Privacy policy

Quits is a ledger for money between people. It keeps score; it never touches your bank account. This page explains, in plain language, exactly what we hold and why.

If anything here is unclear, write to privacy@quits.cc and we will answer.

What we collect

When you sign in. Your phone number. We send a six-digit code to it by SMS and store the number, because that is how we know it is you next time and how a friend's entries find you when you join. There is no password, so there is no password for us to lose.

The SMS itself is sent by Firebase Authentication, a Google service. Google receives your phone number in order to deliver the message and to block abuse of the code system. Google's handling of it is covered by their own privacy policy. We get back only a signed confirmation that the number is yours.

Your name. Whatever you type. It is shown to the people you share entries with.

The people you add. When you add someone to your list, we store the name you gave them and, if you provide it, their phone number. You provide this; they may not have given it to us themselves. Only add contact details you are entitled to share.

Contacts you choose to import. Quits can show you your phone's address book so you can tick a few people instead of typing their names. Reading the book happens on your phone. Only the rows you tick are sent to us — their name and number — and we store those the same way as anyone you added by hand. Everyone you did not tick stays on your phone and is never transmitted. You can ignore the importer completely; nothing in the app requires it.

A profile photo, if you set one. The image is stored on our server. Be aware that it is served from an unguessable web address without a login check, so anyone who has that address can view the picture — treat it as public. Remove it in the app and the file is deleted.

What you record. Amounts, descriptions, dates, who paid, who owes, and which group an entry belongs to. This is the product — without it there is nothing to show you.

Groups. The group's name, kind, optional start and end dates, and who is in it.

A sign-in token, on your device. Kept in the app's local storage, along with your light-or-dark preference. Not a tracking cookie, and never sent anywhere except to our own API.

What we never collect

• Bank credentials, UPI IDs, card numbers or anything else that could move money.
• Your address book in bulk. We never copy it wholesale — see above; only the people you tick are sent, and only when you use the importer.
• Your photo library. Setting a profile picture or scanning a bill opens your phone's own picker and hands us the single image you chose; the app cannot see the rest.
• Your location, your call log, your messages, or anything about other apps.
• Advertising identifiers. There are no ads in Quits and no ad networks in it.

We do not sell, rent or trade any of it. There is no third party paying us for access to you.

Who can see what you record

This matters more than most privacy policies admit, so it is spelled out.

• An entry between you and one other person is visible to exactly the two of you.
• An entry in a group is visible to every member of that group.
• If you added someone using their phone number and they later sign up with that number, the history you recorded about them becomes visible to them. That is the point — it is their money too — but you should know it before you type it.
• Your name and profile photo are shown to anyone you share an entry or a group with.
• Nobody else can see any of it. Our team does not read your entries; access to production data is limited to what is needed to keep the service running.

The optional AI features

Quits can turn a sentence like "dinner 1200 split with Raj and Priya, I paid" into a draft entry, read a photographed bill, and write a short summary of what you're owed. These are optional, and they involve sending data to companies other than us.

We do not keep the photo after the text has been read from it. What those providers do with what they receive is governed by their own terms. If you would rather none of this happens, simply don't use those three features — every other part of Quits works without them, and nothing is sent unless you tap the button.

Messages we send you

We send exactly one kind of message: your six-digit sign-in code, by SMS, when you ask for it. No marketing texts, no "we miss you", no promotions, and we do not sign you up to anything. Standard carrier charges for receiving a text may apply at your end.

This website

quits.cc is a set of static pages. It sets no cookies, runs no analytics, embeds no trackers and loads nothing from a third party. Reading this page tells us nothing about you beyond an ordinary server request log.

How long we keep it

For as long as your account exists. Deleted entries are marked deleted rather than erased immediately, so the other person's books don't silently change underneath them and so a mistake can be undone.

Deleting your account

You can do it yourself: Profile → Download or delete → Delete my account. It takes effect immediately, and there is no need to ask us. If you can no longer sign in, write to privacy@quits.cc telling us the phone number you signed up with, and we will do it for you — we confirm it is your number before we act on it, so nobody can close your account by guessing.

Either way, settle any open balances first, and take a copy of your data from the same screen if you want one. The full steps, and exactly what is erased, are here.

One honest limit: an entry involves two people, and it is their record as much as yours. Where an entry is shared, we remove your personal details from it but the entry itself remains on the other person's ledger. We cannot rewrite someone else's history of what they are owed.

Security

Traffic is encrypted in transit. Sign-in codes are short-lived and single-use, and are issued and checked by Firebase rather than by us, so a bug in our code cannot hand out a valid one. Sessions are signed tokens, not passwords. No system is perfect, and we would rather say that than claim otherwise.

One thing worth knowing: your account is tied to your phone number. If you give up that number and the carrier reissues it to somebody else, they could sign in as you. Tell us at privacy@quits.cc before you let a number go and we will detach it.

Children

Quits is not intended for anyone under 18. If you believe a child has an account, tell us at privacy@quits.cc and we will remove it.

Your rights

Under India's Digital Personal Data Protection Act, 2023, you can ask us what we hold about you, ask for it to be corrected, ask for it to be erased, and withdraw consent. One email to privacy@quits.cc is enough — no form, no fee.

Changes

If this policy changes in a way that affects you, we will change the date at the top and say so in the app before it takes effect.

Contact

privacy@quits.cc — for anything on this page. hello@quits.cc — for everything else.

Quits is operated from India.