Splix privacy policy

Scope and contact

Effective date: 11 October 2026.

This policy applies to the Splix Android app, published by Baeri. For privacy questions, contact splix@baeri.eu.

Local-first design

You can use Splix without creating a cloud account. Local app data can include profile settings, Contacts, Trips, Split Groups, participants, expenses, payments recorded outside Splix, settlement records, notes, reminders, provider links, selected images, and app settings. Android Auto Backup is disabled for Splix.

Optional Sync account

If you create Sync, Splix creates a pseudonymous account protected by device keys and 24 recovery words. It does not require an email address or password. Splix processes random account and device identifiers, a public verification key, device label, app and platform version, and the profile display name used in collaboration.

Recovery words and private device keys remain under your control. Never send recovery words, invitation codes, or private keys to Baeri support.

Private Sync

You choose which Trips and Split Groups use private Sync. For an enabled workspace, Splix stores the structured records needed to synchronize connected devices. These can include workspace names, destinations, dates, participants, budgets, itinerary and preparation items, reminder flags, provider links, notes, expenses, payers, allocations, currencies, settlement records, deletions, versions, and relationships.

Private Sync also includes reusable Contact records referenced by that workspace. A referenced Contact can contain a name and optional country, email, phone, or IBAN. Unreferenced Contacts and unrelated local-only workspaces are not uploaded.

Collaboration

You can explicitly invite another pseudonymous Splix account to collaborate on a Trip, Split Group, or linked pair. Members can see workspace names and the planning or financial content included in that collaboration. Owner, Editor, and Viewer roles control permitted actions.

Before private data becomes collaboration content, Splix removes reusable Contact records, Contact IDs, device-local user markers, Android reminder scheduling and snooze state, and unresolved or inferred participant links. Members still see participant names and the planning or financial information needed for the shared workspace.

Covers, local files, and external actions

Local cover-image bytes, stay photos, app-private paths, and file or content URIs are not uploaded to Sync. A selected Pexels cover can sync its validated image or reference URL and attribution metadata so another device can download its own cached copy.

Trip JSON files remain local until you explicitly export, import, save, or share them. Provider links, Browse, email, SMS, Android sharing, and exported files open or send content only after your action. External destinations apply their own privacy policies and terms.

If you choose Find cover, Splix sends the search text and standard network metadata to Pexels and downloads previews or the selected image. See the Pexels privacy policy.

If you scan a Splix QR code, Google Play Services Code Scanner and ML Kit process the camera image and result on the device; Google states that it does not store that image or result. The scanner can send Google device and app information, per-install identifiers, performance and configuration data, feature events, and error codes for diagnostics, usage measurement, maintenance, and abuse prevention. Splix does not enable scanner auto-zoom.

Explore sandbox

The following applies when a sandbox testing build enables Explore. It does not activate Explore in production builds.

Sharing in Explore

Explore is available to signed-in sandbox accounts. Publishing is optional. Before you publish a Trip idea or recruiting Trip, you review and confirm the details that other sandbox travelers can see. These can include your public display/host name, title, description, destination, Trip type, dates, traveler and open-spot counts, public itinerary, optional estimated local cost and Pexels cover reference and attribution. Traveler identities, account identifiers, private workspace links, reusable Contacts, payment details, private notes and collaboration credentials are not included in the public listing.

Pexels cover image bytes are downloaded from Pexels into the device's local cache. Splix's Cloudflare service stores the selected image reference and attribution, not those image bytes.

Your original Trip remains a separate private planning workspace. Copying a Trip idea creates an independent editable Trip. Copied dates, travelers and item prices are initially empty. Closing sharing removes the listing from Explore without changing your original Trip or copies already saved by others. Deleting the synced source Trip also removes its public listing after synchronization. Copies already saved by other travelers remain independent.

Requests and collaboration

When you ask to join, the owner receives your public display name and request state. A pending request does not give you private Trip or Split access. You may cancel it before approval. Approval reserves a place and creates a Viewer invitation. You may decline that invitation before accepting it, releasing the reserved place without changing membership or access.

Accepting an invitation uses the existing collaboration rules. Where the Trip has a linked Split Group, the access confirmation explicitly covers both workspaces. Owners may later change a member's role using the existing access controls. Blocking someone in Explore does not revoke previously granted collaboration access or erase planning or financial history.

Reports and blocks

You can report a public listing or request interaction for spam, harassment, unsafe content, private information or another concern. Reports include the selected reason, optional details and the references needed to review the reported public content. They are visible only to authorized sandbox moderators and support, not to the reported traveler. Avoid including unnecessary private information in a report.

Blocking hides the account's public listings and prevents new requests between the two accounts. You can manage and unblock accounts in Explore. Moderators may dismiss a report or remove public content. Removing a listing does not delete its private source Trip, revoke existing members or erase saved copies. For questions and report follow-up, contact splix@baeri.eu.

Notifications and providers

Splix stores account-specific in-app notification events so requests and invitations can be reviewed after the app is restarted. Optional OS push uses Google Firebase Cloud Messaging. Firebase installation/registration identifiers, push tokens and technical delivery metadata are used to route notifications to the authorized device. Firebase also processes app version and technical information about Android, the device model, the installer and SDK versions to provide and maintain its services. These are installation identifiers, not an advertising identifier. Push messages contain a generic event hint; the app checks its authenticated inbox before displaying a notification or allowing an action. Splix does not enable Firebase Analytics.

Cloudflare hosts the authenticated Explore API and database. Google processes the technical information needed to deliver FCM notifications. Notification permission can be managed through Android settings. Disabling permission stops OS notifications; the authenticated in-app inbox remains available. Public planning content, reports and notification data are used for app functionality, security, abuse handling and support, not advertising or sale.

The Explore build initializes Firebase when the app starts, with automatic Messaging initialization disabled by default. Signing in and enabling Android notifications allows token registration for that account/device. Disabling notifications unregisters the Splix push token; this does not delete the Firebase installation identifier or its provider-side history. Notification permission is an OS delivery control, not a promise that all Firebase initialization or technical processing stops. Delivery analytics export to BigQuery and Firebase Analytics are not enabled.

Retention and deletion

Public visibility lasts until sharing is closed, the source/account is deleted, or a moderator removes the listing. Hidden listing records remain available for owner management until their source/account is deleted. Terminal request and notification history becomes eligible for bounded cleanup after 30 days. Joined requests remain while the publication exists because they account for its places. Open reports remain until reviewed; resolved report history becomes eligible for bounded cleanup after 90 days. Inactive push registrations also become eligible for cleanup after 90 days. Account/device removal also removes associated registrations through the existing deletion rules.

You can delete your Sync account and its associated data through the in-app account controls or the account deletion page. Splix does not currently offer a separate support process for deleting selected data while keeping your Sync account.

Existing private Sync and collaboration deletion/ownership safeguards still apply. A publication removal never implies deletion of an independently saved copy or financial history. Contact splix@baeri.eu for privacy or deletion questions.

Cloud provider and purposes

Baeri uses Cloudflare to host the Splix Worker, D1 database, and private disaster-recovery exports. Cloudflare processes Sync content and standard request and network metadata on Baeri's behalf to deliver, protect, and operate the service.

Baeri uses cloud data to create and secure the optional account, connect and revoke devices, synchronize selected workspaces, authorize collaboration, resolve versions and conflicts, enforce capacity and roles, prevent abuse, process deletion, and provide support. Splix does not use this information for advertising, profiling, or sale.

Splix has no dedicated product-analytics or advertising SDK in the audited release. The limited Google scanner diagnostics described above still apply.

Security and service boundaries

Splix uses HTTPS/TLS in transit and signed device challenges for sensitive account actions. Sync content is not end-to-end encrypted: the Splix Worker must read and validate structured records. You are responsible for protecting your device and recovery words.

Splix does not process payments, transfer money, connect to banks, complete bookings, sell insurance, or provide banking or insurance services.

Retention and deletion

Local Trips and Split Groups moved to Recently Deleted can be restored during a 30-day recovery window or permanently deleted. Expired standalone items are removed when the app next starts. A synced deletion record prevents another connected device from restoring an old copy.

An Owner can permanently delete a collaboration. Other members are notified and their managed copies are removed when they reconnect. A collaboration without an eligible sponsor becomes read-only and is permanently deleted after 30 days unless sponsorship is restored.

Delete Sync everywhere deletes the active pseudonymous account and its private cloud workspaces and disconnects its devices after owned collaborations are transferred or permanently deleted. Ordinary local Trips, Split Groups, images, and expenses remain on the current device.

Deleted live data can remain for up to seven days in access-restricted Cloudflare D1 recovery history. Private R2 disaster-recovery exports can retain an older database copy for up to 30 days. Minimal deletion-suppression records are kept for 35 days, metadata-only security records for 90 days, and closed support correspondence for 180 days unless an unresolved legal or security case requires longer retention.

An offline device cannot be erased remotely and applies a cloud deletion when it reconnects. Removing Splix cannot delete files you exported, information sent to another service, or an independent copy outside managed collaboration storage. See Delete a Splix Sync account and data.

Your choices, support, and changes

You can use local mode, choose individual workspaces for Sync, stop Sync while keeping local data, leave a collaboration when your role permits, revoke a device, or delete Sync everywhere. For access, correction, deletion, objection, or other privacy requests, use the deletion page or contact splix@baeri.eu.

Baeri may need to verify control of the relevant pseudonymous account, but will never ask you to send recovery words, invitation codes, private keys, workspace content, Contact details, IBAN, or financial records.

Splix is intended for general adult users and is not designed as a children's service.

We may update this policy when Splix changes. The published policy will show its latest update date.