Privacy Policy
BroPayy · Last updated: 6 October 2026
BroPayy is a free app for splitting shared costs with friends, made and run by Aakash Kotian in India (“we”). This policy covers the websites bropayy.app and bropayy.com (our early access sign-up page, bropayy.com/early-access) and the BroPayy apps for iPhone and Android. The short version: we collect only what’s needed to run your groups, people in a group see what’s in that group, we don’t show ads or sell your data, usage data is shared only if you say yes, and you can delete your account in the app any time. BroPayy never moves money: payments happen in your own UPI app.
What we get when you sign in
With Google, we get your name, email address, profile photo and Google account ID. With Apple (iPhone only), we get your email address and Apple account ID; if you choose Hide My Email, Apple gives us a private relay address instead. If Apple shares your name, we only use it to suggest your display name. We never see your Google or Apple password. On iPhone, Google sign-in runs through Google’s own sign-in tool, which may also collect some device and usage details and your rough location (from your IP address) for Google’s own security and analytics, under Google’s privacy policy. BroPayy doesn’t receive these.
What you add
Your profile: a display name, a username (we make one from your name, and you can change it) and, if you add them, a UPI ID, a photo, your gender and your birthday. Your groups: the name, dates, photo and who’s in it. Everything you and your friends add: expenses and amounts, who paid and who’s in each split, categories, item lists and bill photos, “Looks right” checks and notes, payments marked sent or received, “I’m done” votes, reminders and in-app notifications. If you add a friend as a guest, we store the name you type. If you joined through a friend’s link, we note who invited you.
Reports, feedback and logs
When you use Report a problem, we keep your message, the topic you picked and your account, plus your browser and the page you were on (website and Android) or your device type, iOS version and BroPayy version (iPhone). When you delete your account, you can tell us why; that answer isn’t linked to you. If you email us, we keep the email so we can help. When you use BroPayy, our providers’ servers also record technical details, such as your IP address, device or browser type and when you signed in. These are kept for a short time to keep BroPayy secure.
Early access sign-ups
If you sign up for early access at bropayy.com/early-access, we keep your name, email address (a Gmail address if you use Android), WhatsApp number, whether you use Android or iPhone, what you’d use BroPayy for, and when you agreed to hear from us. We use them only to give you early access and to contact you about it and about BroPayy’s launch, by email or on WhatsApp (run by Meta, under its own privacy policy). On Android, you join our early access group on Google Groups yourself, with your own Google account. If we give you early access through Google Play or Apple’s TestFlight, we give Google or Apple your email address for that. To stop spam, the sign-up page notes a scrambled code made from your IP address, which we delete after a day. Your sign-up is stored with Supabase in Mumbai, India, and nobody else can see it. We delete it 12 months after you sign up, or sooner if you ask: write to the Grievance Officer below. Your sign-up isn’t linked to a BroPayy account.
How we use it
Only to run BroPayy: to sign you in, show your groups to the people in them, work out balances and the fewest payments to settle up, send notifications and payment reminders, and help when you report a problem. From how quickly you pay people back, the app shows your group a payer vibe badge, like “Lightning payer”. We use your gender only to word some messages for you, and your birthday only to understand which age groups use BroPayy and to check you’re old enough to use it. If a friend invited you, it unlocks extras for them in the app. We use technical details to keep BroPayy secure and stop misuse. If you say yes to sharing usage data, we use it to see which features help and what to fix. We don’t show ads, we don’t sell your data, and we don’t track you across other apps or websites. BroPayy has no ad tools, and uses analytics only if you say yes.
Who can see what
People in your groups see your display name, username, photo, UPI ID and payer vibe, plus everything in the groups you share: expenses, notes, payments and photos. Any member can download a group’s expenses as a file or share a summary. People you invite to a group, or who invite you, see your display name, username and photo, but not your UPI ID unless you end up in a group together. Anyone signed in who types your exact username sees your display name, so they can add you. Anyone with a group’s invite link sees the group’s name, photo and member count and who shared it, and can join the group straight away and then see everything members see, so share it only with the group. An admin can reset the link any time. Other people on BroPayy never see your email, gender or birthday. If friends join through your link, the app shows you how many joined, not who.
Services we use
Supabase stores our database, sign-ins and photos, and Vercel runs our website and server code. Google and Apple handle sign-in, and Apple delivers iPhone notifications. If you say yes to sharing usage data, PostHog, an analytics service, receives the usage events described below. We share with each only what it needs to do its job for BroPayy. Group names, expenses and your details are never sent to AI services.
Usage data (analytics)
Only if you say yes. BroPayy asks you once, on Home. Nothing is sent until you say yes yourself, even from the screens before you sign in: what you do there waits for a short while in that browser tab or in the app, goes only if you then say yes, and is dropped if you say no or don’t answer. If you agree, we send PostHog usage events: which screens and features you use, like adding an expense or opening Settle up, whether you’re on the website, Android or iPhone, and your BroPayy version. No other details about your phone, computer or browser are sent. Events carry your BroPayy account ID, a random code, and never your name, email, username, photo, gender, birthday, UPI ID, group names, amounts, notes or messages. Web addresses are cleaned first, so invite links and codes are never sent. PostHog keeps the events on its EU servers in Frankfurt, Germany. Your IP address isn’t saved with them or used to find your location, and we don’t record your screen. Events are kept for up to 12 months; write to us and we’ll delete yours sooner. To stop, turn off Share usage data under You: nothing more is counted, and BroPayy forgets PostHog’s random ID on that device.
GIFs and UPI apps
In the meme pack (website and Android), our server sends your search words to GIPHY, and your device loads the GIFs straight from GIPHY, so GIPHY sees your IP address and browser type, but not your name or email. Photos you put in story templates never leave your phone. When you tap Pay, BroPayy opens your UPI app with the person’s UPI ID and name and, where supported, the amount and a short note. The payment then happens in that app, under its own privacy policy.
Google user data
We use what Google shares with us (your name, email address, profile photo and account ID) only to sign you in, set up your profile and show your name and photo to your groups. It’s stored with your account and erased when you delete it. We don’t use it for ads, we don’t sell it, and no one at BroPayy looks at it unless you ask us for help, it’s needed for security, or the law requires it. BroPayy’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
iPhone notifications
If you turn on notifications in the iPhone app, your phone gives BroPayy a push token: a code Apple uses to deliver notifications to that phone. We keep it with your account only while notifications are on and you’re signed in, and delete it when you turn them off, sign out or delete your account. A notification shows the group’s name, who did what, the expense name and amounts, and travels through Apple’s push service to your phone. To hide these on your lock screen, change Show Previews in your iPhone’s Settings.
Cookies
The website and Android app use only essential cookies: one keeps you signed in, a few short-lived ones finish signing in and bring you back to the right page, one remembers whose invite link brought you (for 30 days), and one carries a note like “group created” to the next page you open (for up to 5 minutes). That note holds nothing personal and is counted only if you said yes to sharing usage data. PostHog doesn’t use cookies: if you say yes, it saves a random ID in your browser’s storage so it can tell your visits apart, and turning sharing off erases it. There are no ad or tracking cookies.
Saved on your device
So BroPayy works offline, it keeps some things on your device: expenses you add without signal (until they’re sent), copies of your recent groups and, on the website and Android, your last UPI app, split choice and a payment you just started (for up to 2 hours). The iPhone app keeps your sign-in in the iPhone’s Keychain. On iPhone, signing out or deleting your account clears these copies. On the website and Android, signing out clears saved pages; to remove the rest, clear BroPayy’s site data in your browser or the app’s storage on Android. Before you answer the usage data question, a few usage events wait in that browser tab or in the app. If you say yes, PostHog also keeps its random ID there, plus any events not sent yet; turning sharing off, signing out or deleting your account erases them.
Where we keep it, and for how long
Your data is stored on servers in Mumbai, India (Supabase, on Amazon Web Services), and our server code runs mainly in Mumbai too. Supabase and Vercel are US companies and may handle data outside India for support and security. PostHog keeps usage events (only if you said yes) on its EU servers in Frankfurt, Germany, for up to 12 months. Google, Apple, GIPHY and PostHog are outside India. We keep your account for as long as you have it. Groups stay, even when archived, until they’re deleted or everyone with an account in them has left BroPayy. When someone deletes an expense, the app hides it but keeps it in the group’s records. Reports you send are kept until you delete your account. If the law requires us to keep something for longer, we keep only that, and only for as long as required. Copies may stay in our providers’ backups for a short time.
Keeping it safe
Everything travels over encrypted connections (HTTPS). Our database checks every request, so people only see groups they’re in or have been invited to. Bill photos are locked to your group and open through links that expire after an hour. Profile and group photos are saved at hard-to-guess web addresses, but anyone with the exact link can open them. Photos are re-saved before upload, which removes location details. We don’t store passwords, because Google and Apple handle sign-in. No system is perfectly safe; if a breach affects your data, we’ll tell you and the authorities, as the law requires.
Deleting your account
You can delete your account any time in the app: go to You and tap Delete account at the bottom. This erases your sign-in account and email, profile, username, UPI ID, uploaded profile photo, gender, birthday, settings, your notifications, invites and the reports you sent, and signs you out. Usage events you shared stay with PostHog under your old account ID, a random code that no longer leads back to you, and are deleted within 12 months; to have them deleted sooner, write to us before you delete your account. Groups where no one else has an account (just you, or you and guests you added) are deleted. You can also remove BroPayy from your Google account’s security settings, or stop using Sign in with Apple in your Apple Account settings. Can’t get into the app? Email us from the address you signed in with and we’ll delete your account for you.
What stays in shared groups
So your friends’ balances don’t change, what you paid, owe and settled stays in the groups you shared with them. You show there as a guest with your name, notes you left stay, and expenses you added show as added by another member. Payments friends marked as sent to you that you hadn’t confirmed yet count as received. Bill photos of deleted expenses, and photos of groups removed because everyone with an account in them deleted their account, stay in storage; write to us and we’ll remove them. Friends’ notifications may still mention your name.
Your choices and rights
You can see and change your details any time under You. Remove your UPI ID, photo or birthday, or set gender to “Prefer not to say”, whenever you like; that withdraws your consent for them. Turn Share usage data on or off under You any time. To fix an expense, edit it in the group. You can also ask us for a summary of the data we hold about you and who we share it with, ask us to correct or erase it, or name someone to act for you if you die or can’t act yourself. Write to the Grievance Officer below.
Age
BroPayy is for people 13 and older. If you’re under 18, use it only with a parent’s or guardian’s permission. If you think a child under 13 has an account, write to us and we’ll delete it.
Changes to this policy
When we change this policy, we’ll update the date at the top. For important changes, we’ll let you know by email or in the app before they apply.
Questions and complaints
Our Grievance Officer is Aakash Kotian. Email hello@aakashkotian.com about any question, request or complaint about your data or about something in BroPayy. We’ll confirm we got it within 24 hours and give you an answer within 15 days. If you’re not happy with our answer, you can complain to the Data Protection Board of India.
Questions? Write to hello@aakashkotian.com.