This Privacy Policy explains how Spendy ("we," "us," or "our") collects, uses, and protects information when you use the Spendy mobile application and related services (the "Service"). By using the Service, you agree to the practices described here.
1. Information We Collect
Information you enter into the app
This may include your first name, your answers during onboarding (for example, what brings you to Spendy, who is in your household, the types of debt you have, how you get around, your subscriptions and your savings goals), the categories and amounts in your budget, savings goals and challenges, transaction notes and category choices, and the commitment contract you sign within the app.
Account information
We use Supabase to manage your account, including your account email and user ID.
Bank connections
If you choose to connect a supported bank in the United States or Canada, Plaid lets Spendy read your accounts, balances and transactions to track spending and identify recurring subscriptions, bills and income. Spendy never sees or stores your bank login credentials. We send Plaid your user ID to associate the connection with your account; we do not send Plaid your email address or phone number. Plaid processes information under its End User Privacy Policy.
Settings and preferences
We store the preferences you set, such as your chosen currency, number format, language, app colour, the day your financial month starts, and any profiles you create.
Device and diagnostic information
We may receive limited technical information such as device type, operating system version, app version, and anonymised crash or performance diagnostics (for example, through Apple's built-in crash reporting, subject to your device settings) to keep the Service reliable.
Purchases
If you subscribe to Spendy Premium, the purchase is processed by the Apple App Store. We do not collect or store your payment card details. We receive subscription state through Apple App Store Server Notifications and subscription verification in the app, linked to your user ID, so we can unlock premium features, check eligibility for bank sync and support "Restore purchases."
2. What We Do Not Collect
- We do not receive or store your bank login credentials.
- We do not collect your precise location.
- We do not sell or rent your personal information to anyone.
3. Where Your Data Is Stored
Your budget, transactions, goals and settings are stored on your device. Bank account, balance and transaction data passes through Spendy's servers only in transit to provide bank sync; we do not store accounts, balances or transactions in our server database.
Supabase, hosted on Amazon Web Services (AWS) in the United States, holds your account email, user ID, encrypted Plaid access tokens, bank connection status, a copy of sync progress and subscription status. Plaid access tokens are encrypted at rest and allow the Service to maintain the bank connections you authorise.
If you have enabled device backups or iCloud on your iPhone, your Spendy data may be included in those backups under Apple's terms and privacy policy, which are outside of our control. Deleting the app removes its local data but does not delete your account or disconnect your banks.
4. How We Use Information
- To provide the core features of the Service: building your plan, funding your budget categories, syncing bank accounts and transactions, identifying recurring subscriptions, bills and income, showing statistics and the calendar, and tracking savings goals and challenges;
- To personalise the app (for example, greeting you by the name you provide and applying your chosen currency and colour);
- To deliver reminders and notifications you have opted into;
- To operate, maintain, and improve the Service and fix problems;
- To confirm your subscription status and unlock premium features;
- To respond to your support requests;
- To comply with legal obligations.
5. Notifications
Spendy can send you reminders (for example, about upcoming recurring charges or to check in on your goals). Notifications are optional and controlled by the permission you grant in iOS. You can turn them off at any time in your device's Settings.
6. Third-Party Services
We rely on Apple for app distribution, in-app purchases, subscription management (including App Store Server Notifications), and device-level crash reporting; Supabase for account authentication and the server records described above; and Plaid for bank connections and financial data access.
Resend delivers account emails, such as sign-in and account verification messages, and processes the recipient email address and message content for delivery.
Superwall helps present subscription offers and processes purchase and funnel events. Bank-connection analytics are limited to whether a connection was started, succeeded or failed. Superwall receives no financial data, institution names or amounts.
These providers process information to deliver the Service and are expected to protect it in line with their own privacy policies and applicable law. We do not share your financial information with advertisers or data brokers.
7. Data Retention & Deletion
You can disconnect a bank in Settings → Banks in the app. Disconnecting removes the Plaid connection and its stored access token; you can choose to keep its transactions on your device as read-only records or delete them.
Bank sync stops immediately when your subscription lapses. After 30 days of a lapsed subscription, a daily cleanup disconnects your banks and removes their stored access tokens. Data already on your phone stays until you remove it.
To delete your account, use Settings → Account → Delete account in the app. Account deletion removes your Plaid connections and the account records and access tokens held in Supabase. Deleting the app alone does not do this, and neither action cancels an App Store subscription; manage that in your App Store settings.
You can manage your budgets, categories, goals and profiles in the app, and change categories, add notes or hide bank transactions. Deleting the app removes its local data. Other information held by us or our providers, such as support correspondence, is retained only as long as needed for the purposes described above or as required by law. For deletion requests about that information, contact us below.
8. Data Sharing
We do not sell your personal information. We share information only with the service providers described above, when required by law or valid legal process, to protect our rights and the safety of users, or in connection with a business transfer (such as a merger or acquisition), subject to appropriate safeguards.
9. Children's Privacy
The Service is not directed to children under 13 (or the minimum age of digital consent in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will take appropriate steps to delete it.
10. Your Rights
Depending on where you live, you may have rights to access, correct, delete, or restrict the processing of your personal information, and to object to certain processing or request portability. You can manage device data and disconnect banks or delete your account in the app as described above. Canadian users can request access to their personal information, request corrections, or raise questions about our handling of it under applicable Canadian privacy law, including PIPEDA, by contacting [email protected]. Users in the United States and elsewhere can also contact us there to exercise applicable rights. We will respond as required by applicable law.
11. Security
We use reasonable technical and organisational measures to protect information against unauthorised access, loss, or misuse, and we rely on the security protections built into iOS for data stored on your device. We recommend protecting your device with a passcode or Face ID. No method of storage is completely secure, and we cannot guarantee absolute security.
12. International Users
Bank connections are available for supported institutions in the United States and Canada. Our Supabase projects are hosted in the United States, so Canadian users' account and connection information is processed there. Our other service providers may also process information outside your country, where data protection laws may differ. Where required, we take steps to ensure appropriate safeguards are in place for such transfers.
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide notice within the Service. Your continued use after changes take effect constitutes acceptance of the updated policy.
14. Contact
Questions or requests about this Privacy Policy? Contact us at [email protected].