Privacy policy

Last updated: 28 September 2026

Who is responsible

SpendsTracker is made by Daniel Nemchynov, an individual developer in Portugal, who is the controller of your data. Contact: danyknem@gmail.com.

What we store

From your Apple or Google account: name, email and an account identifier. The financial data you enter, import from a statement or that your bank shares when you link it: accounts, balances, transactions, categories, rules, budgets, goals and notes. We don't collect location, contacts, usage statistics or advertising data.

What stays on your phone

Goal photos and your preferences (language, appearance, Face ID and notifications). From a statement you import, the app keeps the transactions, not the file.

What we use it for

Only to show you your finances and sync your data between your devices, that is, to provide the service you ask for. There are no ads, we don't sell data and we don't use it to offer you financial products.

AI suggestions

Only if you agree (at the start or in More → Privacy & data), transactions the app doesn't recognise are sent to OpenAI (USA) to suggest a category. We send only the kind of transaction, the merchant's name and the amount; never your name, email, IBAN, the full description or names of people. The legal basis is your consent, which you can withdraw at any time. Under OpenAI's terms, this data isn't used to train models and is deleted after 30 days at most; the transfer to the USA follows the GDPR safeguards (standard contractual clauses).

Bank linking

When it's available and you choose to link a bank, access is provided by Enable Banking Oy (Finland), an account information service provider authorised by the Finnish Financial Supervisory Authority (FIN-FSA). We never see your bank password and the app can't make payments. You can unlink the bank at any time.

Where it's kept and who processes it

Your data is kept on servers in the European Union (Supabase, Ireland), encrypted in transit and at rest, and only your account can access it. Providers: Supabase (hosting), Apple and Google (sign-in), OpenAI (only with your permission) and Enable Banking (only if you link a bank).

How long

For as long as you have an account. When you delete your account in the app, your data is deleted immediately; it may remain in the hosting backups for a short time, until they're replaced.

Your rights

You can access, correct, export (More → Privacy & data → Export) and delete your data, object to its processing and withdraw your permission for the AI. For other requests, write to the contact above. You can also complain to the Portuguese data protection authority (CNPD, www.cnpd.pt).

Changes

If this policy changes, the date above is updated. Important changes are announced before they apply.