Privacy policy

Last updated: 17 October 2026

Pay Up is an app for splitting expenses with friends. It's run by Sam Pham, in Singapore (“we”). This page explains what we collect, why, who can see it, how long we keep it, and what you can do about it. We follow Singapore's Personal Data Protection Act (PDPA).

The short version: we collect only what the app needs to work, and we never sell your data. There's currently no advertising or tracking in the app.

What we collect

  • Your account: your email address, username and password. The password is stored only in a scrambled form that can't be turned back into it.
  • Your names: your display name, and any name you choose to use in a particular group.
  • Your groups: group names, currencies, invite codes, who is in each group, and who is an admin or owner.
  • Expenses and payments: what you and your group members record — descriptions, amounts, dates, who paid, how it was split, and who recorded it.
  • Notifications the app sends you, and your notification settings.
  • Security records: to stop people guessing passwords, reset codes or invite codes, we note failed attempts (the username or email tried, or the network address used, and the time). These are deleted after one day. Our database provider also keeps short-lived technical logs, such as network addresses, to keep the service running and secure.

We don't collect your location, contacts, photos or payment card details. Pay Up doesn't move money: it only keeps a record of what people say they paid. There's currently no advertising or analytics code in the app. If we add ads or paid features, we'll update this policy and tell you in the app before they start.

Why we use it

  • To run your account and sign you in, including sending sign-up and password-reset codes by email.
  • To show you and your groups who owes whom, and to send you the notifications you've chosen.
  • To keep accounts and groups safe from misuse.

We don't use your data for anything else, and we don't sell or rent it to anyone.

Who can see it

  • People in your groups see your username, your display name (or the name you use in that group), and the expenses and payments in groups you share. They don't see your email address.
  • Nobody else using Pay Up can see your groups or your money.
  • Our service providers handle data only so the app can work:
    • Supabase: our database and sign-in service. Your data is stored on its servers in Singapore.
    • Resend: sends our emails (your email address and the code).
    • Expo: delivers app updates to your phone.
    • Cloudflare: hosts payupapp.app and forwards email sent to us.
    • Google Fonts: supplies the font on payupapp.app (Google sees your network address when your browser loads it).
    Some of them handle data outside Singapore. We only use providers that protect it to a standard comparable to the PDPA.
  • We'll share data with authorities only where the law requires it.

How long we keep it

  • Your account, for as long as you have it.
  • Failed sign-in, reset-code and invite-code attempts: one day.
  • A deleted group is hidden from everyone straight away, and erased for good 30 days later, with all its expenses, payments and notifications.

Deleting your account

You can delete your account in the app (Profile → Settings → Delete account), or by emailing us — see Delete your account. Your login, email address, password and username are deleted, along with your notifications and your profile name.

Expenses and payments you shared with other people stay in their groups, shown as “Deleted User”, because they're part of other people's records of who owes whom. In a group where you still owe or are owed money, your name in that group stays with “(deleted)” added, so the others know who the balance was with.

Keeping it safe

Data is encrypted on its way between the app and our servers, and our database provider encrypts it where it's stored. Each person can only reach their own data and their own groups' data, and the database itself enforces this. Repeated failed attempts at passwords, reset codes and invite codes are limited.

Your rights

Under the PDPA you can ask us:

  • what personal data we hold about you, and how it has been used;
  • to correct it if it's wrong;
  • to stop using it, which means deleting your account, since the app can't work without it.

Email privacy@payupapp.app from the address on your account. We'll reply within 30 days. Sam Pham is our data protection officer and reads that address.

Children

Pay Up isn't meant for children under 13. If you think a child has made an account, email us and we'll delete it.

Changes

If we change this policy, we'll update this page and the date at the top. If a change affects how your data is used, we'll also tell you in the app.

Back to Pay Up