Privacy Policy

Last updated: November 3, 2026

In short

No account, and nothing to sign up for. Fair Divider asks for no email, no phone number and no payment details. If you write to us to exercise a right, we use that email only to answer you.
We process what you enter and technical data. Participant names, amounts, room or item descriptions and turn choices are needed to compute the division. Your IP address is processed to serve requests and for security; the separate live counter also uses it to derive a daily pseudonymous identifier and an IP-based location (section 2).
Different records have different lifetimes. Multi-device sessions and shared result links expire 7 days after creation; anyone holding a share link can read it. The division itself is dropped from server memory after 24 hours of inactivity, and our application server logs are kept for at most 7 days. Google Analytics and Microsoft Clarity retain data for roughly 14 months and 90 days. The independent live counter has separate visitor, event and daily-identifier periods described in section 5; those periods are not a retention promise for infrastructure logs.
Website analytics need your consent; the app switch controls Firebase only. Google Analytics and Microsoft Clarity on the website are off until you accept. Clarity replays masked page interactions and receives an IP-derived location. The apps have no Clarity or session replay; their Firebase analytics are on by default and can be switched off in the info menu. That switch does not stop the independent live counter, which uses a daily pseudonymous identifier and Cloudflare location data. Separate daily backend totals contain no user or device identifiers.
Your data is never sold. Our servers are in Germany and our database in the EU region; Cloudflare may route traffic through servers outside the EU, and if analytics are on, Google and Microsoft may process data outside the EEA. Write to privacy@fairdivider.com to exercise any of your rights; we answer within a month, extendable by two more for complex requests.
Notification display and token registration are different. Android can register a Firebase Cloud Messaging token for a room even when system notification display permission is denied. On iOS, alert permissions and Live Activity settings are separate. Tokens are used for room updates and deleted with the room; turning alerts off does not itself delete a registered token. A lock-screen update can show the current chooser's name (section 14).

This summary is not the policy. The numbered sections below are what governs; where the two differ, they prevail.

1. Data Controller

Binary Spirit S.L.
Tax ID (CIF): B86508181, registered address in Madrid, Spain (see the Legal Notice)
Contact: privacy@fairdivider.com

2. What Data We Collect

Fair Divider processes division data and technical and usage data, as described below:

Participant names — entered by users when creating a division session. These may be real names or pseudonyms.
Division data — total amount to divide, item/room descriptions, choices made per turn, timestamps, and division state.
Shared result links — when a division finishes in one-device mode, on the website or in the iOS and Android apps, the app prepares a short share link for it straight away, so that the share sheet opens without waiting. Preparing that link stores the result on our server, so that the same division can be opened on another device, or by the people you send the link to. What is stored is the participant names, the room or item names, the total, each person's amount, the shared costs and how they are split, and the currency. It is held in our MongoDB database on the origin server for 7 days and then deleted automatically. Anyone holding the link can read it, so send it only to the people concerned. Opening a link someone sent you stores nothing: the long form of the link carries the data inside the address itself, and the reader's browser never sends it to us. The multi-device mode produces only that long form, and it would reach our database only if the person who created it shortened it later, which it cannot do today.
Technical data — our server processes IP addresses to handle REST API requests at /api/v1 and for short-lived security logs. The independent live counter also processes the IP address and User-Agent to derive a daily identifier; its stored visitor and event records do not contain the literal IP address or User-Agent.
Owner token — when you create a session, the server generates a random UUID called the "owner token" and returns it to your browser. The token is stored in localStorage under the key fairDivisionApiState, deletes itself 24 hours after it was last used, and is required to perform privileged operations on the session you created. It is never shared with other participants.
Local storage — we use your browser localStorage (key fairDivision_<roomId>) to enable session reconnection in multi-device mode. This data stays on your device.
Anonymous usage counters — our own server keeps a daily tally of how many requests each kind of operation received (including how many times each part of the site was opened and how many times a result was shared), which client sent them (web, iOS or Android, with the app version and where the division started: the form, the example or refining an earlier result) and whether they succeeded. A stored row is a date, those three labels and a number. It holds no IP address, no session or division identifier, no owner token, no participant name and no device or user identifier of any kind, so it cannot be traced back to you or to any device. Per day and per participant group size, we additionally keep only a sample count and the sum of the ratio between the highest and lowest room price of completed divisions; this holds no names, amounts, currencies, or identifiers. This is separate from the optional analytics below and, because it identifies nobody, it does not depend on your consent.
Independent live visit counter — this cookie-free counter is separate from both anonymous backend totals and Google Analytics for Firebase. It derives a daily pseudonymous identifier from the IP address, User-Agent, site, Europe/Madrid calendar date and a salt, using the first 64 bits of SHA-256. This is an identifier, not anonymous data. Cloudflare also supplies IP-derived city, region, country, latitude and longitude; the counter does not round those coordinates. They are not device GPS readings, and their geographic accuracy is not established as country- or region-only. Visitor and event state and daily identifiers are stored in Cloudflare Durable Objects, with different retention periods (section 5). The apps' Firebase switch does not control this counter.
Google and Microsoft analytics data — the website's Google Analytics 4 and Microsoft Clarity process usage and interactions only if you opt in. The apps' Google Analytics for Firebase is on by default until you switch it off in the info menu. Sections 7 and 14 describe these tools; these choices do not control the separate backend totals or live counter.

We do not require accounts or ask for email addresses, phone numbers or payment details to use the calculator. We do not request device GPS location. IP-derived location is processed as described above, including Cloudflare coordinates whose accuracy we do not classify as coarse-only. If you contact us, we process the contact details you provide to respond.

3. How We Use Your Data

Providing the service — processing division sessions, synchronizing multi-device turns, calculating fair divisions, and keeping a finished result available for seven days so it can be reopened or shared through a link you generate.
Technical operation — server logging for error detection and security monitoring, and the anonymous usage counters described in section 2, which tell us whether the service is actually working.
Usage measurement — understanding usage to improve the service through the independent live counter, optional Google Analytics 4 and Microsoft Clarity on the website (section 7), and Google Analytics for Firebase in the apps (on by default, controlled by the Firebase switch in section 14).

Legitimate interest (Art. 6.1.f) — for providing the core fair division service and maintaining server security, including keeping a finished result available for seven days so it can be reopened or shared through a link you generate, and for the apps' Google Analytics for Firebase described in section 14. This Firebase statement does not extend to the independent live counter.
Consent (Art. 6.1.a) — for the optional website analytics described in section 7 (Google Analytics 4 and Microsoft Clarity). These load only if you opt in, are off by default, and can be switched off again at any time. Under Article 22 of the Spanish LSSI-CE, non-essential cookies require your prior consent.

5. Data Retention

Multi-device sessions (the room, its code, the participant names, the total amount and the room descriptions) are automatically deleted after 7 days from creation.
Shared result links — when a division finishes on the website, the short link prepared for it stores that result (the participant names, the room or item names, the total, each person's amount, the shared costs and how they are split, and the currency) in our database, and it is deleted automatically 7 days after it is created. Until then, anyone holding the link can open the result. Opening a link someone sent you stores nothing: the long form of the link is stored nowhere on our side, it exists only in the address you share, and the reader's browser never sends it to us.
The division itself — the rooms, the preferences entered and the resulting prices — is held in server memory, in every deployment, and deleted after 24 hours of inactivity. The database stores who is taking part in a multi-device session, the total amount and the room descriptions — not the turn-by-turn division, which stays in memory.
Application server logs are retained for a maximum of 7 days. This period does not describe the separate logs or backups of infrastructure providers.
Local storage on your device persists until you clear your browser data or the session expires.
Google and Microsoft analytics data is retained by the relevant provider: approximately 14 months for Google Analytics and 90 days for Microsoft Clarity (section 7), and approximately 14 months for the apps' Google Analytics for Firebase (section 14). Website tools require opt-in; the app switch stops Firebase collection only, not the independent live counter.
Independent live counter — visitor records, including their last-action fields, are removed after 30 minutes of inactivity; individual entries in the recent-event list expire after 5 minutes. Daily identifiers reset at midnight in Europe/Madrid, but a continuing visit can link the previous day's identifier to the new one until the visitor record expires. State is persisted in Durable Objects; cleanup is batched on a nominal one-minute alarm schedule, rather than deleting every record at the exact expiry instant. These periods do not specify Cloudflare infrastructure-log or backup retention.
Anonymous usage counters and room-price spread are daily totals with no personal data and are kept indefinitely.

6. Cookies and Similar Technologies

The necessary browser cookies and storage entries listed in our Cookie Policy are exempt from prior consent under Article 22.2 of the Spanish LSSI-CE and the AEPD 2023 Cookie Guide. The website additionally offers optional analytics cookies that load only after you opt in, as described in section 7. The full inventory (strictly necessary own cookies, Cloudflare Turnstile cookies served on the multi-device page, browser-storage entries, and the optional analytics cookies set only after opt-in) is documented in our Cookie Policy.

We do not use advertising cookies or third-party cookies for profiling or behavioural advertising. Website Google Analytics 4 and Microsoft Clarity run only with your consent (section 7). The apps' Firebase analytics and the independent cookie-free live counter are described separately in section 14 and section 2. Cloudflare Turnstile is loaded on /multi for anti-abuse purposes and sets no analytics or advertising cookies.

The Fair Divider website can load two optional analytics tools: Google Analytics 4 and Microsoft Clarity. They are disabled by default and run only after you give explicit consent. The apps' Firebase analytics has its own switch (section 14). These choices do not control the separate backend totals or live counter (section 2).

Google Analytics 4 — provided by Google Ireland Limited, acting as our data processor. It produces aggregate usage statistics (for example, which pages are visited and from which country). Google Analytics 4 does not store raw IP addresses.
Microsoft Clarity — provided by Microsoft Ireland Operations Limited, acting as our data processor. It produces heatmaps and session replay (a reconstruction of on-page interactions such as clicks and scrolling). Clarity masks the content of input boxes and drop-down menus in every masking mode, and we additionally apply Clarity's element-level masking to the calculator itself — the setup form, the division, the proposal and the result — so participant names, item descriptions and amounts are not uploaded to Clarity. Clarity does record the address of the page you are on, the page you arrived from, your browser and device, and an approximate location derived from your IP address. Note that names and amounts are still sent to our own servers to compute the division, as described in sections 2 and 5; the masking above concerns only what Clarity receives.

Legal basis — your consent (Art. 6.1.a GDPR; Art. 22 LSSI-CE, which requires prior opt-in for non-essential cookies). When you first use the website we ask whether to enable analytics. You can choose "Accept" (strictly necessary + analytics) or "Reject" (no analytics); both are equally easy, analytics stays off unless you accept, and the sheet stays on screen until you choose without blocking this policy or the other legal pages. Your choice is stored in your browser under the fd-analytics key, with its date under fd-consent-at, and we ask again after 12 months.

What the website analytics receive. Only if you accept: the pages you open (without share-link or room codes), clicks on the calculator button and on the App Store and Google Play badges, the steps of a division (started, completed, shared, abandoned), language and theme changes, errors shown, that you pressed Accept, the language of the page, and which version of an interface test you were shown ("A" or "B"). Pages that do not exist are counted as such. Never names, amounts, descriptions or room codes. Google Analytics and Clarity assign your browser a pseudonymous identifier, so this is pseudonymous, not anonymous, data.

Consent-mode sequence. Google Analytics starts with every consent signal (analytics storage, advertising storage, advertising user data and ad personalisation) denied and sends nothing that identifies a browser. Only when you press Accept does it move analytics storage to granted; the advertising signals stay denied. Microsoft Clarity is not loaded at all until you accept. Clarity may set its own cookies on its own domains in addition to those on ours; they are listed in the Cookie Policy.

Withdrawing consent. You can change your mind at any time — withdrawing is as easy as giving consent. This applies to website Google Analytics 4 and Microsoft Clarity, not the independent live counter. (The apps' Firebase analytics does not rest on consent: it is on by default and you can object to it at any time under Art. 21 GDPR by turning off the "Share usage statistics" switch in the info menu; see section 14.) On the website, use the "Cookie settings" link in the footer of the Fair Divider app (the calculator pages) to reopen the chooser and switch analytics off; the analytics tools will no longer load. Withdrawing stops future collection and deletes the four analytics cookies (_ga, _ga_<id>, _clck, _clsk) on our domain, and tells Google and Microsoft that consent is withdrawn; it does not erase data Google and Microsoft already hold, which you can ask us to delete at privacy@fairdivider.com.

International transfers. Google and Microsoft may process analytics data outside the European Economic Area (for example, in the United States) under the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework, in accordance with Chapter V of the GDPR.

Retention. Google Analytics data is retained for approximately 14 months; Microsoft Clarity data is retained for approximately 90 days (the providers' configured/standard retention periods).

We do not sell or rent your personal data. A shared result link makes the result readable by anyone holding that link until it expires (section 5). The following providers receive data for the technical services described here:

Hetzner Online GmbH (Germany, EU) — server hosting
Cloudflare, Inc. — CDN, DNS and DDoS protection, and the independent live counter, whose Worker and Durable Objects process and store the pseudonymous identifiers, location and activity data described in sections 2 and 5
MongoDB, Inc. (Atlas EU region) — database hosting
Apple Inc. (Apple Push Notification service, USA) — delivery of iOS room alerts and Live Activity updates, with separate system settings for these functions (section 14)
Google Ireland Limited (Firebase Cloud Messaging) — Android push-token registration and room-message delivery; registration is independent of system permission to display notifications (section 14)

If you opt in to the optional website analytics described in section 7, Google Ireland Limited (Google Analytics 4) and Microsoft Ireland Operations Limited (Microsoft Clarity) also act as data processors on our behalf. For the apps' Firebase analytics (section 14, on by default until you switch it off), Google Ireland Limited likewise acts as a processor. We never sell your personal data.

9. International Transfers

Your data is primarily processed within the European Union (Hetzner Germany, MongoDB Atlas EU). Cloudflare may process traffic through global edge servers; this includes the live counter processing described in sections 2 and 5.

If analytics are on, Google and Microsoft may also process data outside the EEA (for example, in the United States) under the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework, as detailed in section 7.

The push tokens and room state used for app notifications pass through Apple and Google as described in section 14; Android token registration is independent of notification display permission. Apple and Google may process these data outside the EEA under the EU-US Data Privacy Framework and/or Standard Contractual Clauses.

You have the right to:

Access — request a copy of your data
Rectification — correct inaccurate data
Erasure — request deletion of your data (sessions and shared result links auto-delete after 7 days). To have a shared result link removed sooner, write to support@fairdivider.com or privacy@fairdivider.com quoting its share code: the ten characters that follow /r/ in the link
Restriction — limit how we process your data
Portability — receive your data in a structured format
Objection — object to processing based on legitimate interest
Withdraw consent or object — withdraw consent for website Google Analytics 4 and Microsoft Clarity via "Cookie settings", and object to Firebase analytics with "Share usage statistics" in the app info menu, without affecting the lawfulness of prior processing. Neither control stops the independent live counter; contact us to exercise your rights concerning it

To exercise a right, contact privacy@fairdivider.com. Include a division session code if your request concerns that session; a session code is not required for other requests.

How to exercise your rights: Send an email to privacy@fairdivider.com identifying yourself. We will respond within a maximum of 1 month as required by Article 12.3 GDPR. If your request requires extraordinary complexity, we may extend this period by up to 2 additional months with prior notice.

11. Right to Complain

You have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es, or with your local supervisory authority.

12. Children

Fair Divider is not directed at children under 16 years of age. We do not knowingly collect data from children.

13. Automated Decision-Making

Fair Divider uses a mathematical optimization to calculate fair divisions. This is a mathematical computation, not profiling or automated decision-making with legal effects as defined in GDPR Art. 22.

14. Mobile Apps

The Fair Divider apps for iOS and Android use the same /api/v1 backend described in this policy, with the same purposes, the same retention periods and the same rights.

Google Analytics for Firebase in the apps. Firebase analytics is on by default, and you can turn it off with the "Share usage statistics" switch in the app's info menu. Turning it off stops Firebase collection; it does not stop the independent live counter described in section 2 or the anonymous backend totals.

What Firebase sends while its switch is on. The name of the actions you take (for example starting, completing, sharing or joining a division, changing the currency or language, errors shown), the screen you are on (from a fixed list), the mode of use (single device or several), the language of the app and, if you opened a share or join link that carried campaign tags, the source, medium and campaign of that link. The apps run Google Analytics for Firebase with every consent signal (analytics storage, advertising storage, advertising user data and ad personalisation) permanently denied, so the Firebase analytics code stores and reads no analytics identifier on your device (no installation or app-instance ID) and sends identifier-free pings: they carry no persistent device or installation identifier and cannot be linked from one session to the next by an ID. A ping still travels over the network from your IP address, so Google receives standard device and usage data, such as the model, system version and language, and derives an approximate country-level location from the IP address. This Firebase description does not apply to FCM registration tokens or the independent live counter's daily identifiers and Cloudflare coordinates. We do not describe all app measurement as anonymous or coarse-only.

Firebase event content. The Firebase event payload does not include participant names, room or item descriptions or amounts. This statement concerns Firebase, not the room data sent to our service or notification providers. The device advertising identifier is not used: on Android we explicitly remove that permission. We show no ads and do not use this analytics for advertising profiles or tracking across apps or websites.

Legal basis for Firebase analytics: our legitimate interest (art. 6(1)(f) GDPR) in understanding aggregate use of the apps in order to improve them, limited to the closed set of Firebase events described above. You can object by turning off "Share usage statistics", which stops Firebase collection without affecting the lawfulness of prior processing. This switch and this statement of legal basis do not apply to the independent live counter.

Firebase processor, destination and retention. Firebase data is processed by Google Ireland Limited on our behalf, in the same Google Analytics 4 property used by the website, and is retained for approximately 14 months. Google may process it outside the EEA under the conditions in section 9. The independent live counter uses Cloudflare and the separate periods in section 5. Your rights and how to exercise them are in sections 10 and 11.

The apps do not include Microsoft Clarity or any advertising SDK, and do not request device permissions beyond what is strictly required for the user-initiated action (for example, sharing a division link). Diagnostic data sent by the operating system to its respective app store (Apple App Analytics, Google Play Console) is governed by the privacy policies of Apple and Google respectively, and not by Binary Spirit S.L.

Multiplayer notifications (apps only)

For a multi-device room, the apps use push tokens to receive room updates: whose turn it is, a proposal waiting for your answer, a turn left waiting, or the result. Android registers a Firebase Cloud Messaging token independently of the operating system's notification display permission; denying that permission does not by itself prevent token registration. iOS uses Apple Push Notification service for alerts and Live Activity updates; permission to display alerts and the Live Activity setting are separate controls.

What is sent. Through Apple (APNs) and Google (FCM) we send the room status, the display name of the person whose turn it is (a name the participants typed themselves), the number of participants and the room code. Alerts carry only a fixed message, never amounts or prices. The Live Activity (iOS) and the ongoing notification (Android) show the current chooser's name on the lock screen, so anyone who can see your lock screen can see it.

Storage and deletion. The token is stored only inside that room's session record. It is never written to our logs, is not linked to any account and is used for nothing else. It is deleted with the room session (after 24 hours without activity, and in any case 7 days after the room was created), when you leave the room deliberately, or when your seat passes to another person.

Legal basis and control. Sending room updates you request is part of the service you use (GDPR Art. 6.1.b). System notification settings control alert display, not all token registration or message delivery. On Android, disabling alerts does not delete an FCM token already registered for a room. On iOS, alerts and Live Activities have separate system controls. The app continues to work when alerts are disabled. On the website, tab title and icon changes occur only on your device and send no data.

15. Account & Data Deletion

Fair Divider does not require a user account. Multi-device sessions and shared result links auto-expire 7 days after they are created, and the division itself is dropped from server memory after 24 hours of inactivity. To delete your data sooner, or to remove all locally stored data on your device, see our dedicated Account & Data Deletion page.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date.

14 October 2026: factual corrections distinguish anonymous backend totals, the independent live counter and Firebase analytics. The live counter uses daily pseudonymous identifiers, Cloudflare IP-derived coordinates and separate retention periods; the Firebase switch does not control it. Android push-token registration is distinguished from permission to display alerts, and iOS alert settings from Live Activity settings. This wording correction does not change the services' operation.

10 October 2026: multiplayer notifications in the apps were documented. The wording about token registration and display permission is corrected in the 14 October entry and section 14. Sections 8, 9 and 14 describe what is sent, how long the token is kept and how to switch it off.

30 August 2026 → 7 September 2026: shared result links are now described. When a division finishes on the website, a short share link is prepared for it, and that stores the division's result — the participant names, the room or item names, the total, each person's amount, the shared costs and how they are split, and the currency — in our database for 7 days, where anyone holding the link can read it; opening a link someone sent you stores nothing, because the long form carries the data in the address and never reaches our server. Sections 2, 3, 4, 5, 8 and 15 have been updated, and section 10 now gives the route to have a shared link removed before it expires.

6 October 2026, second revision: Firebase app analytics remained on by default with the same switch, but the apps began running Google Analytics for Firebase with all consent signals permanently denied, so Firebase analytics identifiers are not stored or read on the device and Firebase analytics pings are identifier-free. This historical Firebase statement does not cover FCM registration tokens or the independent live counter. Sections 6 and 14 no longer mention a random installation identifier; the data sent is otherwise unchanged. The stated Firebase legal basis (legitimate interest) and Firebase off switch were unchanged.

5 October 2026 → 6 October 2026: wording clarified, no change in the data processed. Section 14 now states that the app event data is pseudonymous; section 6 distinguishes the website from the apps; section 7 explains that turning off the apps' Firebase switch is an objection (Art. 21 GDPR), not a withdrawal of consent.

1 October 2026 → 5 October 2026: Firebase app analytics were turned on by default, with a switch in the info menu to turn Firebase off at any time (previously off by default and opt-in). The data collected is the same closed set of events described in section 14. The stated legal basis for Firebase app analytics changed to legitimate interest instead of consent. Website analytics are unchanged: opt-in only.

24 August 2026 → 28 August 2026: the iOS and Android apps now include optional analytics (Google Analytics for Firebase), off by default and switched on from the info menu. Section 14 previously stated that the apps carried no analytics; it has been rewritten with the detail of what is and is not collected. Sections 2, 3, 4, 5, 7, 8 and 10 have been corrected to distinguish the website analytics from the app analytics.

20 August 2026 → 24 August 2026: sections 3, 5 and 15 corrected and one retention period extended. The division held in server memory now expires after 24 hours of inactivity instead of 2, so that a division survives being left overnight. The same sections previously described that memory store as applying only to deployments without a database, which was wrong: it applies to every deployment. Section 3 also corrected the owner token, which is stored in localStorage with a 24-hour self-expiry and not in sessionStorage.

27 June 2026 → 8 August 2026: section 7 corrected. The Microsoft Clarity masking mode was described as Strict; it was Balanced. Element-level masking has been applied to the calculator surfaces, and shared-result links no longer carry participant names in the address bar.

17. Contact

For privacy-related inquiries: privacy@fairdivider.com