Privacy Policy

Last updated: October 6, 2026

In short

No account, and nothing to sign up for. Fair Divider asks for no email, no phone number and no payment details. If you write to us to exercise a right, we use that email only to answer you.
Most of what we process is what you type. Participant names, the amount, the item or room descriptions and the choices made each turn, because the division cannot be computed without them. Your IP address is processed to serve the requests and kept only in short-lived security logs.
It deletes itself. Multi-device sessions are removed 7 days after they are created, a share link keeps a copy of the result for 7 days too and anyone holding that link can read it, the division itself is held in server memory and dropped after 24 hours of inactivity, and server logs are kept 7 days at most. If analytics are on (the website: only if you switch them on; the apps: unless you switch them off), Google and Microsoft keep that data longer on their side: roughly 14 months and 90 days.
Website analytics are off until you switch them on; app analytics are on until you switch them off. On the website it is opt-in, never enabled by default, and Microsoft Clarity replays your on-page interactions; masking keeps names, descriptions and amounts out of that recording, but it does see your approximate location from your IP. The "Cookie settings" link in the footer switches everything off again on the web; in the apps, analytics are on by default and the switch in the info menu turns them off at any time. The apps have no Clarity and no session replay: they send the actions you take and the screens you open, with no identifier stored or read on the device. Separately from all of that, and whether or not you switch anything on, our own server keeps a daily count of requests by kind, client and outcome; those counters name nobody and identify no device.
Your data is never sold. Our servers are in Germany and our database in the EU region; Cloudflare may route traffic through servers outside the EU under Standard Contractual Clauses, and if analytics are on, Google and Microsoft may process data outside the EEA. Write to privacy@fairdivider.com to exercise any of your rights; we answer within a month, extendable by two more for complex requests.

This summary is not the policy. The numbered sections below are what governs; where the two differ, they prevail.

1. Data Controller

Binary Spirit S.L.
Tax ID (CIF): B86508181, registered address in Madrid, Spain (see the Legal Notice)
Contact: privacy@fairdivider.com

2. What Data We Collect

Fair Divider collects the minimum data necessary to provide the fair division service:

Participant names — entered by users when creating a division session. These may be real names or pseudonyms.
Division data — total amount to divide, item/room descriptions, choices made per turn, timestamps, and division state.
Shared result links — when a division finishes on the website, the app prepares a short share link for it straight away, so that the share sheet opens without waiting. Preparing that link stores the result on our server, so that the same division can be opened on another device, or by the people you send the link to. What is stored is the participant names, the room or item names, the total, each person's amount, the shared costs and how they are split, and the currency. It is held in our MongoDB database on the origin server for 7 days and then deleted automatically. Anyone holding the link can read it, so send it only to the people concerned. Opening a link someone sent you stores nothing: the long form of the link carries the data inside the address itself, and the reader's browser never sends it to us. The apps and the multi-device mode produce only that long form, and it would reach our database only if the person who created it shortened it later, which neither can do today.
Technical data — IP addresses are processed by our server to handle REST API requests at /api/v1 but are not stored in our database beyond short-lived security logs.
Owner token — when you create a session, the server generates a random UUID called the "owner token" and returns it to your browser. The token is stored in localStorage under the key fairDivisionApiState, deletes itself 24 hours after it was last used, and is required to perform privileged operations on the session you created. It is never shared with other participants.
Local storage — we use your browser localStorage (key fairDivision_<roomId>) to enable session reconnection in multi-device mode. This data stays on your device.
Anonymous usage counters — our own server keeps a daily tally of how many requests each kind of operation received (including how many times each part of the site was opened), which client sent them (web, iOS or Android) and whether they succeeded. A stored row is a date, those three labels and a number. It holds no IP address, no session or division identifier, no owner token, no participant name and no device or user identifier of any kind, so it cannot be traced back to you or to any device. Per day and per participant group size, we additionally keep only a sample count and the sum of the ratio between the highest and lowest room price of completed divisions; this holds no names, amounts, currencies, or identifiers. This is separate from the optional analytics below and, because it identifies nobody, it does not depend on your consent.
Live visit counter — our own live visit counter, with no cookies and no identifiers; aggregate data discarded after 30 minutes.
Analytics data — the website's analytics tools process aggregate usage data and interactions only if you opt in; the apps' analytics tool does so by default until you switch it off in the info menu. This is described in sections 7 and 14.

We do not collect email addresses, phone numbers, payment information or precise geolocation data, and we do not require user accounts. If analytics are active (website: only if you opt in; apps: on by default), an approximate country- or region-level location is derived from your IP address.

3. How We Use Your Data

Providing the service — processing division sessions, synchronizing multi-device turns, calculating fair divisions, and keeping a finished result available for seven days so it can be reopened or shared through a link you generate.
Technical operation — server logging for error detection and security monitoring, and the anonymous usage counters described in section 2, which tell us whether the service is actually working.
Analytics — understanding aggregate usage to improve the website (only if you opt in) and the apps (on by default, can be switched off at any time) (see sections 7 and 14).

Legitimate interest (Art. 6.1.f) — for providing the core fair division service and maintaining server security, including keeping a finished result available for seven days so it can be reopened or shared through a link you generate, and the apps' analytics (section 14).
Consent (Art. 6.1.a) — for the optional website analytics described in section 7 (Google Analytics 4 and Microsoft Clarity). These load only if you opt in, are off by default, and can be switched off again at any time. Under Article 22 of the Spanish LSSI-CE, non-essential cookies require your prior consent.

5. Data Retention

Multi-device sessions (the room, its code, the participant names, the total amount and the room descriptions) are automatically deleted after 7 days from creation.
Shared result links — when a division finishes on the website, the short link prepared for it stores that result (the participant names, the room or item names, the total, each person's amount, the shared costs and how they are split, and the currency) in our database, and it is deleted automatically 7 days after it is created. Until then, anyone holding the link can open the result. Opening a link someone sent you stores nothing: the long form of the link is stored nowhere on our side, it exists only in the address you share, and the reader's browser never sends it to us.
The division itself — the rooms, the preferences entered and the resulting prices — is held in server memory, in every deployment, and deleted after 24 hours of inactivity. The database stores who is taking part in a multi-device session, the total amount and the room descriptions — not the turn-by-turn division, which stays in memory.
Server logs are retained for a maximum of 7 days.
Local storage on your device persists until you clear your browser data or the session expires.
Analytics data is retained by the relevant provider: approximately 14 months for Google Analytics and approximately 90 days for Microsoft Clarity (see section 7); the app analytics data is retained by Google for approximately 14 months (see section 14). No website analytics data is collected unless you opt in; app analytics are on by default and stop as soon as you switch them off.
Anonymous usage counters and room-price spread are daily totals with no personal data and are kept indefinitely.

6. Cookies and Similar Technologies

Fair Divider relies on strictly necessary cookies and equivalent storage technologies, which are exempt from prior consent under Article 22.2 of the Spanish LSSI-CE and the AEPD 2023 Cookie Guide. The website additionally offers optional analytics cookies that load only after you opt in, as described in section 7. The full inventory (strictly necessary own cookies, Cloudflare Turnstile cookies served on the multi-device page, browser-storage entries, and the optional analytics cookies set only after opt-in) is documented in our Cookie Policy.

We do not use advertising cookies, tracking pixels, or third-party cookies for profiling or behavioural advertising. On the website, the only non-essential technologies are the optional analytics described in section 7, which run solely with your consent. The apps' analytics is described in section 14. Cloudflare Turnstile is loaded on /multi for anti-abuse purposes only and sets no analytics or advertising cookies.

In addition to the strictly necessary technologies above, the Fair Divider website can load two optional analytics tools. They are disabled by default and run only after you give explicit consent. The mobile app analytics is separate (on by default in the apps, with an off switch) and is described in section 14.

Google Analytics 4 — provided by Google Ireland Limited, acting as our data processor. It produces aggregate usage statistics (for example, which pages are visited and from which country). Google Analytics 4 does not store raw IP addresses.
Microsoft Clarity — provided by Microsoft Ireland Operations Limited, acting as our data processor. It produces heatmaps and session replay (a reconstruction of on-page interactions such as clicks and scrolling). Clarity masks the content of input boxes and drop-down menus in every masking mode, and we additionally apply Clarity's element-level masking to the calculator itself — the setup form, the division, the proposal and the result — so participant names, item descriptions and amounts are not uploaded to Clarity. Clarity does record the address of the page you are on, the page you arrived from, your browser and device, and an approximate location derived from your IP address. Note that names and amounts are still sent to our own servers to compute the division, as described in sections 2 and 5; the masking above concerns only what Clarity receives.

Legal basis — your consent (Art. 6.1.a GDPR; Art. 22 LSSI-CE, which requires prior opt-in for non-essential cookies). When you first use the website we ask whether to enable analytics. You can choose "Accept" (strictly necessary + analytics) or "Reject" (no analytics); both are equally easy, analytics stays off unless you accept, and the sheet stays on screen until you choose without blocking this policy or the other legal pages. Your choice is stored in your browser under the fd-analytics key, with its date under fd-consent-at, and we ask again after 12 months.

What the website analytics receive. Only if you accept: the pages you open (without share-link or room codes), clicks on the calculator button and on the App Store and Google Play badges, the steps of a division (started, completed, shared, abandoned), language and theme changes, errors shown, that you pressed Accept, the language of the page, and which version of an interface test you were shown ("A" or "B"). Pages that do not exist are counted as such. Never names, amounts, descriptions or room codes. Google Analytics and Clarity assign your browser a pseudonymous identifier, so this is pseudonymous, not anonymous, data.

Consent-mode sequence. Google Analytics starts with every consent signal (analytics storage, advertising storage, advertising user data and ad personalisation) denied and sends nothing that identifies a browser. Only when you press Accept does it move analytics storage to granted; the advertising signals stay denied. Microsoft Clarity is not loaded at all until you accept. Clarity may set its own cookies on its own domains in addition to those on ours; they are listed in the Cookie Policy.

Withdrawing consent. You can change your mind at any time — withdrawing is as easy as giving consent. This applies to the website. (The apps' analytics does not rest on consent: it is on by default and you can object to it at any time under Art. 21 GDPR by turning off the "Share usage statistics" switch in the info menu; see section 14.) On the website, use the "Cookie settings" link in the footer of the Fair Divider app (the calculator pages) to reopen the chooser and switch analytics off; the analytics tools will no longer load. Withdrawing stops future collection and deletes the four analytics cookies (_ga, _ga_<id>, _clck, _clsk) on our domain, and tells Google and Microsoft that consent is withdrawn; it does not erase data Google and Microsoft already hold, which you can ask us to delete at privacy@fairdivider.com.

International transfers. Google and Microsoft may process analytics data outside the European Economic Area (for example, in the United States) under the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework, in accordance with Chapter V of the GDPR.

Retention. Google Analytics data is retained for approximately 14 months; Microsoft Clarity data is retained for approximately 90 days (the providers' configured/standard retention periods).

We do not sell, rent, or share your personal data with third parties. The one exception is a shared result link, which you create and send yourself: the result becomes readable by anyone holding that link until it expires (section 5). Our infrastructure providers process data on our behalf:

Hetzner Online GmbH (Germany, EU) — server hosting
Cloudflare, Inc. (USA, with EU processing and Standard Contractual Clauses) — CDN, DNS, and DDoS protection
MongoDB, Inc. (Atlas EU region) — database hosting

If you opt in to the optional website analytics described in section 7, Google Ireland Limited (Google Analytics 4) and Microsoft Ireland Operations Limited (Microsoft Clarity) also act as data processors on our behalf. For the app analytics (section 14, on by default until you switch it off), Google Ireland Limited likewise acts as a processor. We never sell your personal data.

9. International Transfers

Your data is primarily processed within the European Union (Hetzner Germany, MongoDB Atlas EU). Cloudflare may process traffic through global edge servers under Standard Contractual Clauses (SCCs) compliant with GDPR Chapter V.

If analytics are on, Google and Microsoft may also process data outside the EEA (for example, in the United States) under the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework, as detailed in section 7.

You have the right to:

Access — request a copy of your data
Rectification — correct inaccurate data
Erasure — request deletion of your data (sessions and shared result links auto-delete after 7 days). To have a shared result link removed sooner, write to support@fairdivider.com or privacy@fairdivider.com quoting its share code: the ten characters that follow /r/ in the link
Restriction — limit how we process your data
Portability — receive your data in a structured format
Objection — object to processing based on legitimate interest
Withdraw consent or object — withdraw your website analytics consent at any time via the "Cookie settings" link in the website footer, and switch the apps' analytics off at any time with the "Share usage statistics" switch in the info menu, without affecting the lawfulness of processing before that

To exercise any right, contact privacy@fairdivider.com with your division session code. We will respond within 30 days.

How to exercise your rights: Send an email to privacy@fairdivider.com identifying yourself. We will respond within a maximum of 1 month as required by Article 12.3 GDPR. If your request requires extraordinary complexity, we may extend this period by up to 2 additional months with prior notice.

11. Right to Complain

You have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es, or with your local supervisory authority.

12. Children

Fair Divider is not directed at children under 16 years of age. We do not knowingly collect data from children.

13. Automated Decision-Making

Fair Divider uses a mathematical optimization to calculate fair divisions. This is a mathematical computation, not profiling or automated decision-making with legal effects as defined in GDPR Art. 22.

14. Mobile Apps

The Fair Divider apps for iOS and Android use the same /api/v1 backend described in this policy, with the same purposes, the same retention periods and the same rights.

Analytics in the apps. The apps include analytics based on Google Analytics for Firebase. It is on by default, and you can turn it off at any time with the "Share usage statistics" switch in the app's info menu. Turning it off stops collection that same instant.

What is sent while it is on. The name of the actions you take (for example starting, completing, sharing or joining a division, changing the currency or language, errors shown), the screen you are on (from a fixed list), the mode of use (single device or several), the language of the app and, if you opened a share or join link that carried campaign tags, the source, medium and campaign of that link. The apps run Google Analytics for Firebase with every consent signal (analytics storage, advertising storage, advertising user data and ad personalisation) permanently denied, so the analytics code stores and reads no identifier on your device (no installation or app-instance ID) and sends identifier-free pings: they carry no persistent device or installation identifier and cannot be linked from one session to the next by an ID. A ping still travels over the network from your IP address, so Google receives standard device and usage data, such as the model, system version and language, and derives an approximate country-level location from the IP address. We therefore do not call this data anonymous: it is pseudonymous and IP-derived, and only coarse.

What is never sent. Participant names, room or item descriptions and amounts never leave the app for analytics, under any circumstances. The device advertising identifier is not used either: on Android we explicitly remove that permission from the app. We show no ads, build no profiles and do not track you across apps or websites.

Legal basis: our legitimate interest (art. 6(1)(f) GDPR) in understanding aggregate use of the apps in order to improve them, limited to the closed set of events described above (pseudonymous data, see above). You can object at any time, and switching the "Share usage statistics" switch off stops it that same instant; this does not affect the lawfulness of processing carried out before.

Processor, destination and retention. The data is processed by Google Ireland Limited on our behalf, in the same Google Analytics 4 property used by the website, and is retained for approximately 14 months. Google may process it outside the European Economic Area under the conditions in section 9. Your rights and how to exercise them are those of sections 10 and 11.

The apps do not include Microsoft Clarity or any advertising SDK, and do not request device permissions beyond what is strictly required for the user-initiated action (for example, sharing a division link). Diagnostic data sent by the operating system to its respective app store (Apple App Analytics, Google Play Console) is governed by the privacy policies of Apple and Google respectively, and not by Binary Spirit S.L.

15. Account & Data Deletion

Fair Divider does not require a user account. Multi-device sessions and shared result links auto-expire 7 days after they are created, and the division itself is dropped from server memory after 24 hours of inactivity. To delete your data sooner, or to remove all locally stored data on your device, see our dedicated Account & Data Deletion page.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date.

30 August 2026 → 7 September 2026: shared result links are now described. When a division finishes on the website, a short share link is prepared for it, and that stores the division's result — the participant names, the room or item names, the total, each person's amount, the shared costs and how they are split, and the currency — in our database for 7 days, where anyone holding the link can read it; opening a link someone sent you stores nothing, because the long form carries the data in the address and never reaches our server. Sections 2, 3, 4, 5, 8 and 15 have been updated, and section 10 now gives the route to have a shared link removed before it expires.

6 October 2026, second revision: app analytics remain on by default with the same switch, but the apps now run Google Analytics for Firebase with all consent signals permanently denied, so no identifier is stored or read on the device and the analytics pings are identifier-free. Sections 6 and 14 no longer mention a random installation identifier; the data sent is otherwise unchanged. The legal basis (legitimate interest) and the right to object by switching the setting off are unchanged.

5 October 2026 → 6 October 2026: wording clarified, no change in the data processed. Section 14 now states that the app event data is pseudonymous; section 6 distinguishes the website from the apps; section 7 explains that turning off the apps' switch is an objection (Art. 21 GDPR), not a withdrawal of consent.

1 October 2026 → 5 October 2026: app analytics are now on by default, with a switch in the info menu to turn them off at any time (previously off by default and opt-in). The data collected is the same closed set of events described in section 14. The legal basis for app analytics is now legitimate interest instead of consent. Website analytics are unchanged: opt-in only.

24 August 2026 → 28 August 2026: the iOS and Android apps now include optional analytics (Google Analytics for Firebase), off by default and switched on from the info menu. Section 14 previously stated that the apps carried no analytics; it has been rewritten with the detail of what is and is not collected. Sections 2, 3, 4, 5, 7, 8 and 10 have been corrected to distinguish the website analytics from the app analytics.

20 August 2026 → 24 August 2026: sections 3, 5 and 15 corrected and one retention period extended. The division held in server memory now expires after 24 hours of inactivity instead of 2, so that a division survives being left overnight. The same sections previously described that memory store as applying only to deployments without a database, which was wrong: it applies to every deployment. Section 3 also corrected the owner token, which is stored in localStorage with a 24-hour self-expiry and not in sessionStorage.

27 June 2026 → 8 August 2026: section 7 corrected. The Microsoft Clarity masking mode was described as Strict; it was Balanced. Element-level masking has been applied to the calculator surfaces, and shared-result links no longer carry participant names in the address bar.

17. Contact

For privacy-related inquiries: privacy@fairdivider.com