Privacy

On your device

What you record - amounts, descriptions, categories, dates, how something was paid, opening money, budgets, repeating payments and your own categories - is stored on the device first, along with your settings. In the web app that is the browser’s storage for this site; in the Android app it is the app’s private storage.

Signing out does not delete it: the app keeps working without an account. To remove it, clear this site’s data in your browser, or uninstall the Android app. Deleting your account, below, clears it as well.

If you sign in

Signing in is optional. When you do:

• Your email address identifies your account and is where a 6-digit sign-in code is sent. There is no password.
• Your entries and settings above are copied to Spendo’s database, so the same ledger appears on every device you sign in on.
• One cookie keeps you signed in. Scripts on the page cannot read it; it ends after 30 days of not being used, and never lasts more than 6 months.

Sign-in codes are deleted a day after they expire, and ended sessions a month after they end.

Who else handles it

• Render runs Spendo’s server, and Cloudflare sits in front of it. Like any web server, they see your IP address and which pages and requests your device makes.
• Neon hosts the database that holds signed-in accounts and their entries.
• Brevo sends the sign-in email, so it receives your email address and the code.
• Groq runs the AI features, in the web app and the Android app alike, if you use them: guessing a category sends the description you typed; a month’s write-up and spending suggestions send totals and category shares, never a description, a date or a single transaction; adding several at once sends the sentence you spoke or typed, with today’s date so that “yesterday” lands on the right day; and with AI on, tapping the microphone records what you say and sends the recording, through Spendo’s server, to Groq’s Whisper to be turned into words. Spendo’s server does not keep it. One switch in Settings turns all of it off, and then nothing is sent; each app has its own switch.
• Google may receive the audio when you tap the microphone with AI switched off. In the web app, Chrome’s own speech recognition does the listening and sends the audio to Google. In the Android app, the words are worked out on the phone itself where it can do that for English (India), and the audio stays on the phone; where it cannot, the phone’s speech service, which is Google’s, does it and may send the audio away. The app says which, every time, before you speak. It never listens on its own, and typing does the same job without it.

Removing your account

Signed in, open Settings, choose Delete account and type your email address to confirm. This works the same in the web app and the Android app.

• Your account and everything in it - entries, months and opening money, budgets, repeating payments, your own categories, and every signed-in session - are deleted from Spendo’s database at once. It cannot be undone.
• The device you do it on is cleared too. Other devices you were signed in on are signed out the next time they sync; what they already show stays on them until you clear it there.
• An encrypted copy of the whole database is made every night and kept for 30 days, so your data is in those copies for up to 30 days after you delete it, and then it is gone.

If you can no longer sign in, write to the address below from the email address you signed in with, and the account will be deleted for you.

Contact: address to be added

Everything else

Spendo is a personal project, not meant for children under 13. If this policy changes, the date at the top changes with it.