Privacy Policy

This is an English translation for your convenience. The German version is the legally binding one.

Last updated: October 2026. It applies to the ShareTab app and to this website.

1. Controller

Robin Werner
Bismarckstr. 52
28203 Bremen
Germany
Email: support@sharetab.de

No data protection officer has been appointed; the conditions of § 38 BDSG (German Federal Data Protection Act) are not met.

2. The key points first

• ShareTab contains no tracking and no advertising.
• There are no analytics SDKs, no advertising IDs and no disclosure of data to third parties for advertising purposes.
• The database is located in Frankfurt am Main.
• This website sets no cookies and loads nothing from third-party servers.

3. What data is processed

Account

Email address, display name, a hash of the password, the time of registration and, optionally, a profile photo. Also the language you use the app in, so that emails about your account arrive in that language. Purpose: providing the account and the shared expense list. Legal basis: Art. 6(1)(b) GDPR (performance of the contract of use).

Expenses and workspaces

Amount, free-text description, date, category, split rule, who paid, membership of a shared workspace and the names of the people added to it. Purpose: the core function of the app. Legal basis: Art. 6(1)(b) GDPR.

A workspace is shared by two people. Anyone who joins a workspace sees all the expenses recorded in it — including those of the other person. That is the purpose of the app.

Crash and error diagnostics

When a crash or error occurs, technical information is transmitted: the error message, the stack trace, the app version, the operating system version and the device model. Purpose: finding and fixing errors. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working app).

This is done with Sentry, operated in its EU region. It is set up so that the contents of your household are never transmitted in the first place:

• The contents of database requests — in particular the free-text description of an expense and amounts — are removed from error reports on the device itself, before they leave the device (sendDefaultPii: false and a filter stage of our own).
• On the server side, a second filter stage removes values that the database writes into the text of its error messages.
• No cookies are set.

The following information, on the other hand, is sent. We name it explicitly:

• A random identifier of the app installation, which Sentry assigns itself in order to group related error reports. It is not your name and not your device: a new identifier is generated when the app is reinstalled.
• The identification number of your account may appear in technical call traces — not your name, not your email address, but the internal number under which the database keeps your record.
• An approximate location (country and city). For this, your IP address is evaluated on receipt and then not stored. Every connection on the internet necessarily transmits an IP address for technical reasons; what matters is that it is not retained here.

What reaches Sentry as a result: the shape of the failed call — which operation, which table, which status code — not its content.

Authentication emails

To confirm your registration and to reset your password, an email is sent to the address you provided. This involves processing the recipient address and technical delivery information. Legal basis: Art. 6(1)(b) GDPR.

These emails are sent via SMTP2GO. The delivery data held there is deleted after 35 days.

This website

When the website is accessed, the host processes technically necessary access data (IP address, time, requested resource, browser type transmitted). Legal basis: Art. 6(1)(f) GDPR (operation and security of the website). No cookies are set, no fonts or scripts are loaded from third-party servers and no audience measurement takes place.

4. Processors and transfers to third countries

Data processing agreements under Art. 28 GDPR are in place with the following service providers. Where a provider is based outside the EU, the transfer relies on the Standard Contractual Clauses (SCC) of the European Commission (Art. 46(2)(c) GDPR).

When fetching app updates, the device transmits technically necessary information (IP address, app and operating system version) to Expo.

5. Retention and deletion

Account and expense data is stored for as long as the account exists. You can delete your account in the app at any time: Settings → Profile → Delete Account. The deletion takes effect immediately.

The following applies:

• Your account, your profile and your profile photo are deleted.
• The shared expenses remain, but are detached from you: your name is replaced by “Gelöschter Nutzer” (German for “deleted user”). The reason: the expenses belong, in substance, to both people in a household, and deleting them would distort the other person’s balance.
• If you were the last member of a workspace, the workspace is deleted completely, together with all its expenses, categories, people and settlements.

Backups. Backups of the database are made and deleted after seven days. Within that period, data that has already been deleted may still be contained in a backup. Once the period has expired, it is gone from there too.

Error reports in Sentry are deleted after 90 days. They contain none of the contents of your expenses (see section 3).

6. Your rights

You have the following rights against the controller:

• Access and data portability (Art. 15 and 20 GDPR). You get your data directly in the app: Settings → Export Data → Export My Data. The file contains your profile, your workspaces and the associated expenses in a machine-readable format. We answer requests that go beyond this by email within one month.
• Rectification (Art. 16 GDPR). You can change your display name and profile photo yourself in the app.
• Erasure (Art. 17 GDPR) — can be carried out in the app, see section 5.
• Restriction of processing (Art. 18 GDPR) and objection (Art. 21 GDPR) to the processing based on Art. 6(1)(f) GDPR, that is, to the crash diagnostics.
• Complaint to a supervisory authority (Art. 77 GDPR). The competent authority is Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen (the data protection authority of the State of Bremen). You can also contact the supervisory authority of your habitual residence.

For any of these, an informal message to support@sharetab.de is enough.

7. Data on your device

Your session’s sign-in data is kept in the device’s protected keychain. Expenses you have recorded without a network connection are stored unencrypted in the app’s storage until they are transmitted; they contain no credentials. Both are removed when you sign out.

8. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

9. Changes to this policy

If the app or the service providers used change, this policy will be updated. The date at the top shows the current version.