higher. If you think a child has given us their data, write to us and we'll delete it.

14. Security

In addition to what's described in §3: sign-in happens with an email link, Apple or Google, with no password to remember; sessions end when you sign out; the server's secrets are not in the app. No system is one hundred percent secure: if we discover a breach that affects you, we notify the authority and, where the law requires it, you.

15. Changes to this policy

If we change something important, we'll tell you in the app before it takes effect. The date at the top shows the latest version.