Privacy Policy

Spendmate ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our financial tracking service.

By using Spendmate, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our Service.

2.1 Personal Information

• Account details: name, email address
• Profile information: avatar, preferences, timezone, currency
• Communication: support tickets, feedback, correspondence

2.2 Financial Data

• Transactions: amounts, dates, categories, merchants, notes
• Accounts: balances, types, institutions (nicknames only)
• Budgets & Goals: targets, progress, categories
• Documents: uploaded receipts, statements (encrypted)

2.3 Technical Data

• Device info: browser, OS, screen resolution
• Usage analytics: page views, feature interactions, errors
• Logs: IP address, access times, API requests

2.4 Third-Party Data

If you connect external accounts (banks, authentication), we receive only the data you authorize. We do not store your banking credentials.

• Provide the Service: Process transactions, generate reports, sync data across devices
• Improve Experience: Analyze usage patterns, fix bugs, develop new features
• Security: Detect fraud, prevent unauthorized access, enforce Terms
• Communicate: Send service updates, security alerts, billing receipts
• Legal Compliance: Fulfill legal obligations, respond to lawful requests
• Analytics: Aggregate, anonymized usage statistics (no personal identifiers)

We do not sell your personal or financial data. We share information only as follows:

• Service Providers: Cloud hosting (AWS/Vercel), authentication (Clerk/Auth.js), analytics (Umami, GA4), email (Resend). All under strict DPAs.
• Banking Partners: Only data you explicitly authorize via OAuth/secure APIs. No credentials stored.
• Legal Requirements: When required by law, court order, or to protect rights/safety.
• Business Transfers: In merger/acquisition, data transfers with same privacy commitments.
• Aggregated Data: Anonymized, statistical insights that cannot identify you.

• Encryption: TLS 1.3 in transit, AES-256 at rest for sensitive data
• Authentication: Secure OTP/passwordless auth, session management, rate limiting
• Access Control: Role-based access, principle of least privilege
• Monitoring: Security logging, intrusion detection, regular audits
• Backups: Encrypted, geographically distributed, tested recovery

While we implement industry-standard measures, no system is 100% secure. You are responsible for keeping your credentials safe.

• Active Account: Data retained while account is active
• Account Deletion: Data deleted within 30 days of request
• Legal Holds: Retained longer if required by law or litigation
• Backups: Purged from backups within 90 days
• Anonymized Analytics: May be retained indefinitely

You can request data deletion anytime via account settings or emailing help@shoninfox.com

Depending on your jurisdiction, you may have rights to:

• Access: Request a copy of your data
• Rectification: Correct inaccurate data
• Erasure: Delete your data ("right to be forgotten")
• Portability: Export your data in standard format (JSON/CSV)
• Restriction: Limit processing of your data
• Objection: Object to certain processing (e.g., marketing)
• Withdraw Consent: Where processing is based on consent

To exercise these rights, contact help@shoninfox.com. We respond within 30 days.

We use cookies and similar technologies:

• Essential: Session management, security, authentication (cannot be disabled)
• Analytics: Umami (privacy-friendly, no personal data), Google Analytics 4
• Preferences: Theme, language, dashboard layout

You can manage cookies via your browser settings. Disabling essential cookies will break the Service.

The Service integrates with third parties. Their privacy policies apply:

• Authentication: Clerk / NextAuth.js
• Analytics: Umami Analytics, Google Analytics 4
• Hosting: Vercel / AWS
• Payments: Stripe (if applicable)
• Email: Resend

We encourage you to review their privacy policies.

Spendmate is not intended for users under 18. We do not knowingly collect data from children. If you believe a child has provided data, contact us immediately for deletion.

Your data may be processed in countries other than your own (e.g., US, Singapore). We ensure adequate protection via Standard Contractual Clauses or equivalent safeguards per applicable law.

We may update this policy. Material changes will be notified via email or in-app 30 days prior. Continued use constitutes acceptance. Check this page periodically for updates.

Spendmate Privacy Team

Email: help@shoninfox.com

Data Protection Officer: help@shoninfox.com

Website: Spendmate App