Spentry Privacy Policy

1. Who we are

The data controller is Viacheslav Kuznetsov, the developer of Spentry ("we").

For privacy questions, write to [email protected].

2. The short version

• You sign in with Apple. There are no passwords, and your email can stay hidden.
• Your trips and expenses are stored on our server so they sync and can be shared with the people you invite.
• Receipt reading and voice input send the receipt or the text of what you said to our server, and an AI model from OpenAI reads it. The app asks for your permission first, and you can turn this off in Settings. OpenAI doesn't train its models on this data.
• We don't sell your data, show ads or track you across apps and websites.
• You can delete your account in the app at any time: Settings → Delete Account.

3. What we collect and why

3.1 Your account

• What:
  • the identifier Sign in with Apple gives us;
  • the name and email Apple shares (the email may be a private relay address);
  • a profile photo, if you add one;
  • your sign-in methods.
• Why: to create your account, sign you in and show your name and photo to the people in your trips.
• Sessions: you stay signed in until you sign out, or until the app hasn't connected to our server for 90 days.

3.2 Trips and expenses

• What:
  • trip names, destinations, dates, currencies, covers and members;
  • for each expense: the amount, currency, exchange rate, category, title, note, date, time and time zone;
  • receipt photos you attach;
  • your own categories.
• Why: this is the service itself. It is stored so it syncs between your devices and with the members of shared trips.
• Photos: before a photo is uploaded, the app removes location and other metadata from it.

3.3 Receipt reading and voice input (AI)

When you scan or paste a receipt, share a receipt or a bank's PDF to Spentry, or dictate an expense, we send to our server:

• the receipt photo (for a PDF, its first page and its text), or the text of what you said;
• hints that help read it correctly:
  • the trip's name, destination and currency;
  • your categories and the titles of your recent expenses in this trip;
  • today's date, your time zone and the country it points to;
  • when the photo was taken or added;
  • the cities and shops from your receipts of the last 30 days.

Our server passes this to OpenAI, an AI service provider in the United States. OpenAI reads it and returns the fields of the expense: amount, currency, date, place and category.

• OpenAI doesn't use API data to train its models.
• OpenAI may keep requests for up to 30 days to detect abuse, then deletes them (OpenAI: Your data).
• We ask OpenAI not to store responses (store: false).

Your permission: the first time you scan, paste or share a receipt or dictate an expense, the app asks whether you allow AI reading, and sends nothing until you do. You can turn it off in Settings at any time. Spentry keeps working without it: you type expenses yourself.

Voice: your iPhone turns speech into text. If it can't do that on the device for your language, Apple's speech service does it, under Apple's privacy policy. Only the text reaches our server, never audio.

Receipt photos: if Save Receipt Photos is on in Settings (it is by default), the receipt photo is also attached to the expense, like a photo you add yourself.

How long:

• The copy of a receipt sent for reading is deleted as soon as it has been read. If reading fails, it stays so you can retry, and it is removed within 7 days in any case.
• Records of each reading, including dictated text, are kept for at most 7 days.
• Cities and shops recognized on your receipts are kept for 90 days, as hints for your next receipts.
• Counters that enforce the daily limit are kept for 2 days.

3.4 Notifications

• What: your device's push token, the language of your device and which notifications you want.
• Why: to tell you when someone adds, changes or deletes expenses in a shared trip, or joins it.
• How: notifications are delivered by Apple Push Notification service. They contain names, the trip name, expense titles and amounts.

3.5 Usage log

• What: each time the app connects, we record the time, the app and iOS versions, and the country your connection comes from. We also keep the country you signed up from and the last one.
• How the country is found: from your IP address, using the IP Geolocation by DB-IP database (CC BY 4.0), which runs on our own server. We don't store the IP address itself.
• Why: to understand how many people use which versions and where from, and to keep the service secure.
• How long: while you have an account. When you delete it, the countries are erased and the log entries stay only as anonymous counts: the link to your account is removed.

3.6 Exchange rates

Our server downloads daily exchange rates from a public source (currency-api, served by jsDelivr and Cloudflare). No data about you is sent to it.

3.7 Data that stays on your iPhone

These stay on your iPhone and are not sent to us:

• your app passcode and Face ID unlock;
• the offline copy of your trips;
• your searches;
• PDF and CSV exports, until you choose to share them.

The app checks whether the clipboard holds a receipt by its type only. It reads the clipboard's contents only when you tap Paste.

4. Who can see your data

• People in your trips: your name, profile photo and everything you add to a shared trip, including expenses, notes and receipt photos.
• Service providers that process data for us:
  • DigitalOcean, LLC: servers, database and file storage, in Amsterdam, the Netherlands. Its sub-processors are listed at https://www.digitalocean.com/trust/subprocessors.
  • OpenAI: receipt and voice reading, in the United States (section 3.3).
  • BunnyWay d.o.o. (bunny.net), Slovenia: a relay for when our servers can't be reached directly, for example from Russia. The app then sends its requests and photos through bunny.net's network to our servers. The relay passes them on without keeping their contents.
  • Apple: Sign in with Apple, push notifications, server speech recognition when on-device recognition is unavailable, and the App Store.
• Nobody else. We don't sell or rent your data, there are no ads and no tracking.
• Authorities: we may disclose data when the law requires it.

5. International transfers

Our servers are in the Netherlands. Data for AI reading goes to OpenAI in the United States. DigitalOcean's sub-processors may process data in the United States. Requests sent through the bunny.net relay cross its network, which has points of presence around the world.

These transfers rely on the providers' data processing agreements and Standard Contractual Clauses or the EU-U.S. Data Privacy Framework where applicable.

6. Legal bases (EEA, UK, Switzerland)

• Performance of our contract with you (Art. 6(1)(b) GDPR): your account, trips, expenses, photos, sync, sharing and notifications.
• Legitimate interests (Art. 6(1)(f)): the usage log, security, preventing abuse and backups.
• Consent (Art. 6(1)(a)): sending receipts and dictated text for AI reading. You can withdraw it at any time in Settings, and that doesn't affect what was processed before.

7. Deleting your data

Delete your account in the app: Settings → Delete Account. This happens:

• Deleted at once:
  • your name, email, profile photo and sign-in methods;
  • your sessions, devices and push tokens;
  • the countries kept for your account;
  • your receipt-reading history and the places recognized on your receipts;
  • your own categories. If an expense in a shared trip uses one of them, the trip's organizer gets a copy, so the expense keeps its category.
• Your invitation links stop working.
• The usage log stays only as anonymous counts, without the link to you (section 3.5).
• Apple: your Sign in with Apple token is revoked.
• Trips only you were in: deleted with all their expenses and photos.
• Trips shared with others:
  • the expenses and photos you added stay in the trip for the other members;
  • your name is removed from them, and the trip's organizer becomes their author.
• Shared trips you organize: you choose to hand each one over to the member who joined first, or to delete it for everyone with all its expenses and photos.
• Backups: deleted data disappears from database backups within 7 days.

You can also delete single expenses, photos and trips at any time. Leaving a trip removes it from your devices.

8. Your rights

Depending on where you live, you may have these rights:

• access your data;
• correct it;
• delete it;
• restrict or object to its processing;
• receive it in a portable format;
• withdraw consent.

You can export any trip as CSV in the app. For anything else, write to [email protected]. We answer within one month. You can also complain to your data protection authority.

9. Security

• Connections are encrypted (HTTPS).
• Photos are kept in private storage behind links that expire after 15 minutes.
• Every request is checked against your trip membership.

No system is perfectly secure. If a breach affects you, we will tell you as the law requires.

10. Children

Spentry is not meant for children under 13, and we don't knowingly collect their data. If you think a child under 13 has given us data, write to us and we will delete it.

11. Website

spentry.me sets no cookies and uses no analytics. Its fonts are served from our own site. Our hosting provider processes your IP address to deliver pages.

12. Changes

If we change this policy, we will update the date above. If the change is significant, we will tell you in the app.

13. Contact

Write to [email protected].