Privacy Policy

Spendle ("we", "us") is a personal finance and expense-tracking app. This policy explains what data we collect when you use Spendle on the web or on Android, why we collect it, who we share it with, and the choices you have. Spendle does not connect to your bank accounts, move money on your behalf, or trade investments - everything you track is entered by you.

Account information. Name, email address, and a hashed password if you sign up with email, or your name, email, and profile photo if you sign in with Google. We never see or store your Google password.

Financial data you enter. Transactions, categories, budgets, bills, recurring transactions, credit card details you choose to record (name, issuer, last 4 digits, limits - never full card numbers), assets, liabilities, savings goals, and optional settings like your currency, country, and tax filing status (used only to estimate taxes; this is not tax advice and nothing is filed with any tax authority on your behalf).

Security credentials. If you enable a PIN, biometric app lock, or two-factor authentication, we store a hashed PIN, a WebAuthn public key (your fingerprint/face data itself never leaves your device), and a TOTP secret plus hashed one-time backup codes.

Device & usage data. Push notification tokens (if you enable notifications), and, for the app's optional AI features, aggregated usage metadata (which feature was used, token counts, cost) - not the content of what you asked.

Payment data. If you subscribe to a paid plan, payment is processed entirely by Stripe. We never receive or store your full card number - only a subscription status and a Stripe customer reference.

To provide the app's core features (tracking, budgeting, bill reminders, reports), to secure your account, to send transactional and reminder notifications you've opted into, to process subscription payments, and - only when you use the AI Chat/Insights features - to generate a summary of your own financial data so an AI model can answer your question. We do not use your financial data to train any AI model, and we do not sell your data to anyone.

We share the minimum data needed with the following processors:

• Stripe - subscription payment processing.
• Google - optional sign-in (OAuth).
• Resend - transactional emails (e.g. spending digests you've opted into).
• OpenRouter, Groq, and Google Gemini - power the optional AI Chat/Insights features. When you use these features, a summary of your financial data (or your question) is sent to whichever provider is currently serving the request, solely to generate a response.
• Push notification delivery (Web Push / Firebase Cloud Messaging) - only if you enable notifications.
• Exchange-rate and logo-lookup APIs - receive only a currency code or a bank/company domain name, never your personal data.

None of these partners are permitted to use your data for their own advertising.

Data is encrypted in transit (HTTPS/TLS). Passwords and PIN codes are hashed, never stored in plain text. Biometric authentication is verified entirely on your device; we never receive your fingerprint or face data. You can add two-factor authentication for additional protection.

From Settings, you can export a full copy of your data as JSON at any time, or export your transactions as CSV. To delete your account and associated data, submit a request at /delete-account (no login required) - we'll confirm and permanently delete your data within 30 days, except where we're required to retain limited records (e.g. payment records) for legal or tax purposes.

Spendle is not directed at children and we don't knowingly collect data from anyone under 13 (or the minimum age required in your country).

If we make material changes to this policy, we'll update the date above and, where required, notify you in the app.

Questions about this policy or your data? Email support@nexusforgetech.com.