Privacy Policy

We collect only what the features you use need.

Phone number

Your number, whether it is verified, and when you last logged in. The one-time password (OTP) is sent and checked by Google Firebase Authentication; we do not store OTP codes.
To create and secure your account

Profile

Full name and date of birth (required). Email, avatar, monthly income band, occupation type and preferred currency (optional, only if you fill them in).
To set up your account and personalise the app

Budgets and categories

Monthly budgets, categories and limits you create, and the automatic "Not allocated" amount (your total budget minus your category limits).
To track spending against your budget

Expenses

Description or merchant, amount, category, date, how you paid, split details (number of people and your share), and the "Was it needed?" tag (required, optional or impulsive).
To show your spending and calculate your Smart Spending Score

Bills and subscriptions

Name, amount, category, how often it repeats, next due date and whether you want reminders.
To list what is coming up and send reminders

Detected bank payments

Only if you turn on Bank SMS tracking. See section 2.
To find payments for your review

Merchant and category history

A simplified merchant name stored with each expense and the category you chose for it.
To suggest a category the next time you pay the same merchant

Push token and settings

Your device's push token and which alerts you turned on.
To send reminders and alerts you chose

Session data

A hashed session (refresh) token and your device's User-Agent. If we see a reused session token we may end your other sessions.
To keep you logged in securely

Acceptance records

Which version of the Terms and Privacy Policy you accepted, and when.
To show what you agreed to

Usage analytics

Events such as app opened, expense logged (category, spend tag, payment mode, whether it had a merchant and whether it was split), dashboard and insights viewed, tied to an internal user ID (not your phone number). Amounts, merchant names and your phone number are not included. Collected with Mixpanel.
To understand how the app is used and improve it

Crash reports

Error and crash details collected with Sentry. Amounts, merchant or payee names, phone numbers and tokens are filtered out before they leave your device or our server.
To find and fix bugs

• To run your account: phone login, sessions, and keeping your budgets and expenses in sync.
• To show your spending, apply the budget rules you set, and send the alerts and reminders you turned on (near limit, monthly reset, daily summary, inactivity, bills due, payments waiting for review, weekly comparison).
• To calculate your Smart Spending Score, category breakdowns and insights from your own expenses and spend tags.
• To suggest categories from your own past expenses, and to match detected payments to your bills.
• To prevent abuse of the login flow and protect your account.
• To understand usage and fix crashes.

We do not use your data for advertising, we do not sell it, and every insight and notification uses your own numbers only.

We do not share your personal data with anyone except the service providers below, and only what each needs to do its job. They may not use it for their own purposes.

Google Firebase Authentication

Sends and checks your login OTP. Receives your phone number.

Expo and Google Firebase Cloud Messaging

Delivers push notifications. Receives your push token and the notification text.

Mixpanel

Product analytics. Receives usage events and an internal user ID, as described in section 1.

Sentry

Crash and error monitoring. Receives filtered error details.

Our hosting and database provider

Runs the backend and stores your data. Receives the data described in this policy.

• All traffic between the app and our servers is encrypted (HTTPS).
• Session tokens are stored hashed on our servers, and your login token is kept in the device's secure storage.
• Budget, expense, bill, detected-payment, insight and profile data is kept in the app's memory and is not written to the phone's plain-text cache.
• SMS text and screenshot text are processed on your device and are not uploaded.
• Access to your data requires an authenticated session.

No system is completely secure, so we cannot guarantee absolute security.

• Access and correct: view and edit your profile, budgets, bills and expenses in the app at any time.
• Delete: delete individual expenses, or your whole account (section 5).
• Get a copy: ask us for a copy of your data by email.
• Withdraw consent: turn off Bank SMS tracking, spend nudges and any notification type in Settings, and revoke SMS or Usage access in Android settings. Turning a feature off does not affect what was done before.
• Rights under Indian law: if you are in India, you have the rights given by the Digital Personal Data Protection Act, 2023, including to access, correct and erase your data and to have your complaint heard. Write to us first. We aim to reply within 30 days.

The Terms of Service and this Policy are accepted in the app. When we change them in a way that needs your agreement, the app asks you to accept the new version before you continue.

Spenrol is not directed at children and is not for anyone under 18. If we learn that an account belongs to someone under 18, we will delete it.

We may update this policy as the app changes. We will change the "Last updated" date above and, for material changes, ask you to accept the new version in the app. Earlier versions are kept at dated links on spenrol.com/privacy.