CZComing to the App Store
Coming to the App StoreČeština

Privacy policy

Effective from 5 October 2026, version 1

This is a translation. If it differs from the Czech version, the Czech version applies.

Dlužníček is built to know only what it needs to track shared costs. It has no ads, no analytics and no third-party trackers, and we sell your data to no one.

1. Controller

The controller is Česká IT Akademie, z.s., Preslova 72/25, Smíchov, 150 00 Prague 5, Czech Republic, company ID 17863201, registered in the register of associations kept by the Municipal Court in Prague, file L 77092.

For anything about personal data, write to support@czechitacademy.cz. We have not appointed a data protection officer because the law doesn’t require us to.

2. What we process

Your account

  • the name others see in your groups,
  • your email, how you sign in (Apple, Google or email and password) and your account identifier in Firebase Authentication. If you sign in with Apple and choose to hide your email, we only get an anonymous Apple relay address. We never see the password of an email account; Firebase manages it,
  • a profile photo, if you upload one,
  • your bank account number (IBAN) and Revolut username, if you enter them. Members of your groups see them on the Pay screen,
  • the app language, when you created the account and when you last signed in.

Group content

  • group names and member names, including people without an account whom someone else added,
  • expenses, transfers and income: amounts, currencies, rates, categories, dates, notes, who paid and for whom,
  • receipt photos,
  • the change history: who added, edited or deleted what and when, including earlier versions.

Loyalty cards: name, card code, note and a photo of the front if you add one, plus who a card was shared with.

Subscription: the Apple transaction identifier, subscription type, status and end date. We never see payment details; Apple handles those.

Notifications: the Apple push token of your device, if you allow notifications.

Technical data: the server logs the type of request, the in-app address and the result. Your IP address is kept only in memory to protect against overload, and it is not stored.

On your phone the sign-in tokens stay in the secure iOS keychain, along with a queue of changes not yet sent. Face ID is checked by iOS itself; we have no access to biometric data.

3. Why, and on what basis

Purpose Legal basis
Running your account, groups, calculations and settle-ups performance of a contract, i.e. these terms (Art. 6(1)(b) GDPR)
The Premium subscription and verifying it with Apple performance of a contract
Names and expenses of people without an account, entered by a group member the group members’ legitimate interest in keeping shared accounts (Art. 6(1)(f) GDPR)
Change history, backups, security and abuse prevention our legitimate interest in a reliable and secure service
Push notifications your consent, which you give and withdraw in iOS or in the app profile
Accounting and tax duties legal obligation

We don’t use data for advertising, profiling or automated decision-making.

4. Who can see the data

  • Members of your groups see the group content, your name, profile photo and the payment details you entered.
  • Processors who help us run the service:
    • the provider of the server in the Czech Republic that runs the app and its database (the server is managed by Czech IT Academy),
    • Google (Firebase Authentication) for sign-in: it stores your email, name, sign-in method, account identifier and, for email accounts, the password in hashed form. We never send it your expenses, groups or any other app content. This involves a transfer to the USA based on the European Commission’s adequacy decision (EU-US Data Privacy Framework) and standard contractual clauses.
  • Apple acts as a separate controller when you sign in with Apple, when we send push notifications (APNs) and when you buy a subscription in the App Store. This involves a transfer to the USA based on the European Commission’s adequacy decision (EU-US Data Privacy Framework).
  • Google as a separate controller, if you sign in with a Google account, on the same terms.
  • Authorities, where the law requires it.

We download exchange rates from the Czech National Bank and send it no personal data.

5. How long we keep data

  • Account data for as long as your account exists.
  • When you delete your account we delete your profile, email, account identifier (including the Firebase account), payment details, profile photo, sign-in and push tokens, loyalty cards and subscription record.
  • Group content belongs to all its members. Your name, expenses and receipt photos therefore stay in your groups so balances and history still add up for everyone else. The name is no longer linked to any account. If you’d like your name in a group changed, for example to initials, write to us or change it before deleting your account.
  • Backups are kept for up to 12 months (7 daily, 4 weekly and 12 monthly). Deleted data disappears from them as old backups expire.
  • Server logs for up to 30 days.

6. Your rights

You have the right to:

  • access your data and get a copy. You can download a group’s data as CSV at any time,
  • correct inaccurate data. Most of it you can edit in the app yourself,
  • erasure, see Profile → Delete account,
  • restrict processing and to data portability,
  • object to processing based on legitimate interest,
  • withdraw consent at any time, for example by turning off notifications,
  • complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.

We reply within one month. If someone who was added to a group without an account contacts us, we will change or remove their name in that group.

7. Security

All communication with the app is encrypted (HTTPS). Sign-in tokens are stored on the server only as hashes, group access is checked on every request, and backups are encrypted. If a breach ever put you at risk, we would tell you.

8. Children

Dlužníček is for people aged 15 and over. If we find out that someone younger has created an account, we will delete it.

9. This website

The website dluznicek.czechitacademy.cz uses no cookies, no analytics and no third-party content. Fonts and images load from our own server. The server may briefly log technical details of requests for operation and security.

10. Changes

We may update this policy when the app or the law changes. We will announce material changes in the app or on this website in advance.

Terms of use