Privacy policy
For the Kumpari app and web application (Android, iOS, kumpari.com). Last updated: 23 September 2026
This is a translation provided for convenience. The legally binding version is the German Datenschutzerklärung; if the two differ, the German version prevails. Kumpari is operated by a sole proprietor in Austria, and Austrian law applies alongside the GDPR. Austrian statutes are cited by their original names with a short explanation in brackets, because they have no exact English equivalents.
This text is a template, not legal advice. Entries highlighted in yellow are placeholders. Review and approval are a matter for legal counsel or the Gründerservice of the Wirtschaftskammer (start-up service of the Austrian Economic Chamber; free for sole proprietors). The text describes the actual state of the software; if the processing changes (e.g. email features, paid features, error reporting), it must be updated.
The essentials in brief
- Kumpari stores only what is needed for settling shared expenses: your account, your trips with participants, expenses, splits, settlements and receipt photos.
- No tracking, no analytics tools, no advertising, no sharing with third parties for advertising purposes, no fonts or scripts from third-party servers.
- For an account you only need a username and a password. An email address is optional.
- You can get all your data at any time in the app as a file (“Export my data”) and delete your account in the app or at kumpari.com/konto-loeschen.
- Through a separate, multiply protected administration access, the operator sees only account data and counters, never the content of your trips; every action there is logged (section 3.11).
- The application and all data are held on the controller's own hardware in Austria; it is reached through an upstream web server at a provider in Germany. When you set a password, we check it against known data breaches – without the password itself ever leaving our server (section 3.5).
1. Controller
Erik Che Kreinbucher (Miktoya)Gaugerichtsweg 13a, 6832 Sulz, Austria
Email: support@kumpari.com
Further details are in the legal notice. We are not required to appoint a data protection officer (Art. 37 GDPR); data protection requests are answered by the controller himself.
2. Principles
- No advertising, no tracking. Kumpari contains no advertising networks, no analytics or statistics tools, no error-reporting tool and no social media integrations. The web application loads all of its components from
kumpari.com; no content is embedded from third-party servers. - No cookies. Sign-in works with an access token that is stored only on your device (section 3.4). The app and the website set no cookies; we therefore show no cookie banner. Only the operator's separate administration access (section 3.11) uses a technically necessary session cookie – it concerns the operator alone, never users of the app.
- Data minimisation. We do not ask for data the app does not need – no postal address, no date of birth, no phone number, no location.
- No sharing. Your data is seen only by the members of your trips (section 3.2) and by the processors named in section 4, which we need for operation. Through the administration access, the operator himself sees only account data and counters, no trip content (section 3.11).
3. Which data we process and why
3.1 Your account
When you register, you choose a username (3–24 characters, stored in lower case), a display name and a password. We store the password exclusively as a hash using Argon2id with a random salt; it cannot be recovered from that, and we do not know it either. In addition we store the time of registration and a technical version number of your sign-in (we use it to invalidate all old access tokens when you sign out everywhere or after a password change).
An email address is optional. If you provide one, we use it exclusively to verify it and to reset your password (section 3.6). Without an email address there is no way to reset a forgotten password.
We also store the language of your account (German or English; the app sets it to the language it displays, and it determines the language of our emails), your Pro entitlement where applicable (the app shows it in the settings) and, if the operator suspends your account, a suspension record with time and reason (section 3.11).
Purpose: providing your account and the app. Legal basis: Art. 6(1)(b) GDPR (performance of the contract of use). Retention: until you delete your account (section 6).
3.2 Trips, participants, expenses, splits, settlements
This is the actual content of Kumpari. For each trip we store:
- Trip: name, currency, optional date range, archive status, who created it.
- Members: which accounts belong to the trip, their role (admin or member) and the time they joined.
- Participants: the names under which expenses are settled (placeholders such as “Anna” or “Dad”). A participant may be linked to an account but need not be – fellow travellers without an account appear only with the name a member entered.
- Expenses: title, amount, date, category, optional note, who paid, how the amount is split (share and weight per participant), who created the entry.
- Settlements: who gave whom which amount and when, optional note.
- Invitation codes: the code, its expiry date, an optional usage limit and the number of joins.
Who can see this: All members of a trip see its complete content – participants, expenses, splits, settlements, balances and receipt photos. That is the purpose of the app. Anyone with a valid invitation link sees the name of the trip and can join; invitation codes expire after seven days by default, and the admin can replace them at any time.
Data of fellow travellers: If you enter people without an account of their own, you process their names and shares. For a private travel group this is usually personal or household use, to which the GDPR does not apply (Art. 2(2)(c) GDPR). Nevertheless, please enter only what is needed for the settlement and tell your fellow travellers that you are using Kumpari. Kumpari offers the category “Health”; we do not evaluate categories – but please avoid notes that reveal more about a person's health than the purpose of the settlement requires.
Purpose: shared settlement within the travel group, sync between the members' devices. Legal basis: Art. 6(1)(b) GDPR towards every member; for names of fellow travellers without an account, Art. 6(1)(f) GDPR (legitimate interest of the group in a traceable settlement). Retention: until the trip or the entry is deleted (section 5). Deleted entries are technically kept as a deletion marker so that all devices can apply the deletion; section 5 gives the periods.
3.3 Receipt photos
You can attach up to three photos (e.g. till receipts) to each expense. Before uploading, the app downscales the image to at most 1600 pixels on the longer side, saves it as JPEG and removes all metadata (e.g. location, device type, time of capture) that camera apps embed in photo files. On the server the file is stored under a random identifier in the trip's directory; only signed-in members of that trip can retrieve it. We additionally store which expense the receipt belongs to, its size and who uploaded it.
A receipt photo shows whatever you photograph. Please photograph only the receipt – no bank cards, identity documents or people.
Purpose: evidence of the expense for the group. Legal basis: Art. 6(1)(b) GDPR. Retention: the file is deleted immediately when you delete the receipt, the expense or the trip. A restored expense therefore has no receipts any more.
3.4 Sign-in, sessions and data on your device
After signing in, your device receives a signed access token (JWT) that is valid for 30 days and is extended when used. On Android it is stored in the system's protected storage, on iOS in the Keychain, in the browser in the website's local storage – not in cookies. “Sign out everywhere” or a password change invalidates all tokens.
Kumpari works offline-first: the app stores your trips in a local database on your device (in the browser, in the website's storage) and keeps cached receipt images as well as settings such as the colour scheme. This local data does not leave your device; it is deleted when you sign out, when you delete your account and when you uninstall the app. Storing it is strictly necessary for the app to function; consent under §165 para. 3 Telekommunikationsgesetz 2021 (TKG 2021, Austrian Telecommunications Act) is not required for it.
Legal basis: Art. 6(1)(b) GDPR.
3.5 Checking new passwords against known data breaches
When you register or change your password, our server checks whether the chosen password appears in published data breaches. Attackers try such passwords automatically; we therefore reject them. For the check we use the service Have I Been Pwned (Troy Hunt, Superlative Enterprises Pty Ltd, Australia; delivered via Cloudflare) with the k-anonymity method:
- The server computes a SHA-1 hash of the password and sends only its first five characters to
api.pwnedpasswords.com. - The response contains all known hash suffixes for that prefix (several hundred). The comparison takes place exclusively on our server.
- The password itself, its full hash, your username and any other detail of your account never leave our server. The service can determine neither the password nor you. In addition, the response is padded to a uniform size so that not even its length reveals anything.
- The check never runs at sign-in, only when a password is set. If the service is unreachable, nothing is blocked.
Legal basis: Art. 6(1)(f) GDPR (protecting accounts against takeover) in conjunction with Art. 32 GDPR. Since no personal data is transmitted, the service is not a processor, and no personal data is transferred to a third country.
3.6 Emails
Only if you provide an email address do we send you emails – and exclusively transactional emails: verification of the address, password reset (also when the operator triggers it at your request) and the notice stating the reasons if the operator suspends your account (section 3.11). Reset and suspension emails go only to a verified address. The emails are written in the language of your account (German or English). No newsletters, no advertising. For sending we use the service provider Brevo (section 4), which processes your email address, the content of the message and delivery information for that purpose.
Legal basis: Art. 6(1)(b) GDPR. Retention: the address remains stored until you remove it in the settings or delete your account; reset links are short-lived and are stored only as a hash.
3.7 Server logs and protection against abuse
Operating the service produces technical logs:
- Application log: per request the method, path (invitation codes are masked in it), response status, duration, a random request identifier and – for signed-in users – the account identifier. No IP addresses, no content, no passwords, no tokens, no amounts. The log is limited by size (at most 50 MB) and continuously overwrites itself; older entries are therefore usually overwritten after a few days to weeks.
- Access log of the upstream web server (Caddy): time, IP address, requested address, browser identifier (user agent), response status and size. We evaluate these logs only in the event of malfunctions and attacks. Retention: 14 days.
- Rate limiting: to slow down password guessing and abuse, the server counts sign-in, registration, invitation and export requests per IP address for at most 60 minutes in memory. These counters are not stored permanently.
Legal basis: Art. 6(1)(f) GDPR (operational security, detecting and fending off attacks, troubleshooting).
3.8 Backups
The database is backed up once a day; backups are kept for 14 days and then deleted automatically. Receipt files are held in the same backed-up storage area. Deleted or anonymised data may therefore persist in backups for up to 14 days; backups are used only for recovery after an outage, never to restore individual data. Backups are held on the same hardware as the application; in addition, each daily backup is transferred together with the receipt files to a second storage location ([LOCATION/PROVIDER OF THE ADDITIONAL COPY]), where the same 14-day period applies.
Legal basis: Art. 6(1)(f) GDPR (availability and integrity of the data, Art. 32 GDPR).
3.9 App stores and payments
If you install Kumpari via Google Play or the Apple App Store, the respective store operator processes data under its own responsibility (such as your store account, downloads, reviews). We receive no personal data from this, only aggregated statistics. The privacy notices of Google and Apple respectively apply.
There are currently no paid features. Once there are, purchases are handled via the store or a payment service provider; which data arises in the process and how long we must keep purchase records (seven years under tax law) will be added here before launch.
3.10 Contact by email
If you write to us, we process your address and the content in order to answer your enquiry. We delete the correspondence as soon as the enquiry has been dealt with, at the latest after 12 months, unless a statutory retention obligation applies. Legal basis: Art. 6(1)(b) or (f) GDPR.
3.11 Administration by the operator
For operating the service, the controller has a separate administration access. It is not part of the app, can be reached only with device certificates issued specifically for it on the operator's devices, and is additionally protected by a password and a second factor (one-time code).
What the operator sees there: exclusively account data – username, display name, email address and whether it is verified, language, times of registration, last change and, where applicable, deletion, suspension record and Pro entitlements – as well as counters: how many trips, memberships, expenses, settlements and receipts an account has and how much storage the receipts take up. No trip content: no trip names, participants, expenses, amounts, notes or receipt photos. Searches are by username, email address or account identifier.
What the operator can do there:
- Suspend an account, for example on a substantiated report of a breach of the terms of use or to protect a compromised account. While the suspension lasts, signing in is not possible and all devices are signed out; your data remains unchanged. You receive the reasons by email if a verified address is on file; otherwise we tell you on request to support@kumpari.com. The operator may record an internal note on the suspension, which is not included in the email.
- Lift the suspension, sign your account out on all devices and trigger a password reset email – to a verified address. The operator cannot enter or change an email address.
- Grant a Pro entitlement (permanently or until a date) or revoke it. We store the period, the source, who granted it, an optional note and, where applicable, the time and reason of the revocation. The app shows an active entitlement in the settings.
- Delete the account – by the same route and with the same consequences as in section 6.
Log: Each of these actions and every look into an account is recorded – with the time, the acting administrator, the type of action, the account concerned and the administrator's IP address, plus the result (such as whether the suspension email was delivered) and the free texts entered (reason for suspension, internal note, note on the Pro entitlement, reason for a revocation). For a search, the number of hits and the identifiers of the accounts found are logged, never the search term. The log is deleted automatically after 12 months; if an account is deleted earlier, the entries about it, including the free texts, remain until this period expires, because they document what the operator did and why. Access to the administration area also appears in the access log of the upstream web server (section 3.7, 14 days, without search terms).
Legal basis: Art. 6(1)(b) GDPR insofar as the performance of the contract of use is concerned (Pro entitlement, help with your account at your request); otherwise Art. 6(1)(f) GDPR – our legitimate interest in the security of the service, in preventing abuse, in enforcing the terms of use and in documenting who did what in the administration access. Recipients: none; like the app, the administration access runs through the upstream web server (section 4).
4. Recipients and processors
We do not pass data on for advertising or sales purposes. The following parties receive data because we need them for operation:
| Recipient | Purpose | Data | Basis |
|---|---|---|---|
| Members of your trips | shared settlement | display name, username, content of the trip, receipt photos | Art. 6(1)(b) |
| Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany | operation of the upstream web server through which the application is accessed. Transport encryption terminates there; the data is forwarded but not stored permanently. | all data transmitted between the app or the administration access and the application – in plain text at this point | processing on our behalf, Art. 28 GDPR; contract dated [DATE OF DATA PROCESSING AGREEMENT] |
| Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany) | sending transactional emails (only with an email address on file) | email address, content of the message, delivery status | processing on our behalf, Art. 28 GDPR; contract dated [DATE OF DATA PROCESSING AGREEMENT] |
| Have I Been Pwned (section 3.5) | checking new passwords | only a five-character hash prefix – not personal data | not a processor |
| Authorities | only where legally required | data requested in the individual case | Art. 6(1)(c) |
Third countries: Our servers and processors are located in Austria and Germany, i.e. within the EU. No personal data is transferred to countries outside the EU or the EEA. The request to Have I Been Pwned (section 3.5) contains no personal data.
5. Retention periods at a glance
| Data | Stored until |
|---|---|
| Account (username, display name, password hash, email, language) | deletion of the account; afterwards only the blocking marker described in section 6 |
| Suspension record (time, reason) | lifting of the suspension or deletion of the account |
| Pro entitlements | until deletion of the account; a revocation ends the entitlement, the entry remains. On deletion, active entitlements are revoked and notes removed; period, source and revocation remain as evidence on the anonymised account |
| Log of the administration access (incl. free texts) | 12 months, also beyond the deletion of the account |
| Trip with participants, expenses, splits, settlements | deletion of the trip by the admin or deletion of the account of the last member. Deleted entries and trips are kept as a deletion marker so that all devices apply the deletion; they contain the original details and are permanently removed automatically 90 days after deletion. |
| Receipt photos | immediately upon deletion of the receipt, the expense or the trip |
| Access tokens | 30 days without use, immediately upon “Sign out everywhere”, password change or account deletion |
| Access log of the web server | 14 days |
| Application log | limited by size (max. 50 MB, rolling) |
| Rate-limiting counters | at most 60 minutes, in memory only |
| Backups | 14 days |
| Email correspondence | until dealt with, at the latest 12 months |
6. Deleting your account: anonymisation instead of deletion
You can delete your account at any time – in the app under Settings → Delete account or, without the app installed, at kumpari.com/konto-loeschen. As a safeguard we ask for your password once more. The following then happens:
- Trips in which you are the only member are deleted together with all expenses and receipts; the receipt files are removed immediately.
- In trips with other members, your membership is ended. The balances of the others must remain correct, however: a trip in which expenses or shares suddenly go missing would be worthless to your fellow travellers. Therefore the participant row (the name under which expenses were settled in that trip) remains, together with the associated expenses, shares and settlements; only the link to your account is removed. If you were the admin, the role passes automatically to the member who has been part of the trip the longest.
- Your account is anonymised: display name, password hash and email address are deleted, all access tokens become invalid. The username remains stored in blocked form so that nobody can register it anew and thereby take over your earlier entries. Signing in is thus permanently impossible.
- The data on your device is deleted. A second device that was offline at the time of deletion offers to delete its local data at the next start.
- A suspension record is deleted; Pro entitlements are revoked and their notes removed. Entries in the log of the administration access remain until their 12-month period expires (section 3.11).
The operator can also delete an account – at your request, for example if you no longer have access or your account is suspended, or after a termination under the terms of use. This happens by the same route with the same consequences as above, only without asking for the password, and is logged (section 3.11).
If you additionally want the participant name you used in shared trips to be made unrecognisable, rename it in the trip before deletion (e.g. to “Former member”) or ask the trip's admin to do so. Legal basis for keeping the participant row: Art. 6(1)(f) GDPR – the legitimate interest of the remaining members in a complete and correct settlement prevails, because the row contains only a freely chosen name and amounts and is not accessible to outsiders. Art. 17(1) GDPR does not preclude this, because the data continues to be necessary for the purpose of the settlement.
7. Your rights
You have the rights under Art. 15 to 22 GDPR towards us. Much of this you can do yourself in the app:
| Right | How |
|---|---|
| Access (Art. 15) and data portability (Art. 20) | In the app: Settings → Account → Export my data. You receive all data stored for your account as a JSON file (account, all trips with participants, expenses, splits, settlements; receipts with their download address). Receipt images you download in the trip itself. On request we also send you the information by email. |
| Rectification (Art. 16) | You change your display name, trips, participants, expenses and settlements directly in the app. |
| Erasure (Art. 17) | Delete entries and trips in the app; the whole account under Settings → Delete account or at kumpari.com/konto-loeschen (section 6). |
| Restriction (Art. 18), objection (Art. 21) | By email to support@kumpari.com. You may object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) (sections 3.5, 3.7, 3.8, 3.11, 6). |
| Complaint (Art. 77) | With the Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at – or with the supervisory authority of your place of residence. |
If your account is suspended, you cannot sign in and cannot use the self-service functions (data export, account deletion). We then handle access, data portability, erasure and your other rights on request to support@kumpari.com. The entries in the log of the administration access that concern your account are not part of the export in the app; we provide them on request.
We answer requests without undue delay and at the latest within one month (Art. 12(3) GDPR). To match your request, please state your username; we may ask you to confirm your identity via a session signed in within the app, so that nobody obtains information about someone else's account. There is no automated decision-making and no profiling (Art. 22 GDPR). Providing your data is required neither by law nor by contract; without a username and password, however, no account can be created.
8. Data security
- All connections are encrypted with TLS (HTTPS, HSTS); the connection between our servers runs over an encrypted VPN.
- Passwords are hashed with Argon2id; access tokens are signed and revocable.
- Receipt photos can be retrieved only by members of the trip and contain no metadata.
- The server runs in a hardened container without root privileges and is tested automatically; only the operator has access to the servers.
- Without a specifically issued device certificate, the operator's administration access cannot even be reached; it requires a password and a second factor, locks after repeated failed attempts, ends sessions after inactivity and logs every action (section 3.11). Before an account is deleted, it asks for a fresh one-time code.
- Logs contain no content, passwords or tokens.
9. Minors
Kumpari is not aimed at children under 14. We do not ask for a date of birth and cannot verify age; if we learn that an account was created by a child under 14, we delete it.
10. Changes to this policy
We update this policy when the app or the legal situation changes. The version in force at any time is available at kumpari.com/de/datenschutz (binding German version) and, as a translation, at kumpari.com/en/privacy; we announce material changes in the app.
Other legal texts: Legal notice · Terms of use · Withdrawal notice