Legal

Privacy Policy

Last updated 10 October 2026

Who we are

The code-red apps, Chrome extensions and this website (the “apps”) are provided by code-red (“we”, “us”). We are the controller of the personal data described here.

What stays on your device

Everything you create in the apps — for example routines, countdowns, tasks, reminders, recipes, scans and photos — is stored only on your device (in the app's own storage on Android, or in your browser's storage on the web). It is not uploaded to us unless you use a feature that exists to share or read it, described below (for example sharing a Split group). Otherwise it leaves your device only if you export a backup or share something yourself. Uninstalling an app or clearing your browser's site data deletes it, and we cannot recover it.

Android permissions such as notifications, camera or access to your local network are used only for the feature that asks for them, and what they produce stays on your device.

Chrome extensions

The Code Red extensions for Chrome (such as Units and Highlighter) work inside your browser. Their settings and what you create in them — word lists, saved pages, captures — are kept in the browser's own extension storage on your device and are not sent to us. They read the pages you visit only to do their job (for example, to find measurements or your highlight words) and never send page content anywhere. They show no ads and contain no analytics or tracking.

If you choose to sign in, the extension receives your Code Red account from account.code-red.app: your name, email address, profile picture, whether you have left a tip, and a sign-in token. It keeps them on your device to show who is signed in and to use account features; signing out in the extension, or on account.code-red.app, deletes them from the extension. Tips open account.code-red.app and are paid through Stripe, as in the apps.

What we collect

If you sign in with Google (optional)

Signing in is never required to use the apps. If you sign in, we receive through Firebase Authentication your name, email address, profile photo link and Google account identifier. We also store which code-red apps you have signed in to and when. One account works across all code-red apps.

Settings sync (optional, per app)

If you turn on “Sync settings” in an app, that app's settings (such as sounds, layout or preferences) are stored against your account so they match on your other devices. Your content is never synced.

Tips (optional)

You can leave a one-off tip. Tipping requires signing in so every app remembers your support. Payments are processed by Stripe (on the web) or Google Play (in the Android apps): you enter your payment details with them, not with us, and they handle them under their own privacy policies. To confirm a tip we store a scrambled (hashed) reference to the payment, the tip option, its status (for example paid or refunded), the time, and the account it belongs to, plus your supporter status (supporter or not, since when, number of tips).

Split: shared groups and Live Claim (optional)

A Split group stays on your device until you share it. When you share a group, or join one from an invite link, the group is stored in Cloud Firestore so that its members can see and add to it: the group's name and currency, every member's name, the expenses and payments (descriptions, amounts, dates, categories, who paid, how it was split, notes, receipt lines) and their edit history. Only the group's members can read it; members see each other's names, never email addresses. Photos of receipts stay on your device. You can join a group as a guest without signing in: your device then gets an anonymous identifier that links you to the group, kept until you clear the app's or browser's data (if you sign in later, it is linked to your account). Leaving a group removes you from it; its creator can delete it for everyone.

Live Claim puts one bill (its name, currency, lines and total) online so that the people at the table can claim what they had from their own phone or browser. People who join type a name and get an anonymous identifier; they do not need to sign in. Anyone with the link can see the bill, the names typed and who claimed what. A Live Claim and everything in it is deleted about 18 hours after it starts.

Split: reading a receipt in the cloud (optional)

Reading a receipt on your phone sends nothing. If you are signed in and choose a cloud reading, a smaller copy of that one photo (without its location or camera details) is sent through our server function to an AI provider — today Google Gemini, with LlamaIndex (LlamaCloud) as the alternative — which returns the receipt's lines. We store neither the photo nor the answer; we keep a usage record (time, provider, cost, whether it was a free reading) against your account.

Balance top-ups (optional)

Some optional features that cost us money each time, such as cloud receipt readings beyond the free ones, are paid from a balance you top up yourself through Google Play. We store each top-up (product, amount, currency, Play order reference) and your balance against your account. Your payment details stay with Google.

Exchange rates (Split)

To convert an amount, Split asks Frankfurter (api.frankfurter.dev, European Central Bank reference rates) for a rate. The request carries only the two currency codes and the date — never amounts, names or group data. You can turn this off in Split's settings and type rates yourself.

Notifications (Android, while signed in)

While you are signed in, the Android apps register for push notifications (a random installation identifier and a Firebase Cloud Messaging token) so we can tell you about your account, for example when credit is added. We never send marketing notifications.

Crash reports (optional)

When an app crashes, it asks whether to send a crash report, unless you chose Always or Never (in the first screen or in Settings → Privacy). Nothing is sent until you agree. A report contains the error and where in the app's code it happened, the app version, the screen type that was open (for example “a routine”, never which one), and in the Android apps the device model, Android version, free memory and storage and a random installation identifier. It never contains your content or account details, and we remove things like email addresses and long numbers from error text. Android reports go to Firebase Crashlytics; web reports go to our own server function and Google Cloud's error reporting.

Technical logs

Our hosting and server functions keep standard operational logs — such as IP address, time and the request made — to run the service securely and fix problems.

What we do not do

• No advertising, no analytics and no third-party tracking.
• We do not sell or share your personal data for marketing.
• We do not read or analyse the content you create; it is uploaded only when you use a sharing or cloud feature described above.

The apps store small items on your device to work: your sign-in state (so you stay signed in), your supporter status, whether you chose to hide tip suggestions, your crash report choice and any crash report waiting for your decision. The apps set no cookies, and none of this is used for tracking.

Why we use your data (legal bases)

Who processes data for us

• Google (Firebase Authentication, Cloud Firestore, Cloud Functions, Firebase Hosting, Firebase Crashlytics, Cloud Logging, Google Play) — our infrastructure and, on Android, payment provider.
• Stripe — payment processing for tips on the web.
• LlamaIndex (LlamaCloud) — alternative reader for receipts you choose to read in the cloud (Split).
• Frankfurter — exchange rates (Split); receives currency codes and dates only.

Account data is stored in Google Cloud data centres in the European Union (Firestore multi-region “eur3”; server functions in Belgium). Some providers may process data in other countries, including the United States, under appropriate safeguards such as the UK International Data Transfer Addendum or Standard Contractual Clauses.

How long we keep data

• Account, app sign-ins, synced settings and supporter status: until you delete your account.
• Payment records: as long as needed for refunds, disputes and our legal record-keeping (up to 6 years). When you delete your account, they are detached from it.
• Crash reports: up to 90 days in Firebase Crashlytics, and up to 30 days in Google Cloud's logs for web reports.
• Technical logs: kept for a limited period by our hosting provider, typically up to 30 days.

Deleting your data and your choices

• Turn off settings sync in any app's Settings at any time.
• Choose Ask, Always or Never for crash reports in any app's Settings → Privacy. Never also deletes reports still waiting on the device.
• Delete your account and all cloud data from any app: Settings → Delete account & cloud data (details on the delete account page). Data on your device stays unless you delete it.
• Remove the apps' access to your Google account at myaccount.google.com/permissions.
• Or sign in at account.code-red.app and use Privacy and data to export or delete everything.

Your rights

You have the right to access, correct, export or delete your personal data, and to object to or restrict how we use it. Export or delete it yourself at account.code-red.app → Privacy and data. If you are unhappy with our response you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

Children

The apps are not directed at children under 13, and we do not knowingly collect personal data from them. Signing in and tipping require a Google account in your own name.

Changes

We may update this policy. The “last updated” date above will change, and we will tell you in the apps about significant changes.