Privacy Policy

Last updated: 20 October 2026

Who is responsible

EvenCost is a hobby project run by Filip Rokita ("I"), who is the controller of your personal data. Write to contact@filiprokita.com for anything about your data.

What I collect, and why

• Account: your email, your nickname, and a password stored only as an Argon2id hash. Used to create your account and let you log in.
• Sign-in records: a session token, its expiry, and the IP address and browser details seen when you signed in. Used to keep you logged in and to protect the service against abuse.
• Group content: the groups you create or join, and the expenses, shares, settlements and notes you or other members add. Used to calculate who owes whom.

Other members of your groups see your nickname and what you add. They never see your email.

I do not use analytics, advertising or tracking, and I do not sell or share your data for marketing.

Legal basis

• Account and group content: it is needed to provide the service you asked for (GDPR Art. 6(1)(b)).
• Sign-in records and rate limiting: my legitimate interest in keeping the service secure (Art. 6(1)(f)).

Cookies

EvenCost sets one cookie: the session cookie that keeps you logged in. It is strictly necessary for the service, so it needs no consent banner. There are no other cookies and no third-party trackers.

Who processes data for me

• Vercel Inc. hosts the application. It is based in the United States; transfers rely on the safeguards in Vercel's data processing terms.
• Neon hosts the database, in the AWS Frankfurt region (EU).

How long I keep it

• Account data: until you delete your account.
• Sign-in records: until the session expires or you log out, or until you delete your account.
• Group content: kept so that balances stay correct for the other members. After you delete your account it shows your name as "Deleted user".
• Backups at my database provider may hold deleted data for a short time before they expire.

Deleting your account

You can delete your account yourself: open your profile and choose Delete account. I then remove your email, password and sign-ins, and replace your name with "Deleted user". If you own a group that other people are still in, delete that group first.

Your rights

You can ask for a copy of your data, to correct it, to erase it, to restrict or object to its use, and to receive it in a portable format. Write to contact@filiprokita.com. You can also complain to the Polish data protection authority, the President of the Personal Data Protection Office (UODO), at uodo.gov.pl, or to the authority in your own country.

Children

EvenCost is not meant for anyone under 16.

Changes

If this policy changes, the date at the top changes with it.