Privacy Policy

1 Who we are

Expense Tracker is developed by an independent developer, contactable at icanbe444@gmail.com. This policy covers the Expense Tracker mobile app on iOS and Android.

2 What we collect

Everything the app stores is either your account credential or data you type in yourself:

• Account: your email address, and a password you set (we never see or store the password itself — it's handled by our authentication provider's own secure sign-in flow).
• Google sign-in (optional): if you choose "Continue with Google", Google shares your email address and basic profile details (such as your name) with us so we can create and identify your account. We do not receive your Google password and we do not access any other Google data.
• Your settings: the currency you choose (£, $ or ₦).
• Financial data you enter: transactions (amount, description, date, category, notes, tags), accounts and their balances, budgets, recurring bills and income, savings goals and contributions, and any CSV bank statement you choose to import.

We don't collect analytics, advertising identifiers, location, camera, contacts or microphone data, and this app carries no third-party advertising or tracking SDKs.

3 How we use it

Solely to run the app for you: to show your balance, categorise and total your spending, calculate budgets, and track goals and recurring items. We do not use your financial data for advertising, and we do not sell it.

4 Where it's stored, and how it's protected

Your data is stored with Supabase, a database and authentication provider, in their UK (London) data region. Supabase acts as our data processor — they host the infrastructure, they don't use your data for their own purposes.

• Connections between the app and the database are encrypted in transit (HTTPS/TLS), and data at rest is encrypted by Supabase's infrastructure.
• On your device, your sign-in session is separately encrypted (AES-256) with the key held in your phone's own secure hardware storage (iOS Keychain or Android Keystore) — not just saved as plain text.
• The database enforces row-level security: every query is scoped to your account at the database layer, so one user's data is never reachable through another user's session, even in the event of an application bug.

5 Sharing

We don't sell your data or share it with advertisers or data brokers. It's shared only with service providers who help us run the app, and only as needed:

• Supabase hosts the database and sign-in.
• Resend delivers the account emails we send you (email confirmation and password reset), so it handles your email address for that purpose only.
• Google handles the sign-in only if you choose "Continue with Google".

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6 Keeping and deleting your data

We keep your data for as long as your account exists. You can permanently delete your account and everything in it at any time, from inside the app: Settings → Delete account. This removes your data immediately and cannot be undone. You can also request deletion by emailing us.

7 Your rights

Under UK GDPR, you can ask us to let you access, correct, delete, or export a copy of your data, or to explain how it's used. Account deletion is self-service in the app; for anything else, email icanbe444@gmail.com and we'll respond within a reasonable time. If you're unsatisfied with our response, you can complain to the UK Information Commissioner's Office (ico.org.uk).

8 Children

Expense Tracker is not directed at, and is not knowingly used by, children under 13. We don't knowingly collect data from children.

9 Changes to this policy

If this policy changes, we'll update the date at the top of this page. Continuing to use the app after a change means you accept the update.