To provide our mobile app, we use services from Firebase and/or Google Cloud. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

In particular, we use the following Firebase services:

• Firebase Authentication for user login,
• Cloud Firestore for the storage and real-time synchronization of app data,
• Cloud Storage for Firebase for the storage of uploaded images and files.

To provide the app, we store personal data in Firebase to the extent necessary for the use of the app functions. This includes, in particular, user identifiers, login data, travel information, expense and transaction data, participant data, notes, technical metadata, and content stored by the user within the app.

This data is used to provide the app functions, in particular to display, synchronize, store, and delete trips, expenses, participants, profile pictures, uploaded photos, and other app content. Under data protection law, the mere storage, retrieval, display, modification, and deletion of such data already constitutes processing.

Processing is carried out to provide the app and its functions in accordance with Art. 6(1)(b) GDPR. Where individual information or uploads are provided voluntarily and are not strictly necessary for the use of the app, processing may additionally be based on consent pursuant to Art. 6(1)(a) GDPR. Where processing is necessary for the secure, stable, and efficient provision of our service, it is also carried out on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR.

Google processes the data on our behalf. The basis for this is the Firebase Data Processing and Security Terms and/or the data processing agreements concluded with Google.

The Firestore database of our app is operated in the European multi-region eur3. According to Google, this includes the regions Belgium and the Netherlands as well as Finland as a witness region. The Firebase Storage bucket for uploaded images and files is operated in the dual-region EUR4. According to Google, this includes the regions Finland and the Netherlands.

Uploaded profile pictures, photos, and files

Users can upload profile pictures as well as other images or files within the app. This may particularly concern photos relating to profiles, trips, expenses, receipts, or other app content.

In particular, the following data may be stored:

• image or file contents,
• file name,
• file type,
• file size,
• upload time,
• storage path and/or download URL,
• technical metadata,
• assignment to the respective user account, to a trip, expense, or transaction.

Depending on the content of the uploaded images, they may contain personal data, particularly if persons, places, receipts, invoices, names, payment information, or other personal information are recognizable.

The uploaded content is stored via Cloud Storage for Firebase. Associated references, storage paths, metadata, or assignments may be stored in Cloud Firestore.

The storage and use take place in order to provide the respective app functions, in particular the display of profile pictures, the assignment of images to trips or expenses, and the management of user-generated content within the app.

The uploaded content is not used for advertising or analytics purposes. Firebase Analytics is currently not actively used by us.

Disclosure to third parties does not take place, except insofar as this is necessary for the technical provision of the app via Firebase and/or Google Cloud, the user shares content within the app with other authorized users, there is a legal obligation, or this is necessary for the enforcement of legal claims.

If users share trips, expenses, or other content with additional participants, the respectively authorized participants may be able to see the associated content. This may also include uploaded images, profile pictures, expense photos, receipts, notes, and associated metadata.

Access protection and security

Access to stored data and uploaded content is restricted by technical and organizational measures. These include, in particular, Firebase Authentication as well as user- and role-based Firebase Security Rules.

Uploaded images and files are not generally publicly accessible. Access takes place only within the framework of the functions and permissions provided in the app.

Storage duration and deletion

Uploaded images, files, and associated metadata are stored as long as they are required for the respective app function or until the user deletes them.

When a profile picture, file, expense, trip, or user account is deleted, the respectively associated data will be deleted, unless statutory retention obligations, legitimate security interests, or technical reasons prevent immediate deletion.

Data processing outside the European Union

The Firebase and Google Cloud storage locations used by us for Firestore and Firebase Storage are located within Europe. Nevertheless, it cannot be completely excluded that Google or subcontractors process personal data outside the European Union and/or the European Economic Area in the context of the operation, maintenance, support, or security of the services.

Where personal data is transferred to third countries, this is done on the basis of appropriate safeguards within the meaning of the GDPR, in particular the data protection terms provided by Google, standard contractual clauses, or other permissible transfer mechanisms.

Further information on data processing by Firebase and Google can be found in the Firebase privacy information, the Firebase Data Processing and Security Terms, and Google’s Privacy Policy.