Privacy Policy for the Niffl app

Last updated: October 2026

This page explains what data Niffl processes, why, who sees it and how to have it deleted. If anything is unclear, write to us at info@crewz.io.

In short

• Niffl needs no account, no email address and no password. We only know you by a random user ID and the name you enter.
• Everything you add to a group is visible to everyone in that group.
• Groups and expenses are stored on servers in the EU.
• No ads, no selling of data, no advertising IDs.
• Usage statistics and crash reports only if you agree.

1. Controller

The controller for data processing in Niffl is Crewz GmbH, Paul-Ehrlich-Straße 7, 79106 Freiburg im Breisgau, Germany, represented by its managing director Marcel Bihl. You can reach us at info@crewz.io.

2. What Niffl processes and why

2.1 Signing in without an account

On first launch, Niffl signs your device in through Firebase Authentication, without an account. This creates a random user ID, a pseudonym: it doesn’t reveal who you are. We use it to link your groups to you and to protect them from strangers. For the sign-in, Google technically processes your device’s IP address.

• Legal basis: Art. 6(1)(b) GDPR (using Niffl under our terms of use)
• Retention: until you ask us to delete your data (section 6), at the latest until you haven’t opened Niffl for 24 months. Then we delete your sign-in and your profile automatically and remove you from your groups as if you had left (2.3). Until then, the user ID stays on the server even if you delete the app.

2.2 Your name

You give Niffl a name that the others in your groups see; a nickname is fine. We store it in your profile and in every group you are in. If you change it under Settings → Profile, it changes in all your groups.

• Legal basis: Art. 6(1)(b) GDPR
• Retention: in your profile until deletion (section 6), at the latest after 24 months without use (2.1); in groups as described in 2.3

2.3 Groups, expenses and payments

For each group we store:

• the group’s title, emoji, currency and code,
• the names of everyone in the group and, for people using the app, their user ID,
• for each expense and payment: title, amount, date, who paid, for whom, who added it and last changed it, and when,
• the history of every change to an expense, with the value before and after,
• the resulting balances and when the group last changed.

Who sees it: Everyone connected to the group sees all of this and can change it. Anyone with a group’s code or invitation link sees its title, emoji, currency and the names in the group before joining, and can join. So only share the code with people who belong in the group.

Expenses just for you: An expense you add only for yourself is shown only to you, and nobody gets a notification about it. But it is stored like any other expense with the group’s data and is also transferred to the others‘ devices, where Niffl only hides it. So it isn’t meant for secrets.

Data others enter: Whoever adds you to a group enters your name and can add expenses for you, even before you use Niffl. This data then comes not from you but from the others in the group.

People without Niffl: You can add the names of people who don’t use Niffl. Only do so if they agree, or use a nickname. For their names, the legal basis is Art. 6(1)(f) GDPR: the group’s legitimate interest in settling shared expenses. These people have all the rights in sections 7 and 8 too.

• Purpose: so you can record and settle shared expenses
• Legal basis: Art. 6(1)(b) GDPR
• Retention: as long as the group exists. If you leave a group, your name stays there as a person without the app, together with your entries, so the others‘ balances stay correct (Art. 6(1)(f) GDPR). If you don’t want your name to stay there, write to us: we replace it with a placeholder and keep the amounts. When the last connected person leaves a group, it disappears from all lists and is deleted with all its expenses after 30 days. Until then, joining with the code brings it back.

2.4 Backups and server logs

We back up the database daily and keep each backup for 14 days; we can also restore it to any point within the last seven days. Deleted data therefore disappears from the backups within 14 days.

Our server functions write logs so we can find errors: technical messages, including group codes and, when a notification cannot be delivered, the push token. Google keeps these logs for 30 days.

• Purpose: so no group is lost after an error or outage, and so we can find errors
• Legal basis: Art. 6(1)(f) GDPR

2.5 Notifications

Niffl asks whether it may send you notifications: after you create or join a group, and when you turn on notifications in Settings. Only if you agree

• do we store a push token in your profile (the address at which your device receives notifications), the app language and your choice for the „Expenses“ and „Payments“ switches,
• does our server send you a notification when someone in your groups adds, changes or deletes an expense or payment. It contains the group’s title, the person’s name, the expense’s title, the amount and your share.

Notifications go through Expo’s push service (650 Industries, Inc., USA) to Apple (Apple Push Notification service) or Google (Firebase Cloud Messaging), which deliver them to your device. Expo stores the push token in order to deliver notifications, but keeps the content only for as long as sending takes. Depending on your device settings, notifications may be visible on the lock screen.

• Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time, in Niffl under Settings → Notifications or in your device settings.
• Retention: we delete the push token as soon as Apple or Google report it as invalid, at the latest together with your profile.

2.6 Niffl Pro

You buy Niffl Pro in the App Store or on Google Play. Payment happens there: we never see your payment details or your Apple or Google account. The privacy policies of Apple and Google apply to the purchase.

Niffl checks whether you have Pro through RevenueCat (RevenueCat, Inc., USA). For this, RevenueCat receives a random RevenueCat ID that is not linked to your Niffl user ID, the purchase data from the store (product, price, currency, store country, purchase and expiry date, transaction numbers), plus operating system, app version and, technically, the IP address.

• Legal basis: Art. 6(1)(b) GDPR
• Retention: as long as you use Niffl; on request we delete your data at RevenueCat (section 6)

2.7 Usage statistics (only with your consent)

On first launch, Niffl asks whether we may collect usage statistics and receive crash reports (2.8). Only if you agree does the app send data to Google Analytics for Firebase:

• which screens you open and which features you use, for example „group created“ or „expense added“, with details such as the number of people involved,
• automatically collected events such as first launch, sessions, updates and in-app purchases,
• app version, device model, operating system, language and an approximate location (country, region, city) that Google derives from the IP address without storing the IP address,
• a random installation ID, your user ID, your plan (free or Pro) and the number of your groups.

Niffl does not send names, the titles or amounts of your expenses, group codes or advertising IDs. Google processes the data only on our behalf: data sharing for Google’s own purposes and Google Signals are turned off.

• Purpose: to understand what works well in Niffl and what we should improve
• Legal basis: your consent, Art. 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). You can withdraw it at any time under Settings → „Statistics and crash reports“; from then on, Niffl sends neither statistics data nor crash reports.
• Retention: Google deletes individual events after two months; after that, only aggregated figures remain that cannot be linked to you.

If you are under 16, ask your parents before you agree.

2.8 Crash reports (only with your consent)

If you agreed (2.7) and Niffl crashes or something goes wrong, the app sends a report to Firebase Crashlytics (Google). It contains the technical error description, device model, operating system, the state of the device (such as free memory), app version and update, language, plan, time, a random installation ID, your user ID and a list of the last steps in the app (such as which screens were open). We deliberately leave out names, titles, amounts and group codes.

• Purpose: to find and fix bugs
• Legal basis: your consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG, the same as in 2.7 and just as revocable at any time
• Retention: 90 days

2.9 App updates

On launch, Niffl asks Expo (650 Industries, Inc., USA) whether there is an update for the app and downloads it. The app sends its operating system, app version, update channel, Niffl’s project ID and a random installation ID, plus, technically, the IP address. No device identifiers are included.

• Purpose: to fix bugs quickly without waiting for a store update
• Legal basis: Art. 6(1)(f) GDPR and Section 25(2) No. 2 TDDDG
• Retention: only as long as Expo needs the data to run the service

2.10 Invitation links

Invitation links look like this: niffl.crewz.io/ABCDEFGHI. If Niffl is installed, your device opens the link straight in the app. Otherwise the browser opens it at Firebase Hosting (Google), which forwards it to our website crewz.io. Google technically processes the IP address, time and browser; we store none of it ourselves. The website has its own privacy policy.

• Legal basis: Art. 6(1)(f) GDPR, so that invitations arrive reliably

2.11 Help and contact

If you tap „Help and contact“ in Settings, your mail app opens with an email to info@crewz.io. Below your text it lists the app version, operating system, device model, your user ID, the codes of your groups and your RevenueCat ID. You see everything before you send it and can delete lines. With the codes, we can look at the groups concerned if that is needed to solve the problem. We use your email and your email address only to help you.

• Legal basis: Art. 6(1)(b) GDPR, otherwise (f) (answering your request)
• Retention: until your request is resolved, unless statutory retention periods require longer

2.12 Data on your device

Niffl stores on your device your sign-in, a copy of your groups and expenses so the app also works offline, your plan, your answer about statistics and crash reports and settings such as the people view. This is necessary for the app (Section 25(2) No. 2 TDDDG). If you delete the app, your device deletes this data. Only the sign-in may remain in the keychain on iPhone and iPad; if you reinstall Niffl there, you are connected to your groups again.

2.13 Permissions

Niffl asks for one permission only: notifications. Besides that, the app uses the internet and, on Android, Google Play billing. Niffl does not access your contacts, photos, camera, microphone or location, and it does not track you across other companies‘ apps and websites.

3. Accounts from earlier versions

Up to version 2, you could sign in to Niffl with an email address; Firebase sent a sign-in link for that. Since version 3 we no longer need these addresses and have deleted them. If you signed in that way, Niffl keeps using your sign-in, and your groups stay as they are.

4. Who receives data

• The others in your groups, as described in 2.3.
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor for Firebase: sign-in, database (Cloud Firestore), server functions (Cloud Functions) and their logs, invitation links (Firebase Hosting), usage statistics, crash reports and the delivery of notifications to Android devices. The database and the server functions run in data centres in Belgium and the Netherlands; Google also processes the sign-in, the usage statistics and the crash reports in the USA.
• 650 Industries, Inc. (Expo), USA, as our processor for notifications and app updates.
• RevenueCat, Inc., USA, as our processor for Niffl Pro.
• Apple for delivering notifications to iPhone and iPad; Apple and Google also as store operators, responsible for purchases themselves.
• Our email provider, which holds the emails sent to info@crewz.io, as our processor.
• Authorities, where we are legally required to.

We have concluded data processing agreements under Art. 28 GDPR with our processors. We do not sell data and do not pass it on for advertising.

5. Data in the USA

Google (sign-in, usage statistics, crash reports), Expo and RevenueCat may process data in the USA. The EU Commission has found an adequate level of data protection for companies certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); Google LLC and 650 Industries, Inc. are certified. For RevenueCat, the EU Commission’s standard contractual clauses apply (Art. 46(2)(c) GDPR).

6. Deleting your data

You can do much of it yourself in the app:

• Leave a group: in the group, tap the pencil at the top right, then „Leave group“
• Change your name: Settings → Profile
• Turn off notifications: Settings → Notifications or your device settings
• Turn off usage statistics and crash reports: Settings → „Statistics and crash reports“

Delete everything: Write to us via Settings → „Help and contact“. The email contains your user ID, which lets us find your data. If you have already deleted the app, tell us the code of one of your groups and your name in it; if necessary, we will check that the data really belongs to you. Within one month we then delete your sign-in, your profile with name, push token and settings and your data at RevenueCat, and ask Google to delete your usage statistics. We remove you from your groups as if you had left and, on request, replace your name with a placeholder. Google deletes crash reports by itself after 90 days. We also delete your sign-in and profile without a message from you if you don’t use Niffl for 24 months (2.1).

This does not end a Niffl Pro subscription. Cancel it in the subscription settings of your Apple Account or on Google Play.

7. Your rights

You have the right to

• access your data (Art. 15 GDPR),
• have incorrect data rectified (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw your consent with effect for the future (Art. 7(3) GDPR),
• lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany. You can also contact the authority where you live.

Just write to us at info@crewz.io.

8. Your right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). This concerns backups, server logs, app updates, invitation links, your name and entries in groups you have left, and the names of people without Niffl. We then stop processing this data unless we can demonstrate compelling legitimate grounds that override your interests, or we need it to establish, exercise or defend legal claims.

9. What you have to provide

For Niffl you only need a name; without one you cannot create or join a group. Everything else is optional: notifications, usage statistics, crash reports and Niffl Pro. We make no automated decisions within the meaning of Art. 22 GDPR.

10. Security

The app talks to our servers only over encrypted connections, and Google stores the data encrypted. Rules in the database ensure that only the people in a group can read its expenses. Group codes have nine characters and are practically impossible to guess. The data is not end-to-end encrypted: our server reads it to calculate balances and send notifications.

11. Changes

When Niffl or the law changes, we update this privacy policy. You’ll find the current version in the app under Settings → Privacy policy and on crewz.io.