Privacy Policy

Vallis Last updated: 19 August 2026

Draft note — delete this block, and the three below it, before publishing.

Every factual claim here was written against the code as it stands on 2026-08-19, not against the roadmap. Sections marked [NOT YET TRUE] describe features that are specced but not built, and must stay out of the published policy until they ship — a policy that over-discloses is as wrong as one that under-discloses.

Two things must still be true before this goes live.

1. Vallis LLC must actually exist. As of 2026-08-19 it is in formation. §1 and §12 name it as the operator and data controller, and until it is formed that is not true — the controller is currently the founder personally. Do not publish a policy that names an entity that does not exist yet; it is the one document where being wrong about who you are matters most.

2. The PostHog DPA must be signed (§5), which needs the company name and registered address — so it is blocked on the same thing. It is the ONLY one that needs signing.

Verified 2026-08-19, so these do NOT need chasing:

Processor	DPA status
Supabase	Automatic. “Acceptance of the Agreement shall have the same effect as signing the SCCs.”
Google	Automatic. “Incorporated into the Agreement(s)”; no separate opt-in.
Cloudflare	Automatic on a self-serve plan. Its GDPR trust hub states the DPA “is incorporated by reference into our Self-Serve Subscription Agreement”. The DPA’s own “from the date on which Customer signed” wording is the Enterprise path, and reading it alone gives the wrong answer for a free or Pro account.
PostHog	Manual, and gated on the LLC above.

Also confirmed 2026-08-19: in-app account deletion now exists (Settings → Account → Delete account), so Apple’s half of §8 is discharged alongside Google Play’s.

Confirmed 2026-08-19: the Gemini key is on the paid tier, so §2.3’s no-training statement holds. If billing is ever removed from that Cloud project it silently becomes false — the tier follows billing, not a setting.

None of this is legal advice. A US LLC collecting third-party phone numbers and serving EU users should have a lawyer read it once.

The short version

Vallis splits a restaurant or grocery bill between friends. To do that it needs your receipt and the names of the people you’re splitting with.

• We do not move money. Vallis hands off to Venmo or your phone’s messaging app; we never see a payment, a card, or a bank account.
• We do not store your receipt photos. The image goes to our extraction provider, comes back as text, and is discarded.
• We do not sell or share your data, and there is no advertising in Vallis.
• Our product analytics are built so they cannot carry amounts, names, or phone numbers. That’s enforced in the code, not just promised here.

1. Who we are

Vallis is operated by Vallis LLC, 2501 Chatham Rd #6885, Springfield, IL 62704, United States.

Questions, requests, or complaints: privacy@vallis.app. For anything else, support@vallis.app.

Vallis LLC is the data controller for the information described below.

2. What we collect, and why

2.1 Your account

When you create an account we collect your name, email address, and a password. The password is hashed by our authentication provider; we never see or store the plaintext.

If you sign in with Apple or Google instead, we receive your name and email address from them. If you use Apple’s Hide My Email, we only ever receive the relay address Apple generates, and that is fine — Vallis works normally with it.

We use this to identify your account and to keep your splits attached to you across devices.

2.2 Your splits

When you create a split we store: the merchant name and date, the line items and their prices, tax, tip, fees and discounts, and how you assigned items to people.

We also store the names of the people you split with, and their phone number or payment handle where you’ve entered one, so that we can build the Venmo or text-message handoff for you.

This is information about other people. See §6.

2.3 Receipt photos

When you scan a receipt, the image is sent to our extraction provider — Google’s Gemini API — which returns the printed text as structured data.

We do not keep the image. It is not written to our database or to any file storage; it passes through our server and is discarded once the extraction returns. What we retain is the extracted text you then review and edit.

Google processes the image as our service provider, under the paid tier of the Gemini API. On that tier Google’s terms state that it does not use prompts or responses to improve its products, and retains them only briefly, for detecting policy violations and meeting legal obligations. Your receipts are not used to train Google’s models and are not read by human reviewers.

We also keep a small scan record for each extraction — a timestamp, which model ran, how long it took, how many items came back, and whether it succeeded. This is what enforces the free-tier scan limit and tells us when extraction quality degrades. It contains no receipt content.

2.4 Usage analytics

We use PostHog (US region) to understand where people get stuck. We record events like “a split was started”, “the receipt was extracted”, “a request was sent”, along with your account’s user ID.

Analytics events cannot contain money amounts, names, or phone numbers. This is a structural guarantee, not a policy one: the list of permitted events and properties is a closed type that fails our build if anything else is added, values are re-checked at runtime and dropped if they violate the rule, and the test suite fails if a new event is added without a privacy assertion. Where we need to know the size of an extraction error, we record a bucket (“off by more than $5”), never the figure.

We have also turned off the features that would have collected more than we want: automatic tap-capture is disabled permanently (it would have recorded the text of whatever you tapped, which on these screens is a dollar amount or a friend’s name), session replay is not enabled, IP addresses are discarded on arrival, and location enrichment is switched off — so we do not collect or derive your city, region, coordinates, or postal code.

Screen names are recorded as route patterns (/split/[id]/assign), never with your split’s ID in them.

If you’re in the UK or EU, see our legal bases below.

2.5 Guest pages on this website

If someone sends you a Vallis link to claim your items or report a payment, you don’t need an account and we don’t create one for you.

• The link contains a long random token. That token is the only credential, and it grants access to exactly one person’s view of exactly one split — it cannot be modified to see anyone else’s data.
• We show you first names only. Other people’s phone numbers, email addresses and contact details are never shown on a guest page.
• We record which items you claimed, or which splits you reported paying, and the time you did so. That’s what the person who sent you the link asked for.
• There is no analytics, no advertising, and no third-party tracking on guest pages. They set no cookies beyond what is needed to serve the page.
• Links expire after 30 days and can be revoked at any time by the person who sent it.

2.6 Text messages

When you send a claim link or a payment request, Vallis opens your phone’s own messaging app with the message pre-filled. You send it, from your own number. We do not transmit the message or the recipient’s number to any messaging service, and we have no record of whether you sent it.

[NOT YET TRUE — hold until Twilio ships] Gold automatic reminders are sent from a Vallis phone number rather than yours. When that feature is enabled, the recipient’s phone number and the message body are transmitted to our SMS provider (Twilio) in order to deliver it, and replies to those messages are received and processed by us.

2.7 Contacts

Vallis does not access your contacts. People are added by typing a name.

[NOT YET TRUE — hold until contacts import ships] If you grant contacts permission, we read contact names and phone numbers on your device solely to offer them for selection. Contacts you do not select are never transmitted to us, and Vallis remains fully usable if you decline.

2.8 Purchases

[NOT YET TRUE — hold until the purchase flow ships] Subscriptions are processed by Apple or Google, and managed through RevenueCat. We receive your subscription status and the transaction identifiers needed to grant access. We never receive your card or payment details.

2.9 Our legal bases (UK and EU)

UK and EU law requires us to name why we’re allowed to handle your information. For each thing above:

We rely on legitimate interests for analytics rather than asking for consent because of how narrowly it’s collected: no advertising identifiers, no cross-company tracking, no location, no IP address, and nothing that can identify you to anyone but us. If we ever re-enable location enrichment, that reasoning stops holding and we will ask for consent instead.

You can object to any processing based on legitimate interests — see §8.

3. What we do not do

• We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
• We do not show advertising, and we do not use advertising identifiers. Vallis does not track you across other companies’ apps or websites.
• We do not process payments, hold funds, or connect to your bank.
• We do not use your receipts, splits, or usage to train our own models.

4. Who we share it with

Only the service providers that make the app work, each acting on our instructions:

We will also disclose information if we are legally required to, or to protect the rights and safety of our users.

If Vallis is ever acquired or merged, your information may transfer as part of that transaction. We’d tell you before it took effect.

5. International transfers

Vallis LLC is based in the United States and so are all of our providers, so if you use Vallis from the UK, EU, or elsewhere your information is transferred there.

Where that transfer is from the UK or EU, we rely on the Standard Contractual Clauses approved by the European Commission (and the UK Addendum), which each of the providers above includes in its data processing agreement with us.

Draft note — delete before publishing. This says we have accepted those DPAs. Supabase, PostHog, Google and Cloudflare each publish one and most require you to actively accept it in the dashboard. Do that before publishing, or the paragraph is a claim rather than a fact.

6. Information about other people

Vallis only works if you can tell it who you’re splitting with. When you add someone’s name, phone number, or payment handle, you are giving us information about a person who is not our user.

• We use it only to build the split you asked for and the handoff link that goes with it.
• We do not use it to market to them, and we do not build a profile of them.
• If someone contacts us and asks us to remove their details, we’ll remove them from our records and tell you.
• Please only add details for people who’d expect you to — the same courtesy as putting someone’s number in a group text.

Under UK/EU data protection law you are responsible for having a proper reason to share those details with us.

7. How long we keep it

8. Your rights and choices

You can ask us to:

• Give you a copy of the personal information we hold about you.
• Correct anything that’s wrong.
• Delete your account and everything attached to it — see how to delete your account.
• Stop analytics collection for your account.
• Object to, or restrict, how we use your information.

Email privacy@vallis.app and we’ll respond within 30 days. We won’t treat you differently for exercising any of these rights.

Draft note — delete before publishing. Both deletion routes now exist: the self-serve web one at /delete-account for Google Play, and Settings → Account → Delete account in the app for Apple (Guideline 5.1.1(v)). They call the same backend, so what they delete cannot drift apart.

If you’re in the UK or EU, you also have the right to complain to your data protection authority. If you’re in California, the rights above are your CCPA/CPRA rights to know, delete, correct and opt out; we do not sell or share personal information as those terms are defined.

9. Security

Data is encrypted in transit. Access to your splits is restricted at the database level so that one account cannot read another’s. Guest links use long random tokens that cannot be guessed or enumerated, resolve to a single person’s view of a single split, expire, and can be revoked.

No system is perfectly secure, and we won’t pretend otherwise — but treat a Vallis link like a key: anyone who has it can see that one page.

10. Children

Vallis is not directed at children under 13, and we don’t knowingly collect information from them. If you believe a child has created an account, contact us and we’ll delete it.

11. Changes

We’ll update this page when the app changes, and update the date at the top. Material changes will be announced in the app before they take effect.

12. Contact

privacy@vallis.app

Vallis LLC 2501 Chatham Rd #6885 Springfield, IL 62704 United States