Privacy Policy

01The short version

EXPENDR stores the expenses and budgets you choose to enter so your family can track spending together. We don't sell your data and we never connect to your bank. If you use the optional auto-detect feature in EXPENDR Plus, your bank alerts are read on your device only — the raw text never leaves your phone. The free version shows a small banner ad served by Google AdMob — ads never see the contents of your expenses, and EXPENDR Plus removes them entirely. EXPENDR Plus is an optional one-time purchase: The app store you bought it from — Google Play or Apple — handles the payment (we never see your card or bank details) and we use RevenueCat to confirm and remember that your household has unlocked it. To keep the app stable, we use a crash-reporting service that receives an anonymous technical report when something breaks — never the contents of your expenses. We also count a few anonymous usage events (like "an expense was saved") to understand what to improve — never what you actually entered.

02What we collect

• Account info — your email address and, if you sign in with Google or Apple, your name and profile initial. Used to sign you in and label your household membership. If you use Sign in with Apple and choose Apple's "Hide My Email" option, we only ever receive Apple's private relay address, never your real one.
• Data you enter — expenses (amount, category, optional note, date), budgets, categories, your chosen currency, and the display name you pick for your household (e.g. "Mom").
• Household info — which household you belong to, your role (owner/member), and the household's invite code.
• On your device only — a local cache of your data (so the app works offline), notification preferences, your App Lock PIN if you set one, recent bank alerts captured by auto-detect if you enable it (see the auto-detect section below), and small counters such as how many expenses you've saved (used once to ask for an app rating).
• Crash & diagnostics data — if the app crashes or hits an error, an anonymous technical report is sent to our crash-reporting provider (Sentry): the error and its stack trace, your device model, operating-system version, and the app version. These reports do not include your name, email, or the contents of your expenses, and we have disabled collection of identifiers such as your IP address.
• Usage analytics (anonymous) — to understand whether the app is genuinely useful (for example, whether families keep using it after the first week), we use Google Analytics for Firebase to count a few basic events: that the app was opened, that an expense was saved, that someone joined a household, and — in the free version only — that a banner ad was shown, along with the small estimated amount it earned — together with your household role (owner or member), device model, and app version. These are anonymous counts tied to a random app-instance identifier: they never include your name, email, amounts, notes, categories, or any text you enter.
• Advertising data (free version) — to show and measure banner ads, Google AdMob may collect your device's advertising ID, IP address, and general ad-interaction data (e.g. that an ad was viewed or tapped). This never includes your expenses, budgets, or household data — the ad system has no access to what you enter in the app. On iPhone, Apple requires your permission before any app may use the device's advertising identifier for tracking: EXPENDR shows Apple's standard "Allow to track?" prompt, and if you decline, no advertising identifier is used and ads are shown without it.
• Purchase data (EXPENDR Plus) — if you buy the one-time EXPENDR Plus unlock, your app store (Google Play on Android, the App Store on iPhone) processes the payment and our purchases provider RevenueCat records that the purchase happened: your app user ID, which product was bought, the purchase date, and the store country RevenueCat infers from your IP address. We use this only to unlock Plus for your household and to restore it on your other devices. We never receive or store your card, bank, or full payment details.

We do not collect your contacts, precise location, files, or bank/payment information. (Ads may infer your approximate, city-level location from your IP address — see the Advertising section below.)

03Where it's stored

Your data is stored in Google Firebase (Authentication and Cloud Firestore), a service operated by Google LLC. Data is protected by Firebase security rules so that only signed-in members of your household can read or write your household's data. Google's own privacy practices are described at firebase.google.com/support/privacy.

Anonymous crash and error reports are processed by Sentry (Functional Software, Inc.) on servers in the European Union, solely so we can find and fix bugs. Sentry's privacy practices are described at sentry.io/privacy.

If you buy EXPENDR Plus, purchase records are processed by RevenueCat, Inc. to validate the purchase and manage your household's unlock. RevenueCat's privacy practices are described at revenuecat.com/privacy. The payment itself is handled by Google Play (Android) or the App Store (iPhone) under that store's own terms — EXPENDR never receives your card or bank details.

04Who can see your data

• Your household — members you invite can see the household's expenses, budgets, and who added each expense. Share your invite code only with people you trust.
• Service providers — Google Firebase stores and processes your data to provide the service, Sentry processes anonymous crash reports so we can fix bugs, Google Analytics for Firebase counts the anonymous usage events described above, Google AdMob serves banner ads in the free version, and — if you buy EXPENDR Plus — RevenueCat and your app store (Google Play or Apple) process your purchase to validate it and unlock Plus for your household. Firebase and Sentry do not use your data for advertising, and AdMob receives only the advertising data described above — never your expenses or household data.
• Checking the app is genuine — to stop tampered copies of EXPENDR reaching your household's data, the app asks Google (Play Integrity on Android) or Apple (App Attest on iPhone) to confirm it is an unmodified install. This produces a device-level security token only. It carries no personal data and none of what you enter in the app.
• No one else. We do not sell, rent, or share your personal data with data brokers. We would disclose data only if legally required.

05Advertising & your choices

The free version of EXPENDR shows one small banner ad, served by Google AdMob (Google LLC). We restrict ads to family-safe content ratings and block sensitive categories such as gambling and payday loans. Google's advertising privacy practices are described at policies.google.com/technologies/ads.

If you are in a region that requires consent (e.g. the EEA or UK), the app asks for your choice before any ad is shown, and you can change it at any time in the app: tap your avatar → Ad privacy options.

On iPhone, EXPENDR also shows Apple's App Tracking Transparency prompt before ads start. Declining is a normal choice and costs you nothing — ads still appear, they are simply not personalised. You can change your answer at any time in Settings → Privacy & Security → Tracking. On Android, you can reset or delete your advertising ID in your device settings.

EXPENDR Plus removes ads completely.

06Expense auto-detect (EXPENDR Plus)

EXPENDR Plus includes an optional auto-detect feature that can turn bank alerts into suggested expenses, so you don't have to type them in. It works differently on Android and iPhone, and it is off by default on both.

On Android

• Off by default. It works only if you switch it on and grant Android's "notification access" permission, and it reads notifications only from the apps you choose to watch.
• Everything happens on your device. The raw text of your notifications is never uploaded to our servers, never shared with anyone, and is excluded from Google's cloud backup. Card and account numbers are masked on your device before the text is even analysed.
• You can stop any time — turn it off in the app or revoke notification access in Android settings.

On iPhone

EXPENDR cannot read your messages on iPhone, and never asks for permission to. Instead, you choose to set up an automation in Apple's own Shortcuts app, which you control and can change or delete at any time.

• You create it, and it runs inside Apple's app. The automation checks new messages on your device and hands EXPENDR only those that look like a bank alert — text containing a spending word and an amount. Everything else is discarded inside Shortcuts and is never passed to us.
• EXPENDR never sees the rest. We receive only what your automation forwards. There is no access to your Messages app, your contacts, or any message that doesn't match.
• Everything happens on your device. Forwarded text is stored only on your iPhone so you can review it, is never uploaded to our servers and never shared with anyone. Card and account numbers are masked on your device before the text is analysed.
• You can stop any time — delete the automation or the shortcut in Apple's Shortcuts app, and nothing further is ever sent. Turning off EXPENDR Plus also clears anything already waiting.

On both

• Nothing is added automatically. Detected expenses wait in a review list inside the app. Only when you tap Add is a normal expense (amount, category, optional note, date) saved to your household — exactly as if you had typed it yourself. Items you ignore are discarded.
• A suggestion is only a suggestion. Anyone can send a message that looks like a bank alert, so treat the review list as a prompt to check, never as proof a payment happened.

07Notifications, App Lock & permissions

With your permission, EXPENDR sends local reminders (e.g. a daily "log your spending" nudge, budget alerts, and a weekly recap). These are generated on your device — they are not sent from our servers and their contents never leave your phone. You can turn notifications off in your system settings at any time.

If you turn on App Lock, EXPENDR asks you to unlock it before showing your data. It uses a PIN that you choose, and you can optionally add your device's own biometric unlock — Face ID or Touch ID on iPhone, fingerprint or face unlock on Android. Your PIN is stored only on your device and is never uploaded. The biometric check happens entirely inside your operating system: EXPENDR is told only whether it succeeded, and never receives your face, fingerprint, or any biometric data.

The Android app also uses the network-state permission (to show when you're offline) and vibration (for haptic feedback). EXPENDR does not ask for your contacts, camera, microphone, precise location, or access to your photos on either platform.

08Deleting your data

Open the app → tap your avatar → Delete Account. This permanently deletes your sign-in account, your household pointer, and — if you are the last member of a household — the household and all of its expenses. Deletion is immediate and irreversible. If you signed in with Apple, EXPENDR also tells Apple to revoke the sign-in token, so the app's link to your Apple account is removed at Apple's end too. You can also email us (below) and we'll delete your account for you.

09How long we keep your data

• Your expenses, budgets and household — kept until you delete them, or until you delete your account. We do not automatically delete inactive accounts; nothing disappears unless you ask for it.
• Bank alerts captured by auto-detect — kept on your device only, in a review list capped at the most recent items, until you add or ignore them. Turning off EXPENDR Plus or auto-detect clears anything still waiting.
• Crash reports and anonymous usage counts — deleted automatically at the end of our providers' standard retention windows. They contain no expense contents and are not linked to your name or email.
• Purchase records — kept for as long as your household's EXPENDR Plus unlock exists, so it can be restored on your other devices, and for the period the app stores require for refunds, tax and accounting.

10How we protect your data

We follow reasonable security practices proportionate to the data we hold: traffic between the app and our servers is encrypted in transit (TLS) and encrypted at rest by Google Firebase; access to your household's data is enforced server-side by Firebase security rules, so one household can never read another's; the app verifies it is a genuine, unmodified install (Play Integrity on Android, App Attest on iPhone) before reaching your data; and you can add an App Lock PIN with optional biometric unlock on your own device.

We deliberately do not collect the categories of data that would carry the most risk: we never connect to your bank, and we never receive or store card numbers, bank account details, passwords to any other service, government identifiers, health data, precise location, contacts or biometrics. Card and account numbers that appear inside a bank alert are masked on your device before the text is analysed.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affecting your personal data occurs, we will notify affected users and the relevant authority where the law requires it.

11Your rights, and the law that applies

Wherever you live, you can: ask what data we hold about you, ask us to correct it, delete your account and its data yourself from inside the app (Section 08), withdraw a permission you previously gave (notification access, tracking, notifications) in your device settings, and ask us for a copy of your household data. Email dev.meusvita@gmail.com and we will respond within 30 days.

EXPENDR is operated from the United Arab Emirates, and this policy is governed by UAE law, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, alongside the rules below for the countries our users are actually in. Your data is stored on Google's infrastructure and may be processed on servers outside your own country; anonymous crash reports are processed in the European Union (Section 03).

If you are in India. The law in force today is Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. We follow the reasonable security practices described in Section 10, we collect personal information only for the purposes described in this policy, and you may withdraw consent at any time by deleting your account — after which we can no longer provide the service. India's Digital Personal Data Protection Act, 2023 and its 2025 Rules are being brought into force in phases: the notice, consent, rights, retention and breach obligations commence on 13 May 2027. We are not claiming compliance with obligations that have not yet commenced; this policy will be updated before that date.

Grievances (India). Under Rule 5(9) of the 2011 Rules, complaints about this policy or how your data is handled can be sent to the EXPENDR grievance officer at dev.meusvita@gmail.com, and will be addressed within one month.

If you are in the EEA or the UK, you additionally have the rights of access, rectification, erasure, restriction, portability and objection, and may complain to your local data-protection authority. We rely on your consent, and on the performance of our agreement with you, as the bases for the processing described here.

12Children

EXPENDR is a family app, but accounts are intended for users aged 13+ (or the digital-consent age in your country). Younger family members should participate only through, and under the supervision of, a parent or guardian's account.

13Changes & contact

If this policy changes materially, we'll update the date above and note it in the app or on this page.

Questions or requests: dev.meusvita@gmail.com