Privacy Policy

Last updated: October 9, 2026

This policy explains what personal data Rezendue collects, why it is collected, how it is protected, and what rights you have over it. The rules for using the service itself live in the Terms of Service.

Who we are

Rezendue is a web application for tracking shared expenses in groups. It is developed and operated by Zdravko Karamanolov, an individual developer based in Bulgaria ("we", "us"), who is the data controller for the personal data described below. You can reach us at support@rezendue.com.

What we collect

Your basic Google account profile — when you sign in with Google we receive your name, email address, profile picture, and Google account ID, plus technical details about the sign-in itself (such as when the sign-in token was issued). We only request Google's basic sign-in permissions (openid, email, profile). Rezendue has no access to any other Google data or Google Service and we never see your Google password.
A generated pseudonym — when you create your account we assign you a "ghost name" (for example "Panda #4821"). It replaces your name on shared bills after you leave a group or delete your account to retain the history of the other members.
Content you create — groups, bills (titles, amounts, dates, who paid), and the bill images you upload.
Technical request data — when your browser talks to our servers, they record your IP address, the time, the address requested, the result, and (if you are signed in) your user ID.
Functional cookies — two first-party cookies that keep you signed in (see Cookies below).

We do not collect your location, your contacts, device fingerprints, or advertising identifiers.

How we use your data

To provide the service — signing you in, keeping your session alive, and showing your groups and bills to you and to the members of your groups. The legal basis is the performance of our agreement with you (Art. 6(1)(b) GDPR).
To keep the service secure and working — IP addresses and request records are used to rate-limit requests, block abuse and attacks, and investigate errors. The legal basis is our legitimate interest in running a secure service (Art. 6(1)(f) GDPR).

There is no profiling, no automated decision-making, no advertising, and no marketing use of your data.

Google user data

The only Google user data Rezendue accesses is the basic profile described above (name, email address, profile picture, and Google account ID), obtained through Google Sign-In. We use it solely to create and identify your account, sign you in, and show who you are to the members of your groups.

Rezendue's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not:

sell Google user data;
use or transfer it for advertising, including personalized, retargeted, or interest-based advertising;
transfer it to data brokers or information resellers;
use it to determine creditworthiness or for lending purposes;
use it to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.

Google user data is transferred to others only as needed to run Rezendue (to the infrastructure providers listed below), to comply with applicable law, or as part of a merger, acquisition, or sale of assets, in which case you would be notified first. Nobody reads your Google user data unless you ask us to (for example in a support request), it is necessary for security purposes such as investigating abuse, or it is required by law.

Cookies and local storage

Rezendue sets two first-party cookies, used exclusively to keep you signed in: a session token valid for one day and a refresh token valid for seven days. Your theme preference (light/dark) is stored in your browser and never leaves your device. There are no analytics, advertising, or tracking cookies of any kind — which is also why the app shows no cookie banner.

The "Continue with Google" button is loaded from Google. To operate sign-in, Google may set its own cookies, which are governed by Google's Privacy Policy.

Who can see your data

Your group members — content you add to a group (your name, profile picture, bills, and images) is visible to the other members of that group. People who are not members of a group cannot see its members, bills, or images.
Infrastructure providers — under European Union data protection laws, they process data only on our behalf, to run the service:
- Amazon Web Services runs our backend, database, and image storage.
- Google serves the web app through Firebase App Hosting and handles Google Sign-In.
- Cloudflare provides our domain's DNS, protects and routes traffic to our backend (sees IP addresses).
Authorities — only when we are legally required to disclose data.

Your data is never sold, and it is never shared with advertising or analytics companies.

Storage and security

Your account data and content are stored in the European Union. Google and Cloudflare operate global networks, so requests may pass through their servers outside the EU; where that happens, they are bound by the safeguards the GDPR requires, such as the European Commission's Standard Contractual Clauses.

All traffic between your browser and Rezendue, and between our servers and the database, is encrypted in transit (HTTPS/TLS).
The database, the image storage, and the server disks are encrypted at rest.
Bill images are private: they are shown only to the members of the bill's group, through links that expire shortly after they are issued.
Access to production systems is restricted to the developer and limited to what each component needs. The sign-in cookies are restricted to secure connections.

Retention and deletion

Your account data is kept for as long as your account exists.
Our server request logs, including IP addresses, are deleted automatically after 14 days. Our hosting providers keep their own request logs for a limited period (up to 30 days).
Database backups are kept for 14 days, so deleted data disappears from the backups within 14 days.

You can delete your account at any time from Account Settings. If you still owe money on an active bill in one of your groups, the app asks you to settle it first. Deleting your account does the following:

Your Google account details — name, email address, profile picture, and Google account ID — are erased.
Bills and images you contributed to shared groups remain, so the history of the other members stays intact, shown under the "ghost" name you were assigned when you created your account.
Groups you own are handed over to their longest-standing member.
Groups that you are the only member of are deleted, including their images.

If you cannot sign in anymore, you can also ask us to delete your account and data by writing to support@rezendue.com from the email address of your account. We respond within 30 days.

You can remove Rezendue's access to your Google account at any time in your Google Account's third-party connections. This stops Google from sharing your profile with Rezendue in the future; it does not delete the data we already hold, so delete your account as well if that is what you want.

Your rights

Under the GDPR you can ask for access to your data, a copy of it in a portable format, correction, erasure, restriction of processing, or object to processing based on our legitimate interests. To exercise any of these rights, write to support@rezendue.com; we respond within 30 days. You also have the right to lodge a complaint with a data-protection authority — in Bulgaria, the Commission for Personal Data Protection, or the authority in the country where you live.

Children

Rezendue is not directed at children and must not be used by anyone under 16 years of age.

Changes to this policy

If this policy changes, the new version is published here with an updated "last updated" date, and material changes will be announced in the app(email later). If we ever want to use your Google user data in a new way, we will ask for your consent first.

Contact

Privacy questions are welcome at support@rezendue.com.