Privacy Policy

Last updated: 1 August 2026

This Privacy Policy explains what data Spendly ("the app", "we", "us") handles, where it is stored, and the choices you have. The app is designed to be local-first: your financial data lives on your device and is only sent to the cloud when you opt in by signing in and using sync features.

Using the app without an account

You can use the core app as a guest, without creating an account. In guest mode your expenses, accounts, categories and settings are stored only on your device (in an encrypted-at-rest local database provided by your operating system). We do not receive this data, and it is not backed up to our servers. Clearing the app's local data or uninstalling the app permanently deletes it.

Data stored on your device

Regardless of account status, the following is stored locally on your device:

• Transactions you record (amount, category, note, date, payment details you enter)
• Personal and shared accounts you create
• Custom categories, currency and language preferences
• App settings such as theme and onboarding state

Data we process when you sign in

If you create an account or sign in (including Sign in with Apple), we process the following through our authentication and database provider, Supabase:

• Your email address and display name
• An account identifier used to associate your data with you
• For premium (sync) users: your transactions, accounts, groups, group memberships and expense splits, so they can sync across your devices and to people you share groups with

We only upload your financial records to the cloud when you are a premium subscriber and sync is active. Free and guest users' financial records remain on-device.

Shared groups

If you create or join a shared group, the members of that group can see the expenses, splits and balances within that group, along with your display name. Do not add people to a group unless you intend to share that information with them.

Subscriptions and payments

Premium subscriptions are processed by the app stores (Apple App Store / Google Play) and managed through RevenueCat. We do not receive or store your full payment card details. We receive subscription status information (for example, whether your subscription is active, trial, or cancelled, and its renewal date) to unlock premium features.

Notifications

If you enable notifications while signed in, we use Firebase Cloud Messaging to deliver push notifications (for example, group activity). This involves storing a device push token linked to your account. You can disable notifications at any time in Settings or your device settings.

Crash and diagnostics data

To keep the app stable and fix problems, we use Firebase Crashlytics (Google) to collect crash reports and error diagnostics when the app misbehaves. When a crash or handled error occurs, this may include:

• The error type, message and stack trace
• Device information such as model, operating system version and available memory
• The app version and, where set, whether the device is rooted or jailbroken
• A randomly generated installation identifier that is not linked to your name or email

This data is used only to diagnose and fix stability issues. It is not used for advertising or profiling. We aim to avoid including your financial records in error reports, but you should not rely on error diagnostics being free of the values you entered. Crash reports are retained by the provider for a limited period (currently around 90 days). Diagnostics are not collected in development builds.

AI-assisted features

• On-device parsing: Voice command entry uses an AI model that runs entirely on your device. The audio-derived text is processed locally and is not sent to us.
• Cloud parsing: Some features, such as receipt scanning and transaction message parsing, send the specific text or image you provide to a secure server-side function which forwards it to a third-party AI provider (Google Gemini) solely to extract structured expense data. This content is used only to fulfil your request and is not used to build a profile of you.

Third-party services

The app relies on the following processors, each under their own privacy terms:

• Supabase — authentication, database and realtime sync
• RevenueCat and the Apple App Store / Google Play — subscription management
• Firebase Cloud Messaging (Google) — push notifications
• Firebase Crashlytics (Google) — crash reporting and error diagnostics
• Google Gemini — cloud AI parsing of content you submit
• Apple — Sign in with Apple

Data retention and deletion

• Guest data: deleted when you clear local data or uninstall the app.
• Account data: you can permanently delete your account and its synced data from Settings. Deleting your account removes your profile and associated records from our database. Backups held by our processors may persist for a limited period before being overwritten.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to withdraw consent. You can exercise most of these directly in the app (export, delete account) or by contacting us at spendly@ashmmapp.com.

Children

The app is not directed to children under the age required by your local law to consent to data processing, and we do not knowingly collect their data.

Changes to this policy

We may update this policy. Material changes will be reflected by an updated effective date and, where appropriate, an in-app notice.

Contact

For any privacy question or request, contact us at spendly@ashmmapp.com.