Privacy Policy

Hissa is a bill-splitting app made by Luminaris Systems LLC (“Hissa”, “we”). This policy covers the Hissa app, the group pages people open from an invite link, and this website.

What we collect

Sign-in: Email address and name. With Apple or Google: your email, name and their ID for you, never your password. For Apple, also a token kept only to revoke Hissa’s access later.
Profile (optional): Photo, phone number, and where people can pay you (Venmo, Cash App, PayPal, Zelle, UPI), and your default currency.
Groups and expenses: What you and your group record: names, members, expenses, amounts, notes, comments, payments marked as made, and the history of edits.
People you invite: Their name, and an email or phone number if you add one. From your contacts, Hissa receives only the one person you pick.
Receipts and screenshots: Photos, screenshots or PDFs you scan or share (receipts, payment feeds, statements), and the text read from them.
What you type or say: The sentence you type. When you dictate, your phone turns speech into text (on the device where it can, otherwise through Apple’s speech service). Hissa receives the text, never the audio.
Payment alerts (optional, Hissa Plus): Amount, currency, merchant, card issuer and last four digits, which app the alert came from and when, a category, whether it’s still pending, and for a bill its due date; for a payment between people, the other person’s name or handle and note. From a receipt or emailed order: the items, tax, tip and order number. See Payment alerts.
Forwarded email (optional, Hissa Plus): Your private Hissa forwarding address. For emails you forward to it: sender, subject, date and body, read to find the purchase. We keep what we found, not the email. If Gmail sends a forwarding confirmation code, we pass it to you.
What Hissa learns: How you usually split a store or item, and with whom, so the next suggestion is better.
Subscription: Whether you have Hissa Plus, which plan, and when it renews or ends. Apple takes the payment. We never receive card details.
Device and logs: A push-notification token per device, your phone’s time zone, and daily counts of your AI use. Server logs with your IP address, your browser’s or app’s user-agent string, the address requested, status and timing; a log line can include your account ID, an email address or a group link. Short-lived rate limits keyed by IP, email, account or group.

On your phone, Hissa stores your sign-in token in the system keychain, a copy of your groups so the app works offline, and a short list of recent alerts if you use payment alerts. Group pages on the web use your browser’s local and session storage to remember who you said you are; they set no cookies. This website sets no cookies and loads nothing from other companies.

How we use it

Only to run Hissa: sign you in, keep each group’s ledger, read what you send, notify you, provide Hissa Plus, prevent abuse and fix problems. Never for advertising, and Hissa doesn’t track you across other apps or sites.

AI

Hissa uses AI models to turn a sentence, a receipt or an alert into an expense, to sort who a purchase is for, and to write explanations, reminders and trip summaries. Some of these, such as explanations and reminders, work without Hissa Plus. We send the model what the job needs:

the text you typed or dictated, with your name, the date, and your group’s name, currency and members’ names;
a receipt photo or a screenshot you share, with any text your phone read from it; with a screenshot, also your group’s name, currency and members’ names;
for a purchase to sort: the store or payee, items, amounts, your group names and members’ names, and who paid;
an alert or forwarded email you’ve chosen to share: long numbers are masked in alerts; an email goes whole, with its sender line, which can be your own address;
for explanations, reminders and trip summaries: names, expense names, amounts, totals and who pays whom in that group.

We don’t add your email, phone number or payment handles to what we send. Whatever is in a photo, screenshot, sentence or email you share goes as it is. Today requests go through OpenRouter to hosts of DeepSeek models, and we tell OpenRouter to use only hosts that don’t collect your content to train models. If we change AI providers we’ll update this page.

We keep the result, such as the expense. A failed request leaves a short line in our server logs, which can include the provider’s error message. We also save answers so the same thing isn’t asked twice: what kind of place a store is and its everyday name, whether an item or a purchase there is usually shared, whether a payee (which can be a person’s name) is a business, and how an alert that couldn’t be read on your phone was read (merchant or person’s name, amount, last four digits). None of these saved answers is linked to your account, and they stay after you delete it.

AI can be wrong, so Hissa shows you its reading before a new expense is saved. After you’ve split a purchase, a later alert or emailed receipt for it updates that expense: a tip, the final total or a refund changes the split, and Hissa tells you and the group; the receipt’s lines are added, and only you’re told.

Payment alerts

Payment detection is off until you set it up, and it’s part of Hissa Plus. On iPhone it works through Shortcuts automations that you create, for the apps you choose. Hissa can’t read your notifications by itself.

Alerts are read on your phone, and only the cleaned-up details leave it. If an alert with a number in it can’t be read on the phone, or the phone can’t tell the merchant, its text goes to the AI, with the app’s name, the alert’s title (for a text message, the sender) and when it arrived. That’s on by default; you can turn it off in the app, and then an alert your phone can’t read stays on it. For one it can read, the merchant’s or payee’s name still goes to the AI to be cleaned up and sorted. Your phone masks long numbers before the text leaves it, and our server drops balance lines before the AI sees it, but a promotion or a short one-time code from an app you picked can still be sent.

What others see

People in your groups see your name, profile photo, the payment handles you’ve added, and everything recorded in that group. Your sign-in email is part of your member entry, so it reaches their phones too, as does an email or phone number typed for someone invited.
Anyone with a group’s invite link can open its page without an account. They see the group’s name and dates, members’ names, balances, recent expenses (with receipt photos), payments with their notes, and pay-me links. They can mark a payment as made, take that back, and add a pay-me handle for a member who has no account. They never see sign-in emails; a Zelle handle is an email or phone number, and is shown. Share links only with the group.
Profile photos, and receipt photos opened from a group link, are served from long, unguessable web addresses, without a sign-in.
People you invite by email get an email from Hissa with your name, the group’s name and its link. Text invites are sent from your own Messages app.

We share information only with the companies that provide these services to us, only what each needs, and we require them to protect it at least as well as this policy does.

Hetzner: Hosts our server and database in Helsinki, Finland (EU).
OpenRouter and the model hosts it routes to: AI processing, as described under AI.
Resend: Sends sign-in codes and invite emails.
Expo, then Apple’s push service: Delivers notifications. A notification can include names, group and expense names, merchants, amounts, the start of a comment, and a Gmail forwarding code.
RevenueCat and Apple: Hissa Plus purchases and status. RevenueCat receives your Hissa account ID and App Store purchase details, not your name or email.
Apple and Google: Sign in with Apple and Google sign-in.
An inbound email service: Receives the emails you forward to your private Hissa address, if you use that feature.

We may also disclose information if the law requires it, or if Hissa is part of a merger or sale, in which case this policy keeps applying to your information.

Most of these companies are in the United States, so your information may be processed there and in other countries whose privacy laws differ from yours. Where the law requires a safeguard for that transfer, such as standard contractual clauses, we rely on it.

Security

Connections to Hissa use HTTPS. Session tokens are stored hashed on the server; on your phone yours sits in the keychain. The token Apple gives us to revoke access, and sign-in codes for their 10 minutes, are stored as received. Access to the server is limited to the people who run it. No system is perfectly secure; if something goes wrong that affects you, we’ll tell you.

How long we keep it

Your account, groups, detected payments and what Hissa has learned: Until you delete your account, or the group. A group’s ledger keeps its edit history so balances can always be explained.
Sign-in sessions: Until you delete your account. Signing out removes the session from your phone.
Sign-in codes: Valid for 10 minutes; removed when used, or at the next clean-up.
Rate limits: About 24 hours, then removed at the next clean-up.
Notification history: About 30 days, cleared when your next notification arrives.
Receipt photos: As long as the expense they belong to. Unused ones, and ones from a deleted group, go after about 7 days, the next time whoever added them uploads a photo; until then only that person can open them.
Contact details you typed for someone else: In that group’s history, even if edited later, until the group is deleted or that person joins and deletes their account. Not on Hissa and want yours removed? Email support@tryhissa.com.
Saved AI answers: Kept, and not linked to your account. See AI.
Server logs: A limited rolling window, then overwritten.
Backups: Nightly database backups are kept for 14 days. Our host also keeps daily snapshots of the server, replaced on a rolling basis.

Deleting

Delete your account in the app: You → Delete account. It happens right away. Step by step.

Deleted: your account, sign-in sessions, devices, profile photo, payment handles, detected payments, what Hissa learned about your splits, and any group where nobody else with a Hissa account is still a member.
Stays in groups you shared: the expenses and payments, so other people’s balances don’t change, with the names and notes you gave them, their receipt photos, and contact details you typed for other people. You become a former member: your email, phone, handles and photo are removed, your comments are blanked, and your name stays as others knew it.
Apple: if you used Sign in with Apple, we ask Apple to revoke Hissa’s access.
Backups: copies roll off our nightly backups within 14 days, and off our host’s snapshots on its own rolling schedule. RevenueCat and Apple keep their own purchase records.
Hissa Plus: deleting your account doesn’t cancel it. Cancel in iPhone Settings → your name → Subscriptions.

Your rights

You can see and edit most of your information in the app. You can also ask us for a copy of it, to correct it, to delete it, or to stop or limit how we use it: email support@tryhissa.com. We’ll answer within 30 days.

In the EU, UK or a similar region: Luminaris Systems LLC is the controller of your information. We rely on our contract with you to provide the service, on your consent for optional features such as payment alerts and email forwarding (stop them any time: delete the Shortcuts automations, or stop forwarding in your email), and on our legitimate interest in keeping Hissa secure and working. You can complain to your local data protection authority.

In California or another US state with a privacy law: we don’t sell your personal information or share it for cross-context behavioral advertising, and we won’t treat you differently for using your rights.

Children

Hissa isn’t meant for children under 13, and we don’t knowingly collect their information. If you think a child has given us information, email us and we’ll delete it.

Changes

If we change this policy in a way that matters, we’ll say so in the app or by email before it takes effect, and update the date above.

Contact

Luminaris Systems LLC
124 Hague St, Jersey City, NJ 07307
support@tryhissa.com