Privacy Policy

Last updated: 21 July 2026

SettleLah! ("we", "us", or "our") is a bill-splitting web application operated by Joasis Web. This Privacy Policy explains how we collect, use, and protect your information when you use our app at settlelah.app.

1. Information We Collect

Account Information

• Email address (used for login and account identification)
• Display name (chosen by you)
• PIN / passcode (stored securely using bcrypt hashing)

Bill & Group Data

• Bill details you create: item names, prices, members, tax, and service charge
• Group information: group names, members, and associated bills
• Payment settlement records

Receipt Images

• When you use the receipt scanning feature, your receipt image is sent to Veryfi (a third-party OCR service) for processing. We do not permanently store the receipt images on our servers.

Telegram Integration

• If you link your Telegram account, we store your Telegram chat ID to send you payment notifications. We do not access your Telegram messages or contacts.

Device & Usage Data

• We store authentication tokens and preferences (such as dark mode) locally on your device using localStorage. This data never leaves your device.

2. How We Use Your Information

• To authenticate you and secure your account
• To create, store, and share bills among group members
• To scan receipts and extract bill items
• To send payment notifications via Telegram (if linked)
• To send transactional emails (welcome, PIN reset, PIN updated)

3. Data Storage & Security

Your data is stored in Google Firebase Firestore. We use the following security measures:

• Passwords/PINs are hashed with bcrypt before storage
• Authentication uses JWT (JSON Web Tokens) with access and refresh tokens
• Rate limiting and account lockout protection against brute-force attacks
• CSRF protection on sensitive endpoints
• Input sanitisation to prevent injection attacks

4. Third-Party Services

We use the following third-party services:

• Google Firebase / Firestore — database and backend infrastructure
• Veryfi — receipt OCR scanning (images are processed and not retained by us)
• Resend — transactional email delivery
• Telegram Bot API — payment notifications (opt-in only)
• Vercel — application hosting

Each third-party service has its own privacy policy governing their use of data. We encourage you to review their policies.

5. Data Sharing

We do not sell, trade, or rent your personal information to third parties. Your bill data is shared only with the members you include in a bill or group. Third-party services listed above receive only the minimum data needed to perform their function.

6. Data Retention

Your account and bill data are retained as long as your account is active. You may request deletion of your account and associated data by contacting us.

7. Cookies & Local Storage

SettleLah! uses browser localStorage to store authentication tokens and user preferences. We use session cookies for CSRF protection. We do not use tracking cookies or third-party analytics.

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Withdraw consent for optional features (e.g., Telegram notifications)

9. Children's Privacy

SettleLah! is not intended for use by children under 13. We do not knowingly collect information from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected on this page with an updated date.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at support@settlelah.app.