What we store, and what we don't.

Effective 12 October 2026

Chill Bill is run as an independent service in Indonesia and is subject to Law No. 27 of 2022 on Personal Data Protection. For the data you put into Chill Bill, we act as the data controller.

If anything on this page doesn't match what you see in the app, that is a bug, and we want to know. The address is in section 12.

1. What stays on your phone, not on our server

Chill Bill stores your group's records on your phone first, in the browser's or the app's own storage. That is the primary copy. All balance calculations, splits and settlement plans happen on your phone, not on our server.

A group you create without an account never leaves that phone. There is no copy on our server, and if you clear the data from your browser, the group is gone for good, for us too.

2. What reaches our server

Once a group is synced, which means you created an account and invited someone, our server stores:

Group activity records. Every event you record: the group name, the member names you typed yourselves, expense titles and categories, the amounts, who paid, who took part, the dates, and any notes you wrote.
Receipt readings. The shop name, items and figures read from a receipt photo, stored as text inside that expense record.
Your account. Your email address, name and Google account ID, only if you sign in. The name comes from Google, and you can change it in Profile; the new name is used in all your groups, and each group records the change in its history.
Profile photo, if you set one. We keep one small image (256 pixels) that we re-create ourselves from the one you send, with no location or camera data. Only people who share a group with you can see it. We only take the photo from your Google account if you tap Use Google photo yourself.
Devices. One random ID per phone, plus a short name the phone makes up itself (for example "Chrome on Android"), so you can see an old phone in the device list and revoke it. We do not store your browser's User-Agent.
Device credentials. Stored as a hash, so we cannot read them back ourselves.
Payments. If you buy Plus: the order number, amount, time and status. Payment goes by QRIS to the operator's account; we never see or store your card number or bank details.

What we do not store

The receipt photo. The photo is sent to the receipt reader, read, then discarded. It is never written to disk or put in a database.
Amounts in server logs. Our logs hold technical identifiers and outcomes ("ok", "rejected"), never the rupiah figures.
Your phone number, contacts, location or WhatsApp chats. Chill Bill has no access to WhatsApp. When you share a settlement summary, all that happens is your phone copying text into the app you choose.
Advertising cookies or third-party trackers. None.

3. Why, and the legal basis

To do what you ask (performance of a contract): storing group records, syncing between phones, calculating balances, making settlement plans.
To read receipts (consent): it only runs when you take the photo and press the button.
For account security (legitimate interest): device credentials, the device list, and the record of who wrote what in the transaction history.
For billing (performance of a contract and legal obligation): Plus order records.

We do not use your data for advertising, do not sell it, and do not build a profile of your spending. That limit is written in our own product decision records.

4. Where the data is stored

The primary copy is on your phone. The synced copy is stored on one server we rent, and that server is in Singapore, on Tencent Cloud infrastructure through a provider in Indonesia. So synced data leaves Indonesia. We say so here because you have a right to know.

The basis is performance of a contract: without that server, syncing between phones and invitations by link could not work at all. If you do not want your data to leave your phone, use Chill Bill without an account: a group created without an account never touches any server.

Receipt reading

If you use Snap, the receipt photo is sent from your phone to our server, then passed on to Google's language model provider (Gemini) through a gateway run by the operator. The photo is downscaled and its EXIF data removed on your phone before it is sent, so location and camera details do not go with it.

That processing also takes place outside Indonesia. The photo exists in memory only for the length of one request, and we do not keep it. What comes back and is stored is the text only: the shop name, items and figures.

A receipt can contain information about other people who are not Chill Bill users. That is why we never store receipt photos, and we will never use them for any other purpose.

5. How long

Receipt photos: never stored.
Profile photo: until you replace it, remove it, or delete your account. Its backup is gone at most 15 days later.
Group records: for as long as the group exists. The activity record only ever grows and is never overwritten, because that is what makes the transaction history trustworthy. "Deleting" an expense means recording its deletion, not erasing the trace.
Quick Split: the details are deleted 30 days after everyone is settled, on your phone and, if it was ever synced, on our server. What remains on your phone is a summary only: the title, the total and your share. One that is not yet settled is never deleted automatically.
Groups marked as finished: kept for 24 months, then we notify you before deletion. The clock only runs while there is still a member with an account to notify.
Deleted accounts: gone from the database at once, in one transaction, as soon as you tap the button. Daily backups are kept for 14 days, so at most 15 days after deletion no copy remains anywhere.

6. Your rights

Get your data. In the app, open Profile, then Data & backup. You can download all your data, and the full record of one group, at any time, free, with no subscription needed.
Correct it. Every figure can be changed in the app, and the change is recorded in the transaction history.
Delete from this phone. On the same screen, "Delete from this phone" removes the local copy.
Revoke a device. In Profile, under Devices, you can revoke a phone that is lost or sold. That phone can no longer write, and its copy is erased as soon as it comes back online.
Delete your account. In Profile, the Delete account button. It takes effect at once, and the Delete Account page sets out what is deleted and what remains. If you can no longer sign in, email the address below from your account's email address.
Withdraw consent, or object. Email the address below. We resolve it within 30 days.

If you delete your account, group records you wrote together with other people do not disappear from their phones, because those records are theirs too. What goes is the account, the email, your profile photo and the link to you, along with your phone's access to groups you created yourself. A group you created that nobody else ever joined is deleted as well: that group is only your own record, so we delete all of it from the server. Groups you joined carry on.

7. Who else touches this data

Google (Google Ireland Ltd. / Google LLC): signing in with a Google account, and receipt reading through the Gemini model.
Server provider: one server in Singapore (Tencent Cloud, rented through a provider in Indonesia) where synced group records, the account database and profile photos are stored.

No one else: no advertising networks, third-party analytics or data brokers.

8. Security

All traffic goes over HTTPS. Device credentials are stored as hashes. The model provider's key never reaches your phone. The database is backed up daily on the same server, and old backups are deleted automatically.

If a personal data breach occurs, we notify you and the competent authority within the applicable deadline, commonly cited as 3 x 24 hours.

9. Age

Chill Bill is for people aged 17 and over. We do not knowingly collect children's data.

10. Browser storage

Chill Bill uses no tracking cookies. It uses your own browser's local storage (OPFS, localStorage and IndexedDB) to keep group records, your sign-in session, and receipt photos waiting to be sent while you are offline. All of it is on your phone. Clearing site data in the browser deletes it too.

For Safari users on iPhone: that browser can discard site data after about seven days without a visit. That is outside our control. If your group matters, sign in with an account, or keep a backup file.

11. Changes

If this page changes, the date above changes with it. Changes involving new data or new purposes will be announced in the app.

12. Contact

Questions, data requests or account deletion: halo@chillbill.biz.id. What to put in the email is on the Contact page. You also have the right to complain to Indonesia's personal data protection authority.