Spendimo Privacy Policy

Effective date: August 1, 2026 · Last updated: October 3, 2026

Spendimo was built on one idea: your spending is nobody’s business — including ours. This policy explains exactly what that means in practice. It’s written to be read, not skimmed past.

The short version

Without an account, Spendimo talks to no one — not our servers, not any third party. Everything — your entries, receipts, trends — lives only on your iPhone. (The single exception: opening the Spendimo Pro subscription screen fetches current prices via Apple and our subscription processor, RevenueCat.)
With a free account, we hold your email, name, and a hashed password. Your financial entries still stay on your phone; free accounts don’t sync.
With a Pro subscription, your entries sync to our server in Germany so they can back up, follow you across devices, and be shared with your partner — that’s the entire reason the server exists.
Receipt photos stay on your iPhone unless you say otherwise. Scanning always runs on Apple’s on-device Vision engine — no server of ours ever reads or analyzes a receipt. Pro users can opt in to receipt sync (off by default) to store their receipt photos in their account; turning it off again stops new uploads but does not remove copies already in the account — deleting the receipt, the expense, or the account does.
The Spendimo app uses no behavioral analytics, no advertising networks, no trackers, and no AI. The website uses Google Tag Manager, as described below. Our subscription processor, RevenueCat, manages subscriptions and gives us subscription reporting (how many subscriptions are active, started, renewed, or cancelled); that reporting is about purchases, not about how you use the app (details below). If you install Spendimo after tapping one of our ads, your iPhone sends the ad platform an anonymous install report through Apple’s SKAdNetwork — no identifier, no device data, nothing about you; see “When you install Spendimo from an ad” below.

Who we are

Spendimo is made by BekApps LLC, a limited liability company registered in Delaware, United States. For everything in this policy, BekApps LLC is the “data controller” — the party responsible for your data.

Contact: [email protected]
Postal address: 1111B S Governors Ave, Suite 29063, Dover, DE 19904, USA

What we collect — and what we never collect

If you use Spendimo without an account

Nothing. We collect nothing at all. The app makes no network requests in this mode — not to our servers, and not to anyone else’s: there is no account, no identifier, and no telemetry. Simply using the app to track your money contacts nobody. The single exception is a screen you choose to open: viewing the Spendimo Pro subscription screen fetches current prices, which contacts Apple’s App Store and our subscription processor RevenueCat (see the processor list below). Your data sits in the app’s protected storage on your iPhone, covered by iOS file protection.

The honest flip side: because we never see this data, we cannot back it up or recover it. If the phone is lost or the app is deleted, the data is gone. You can export everything to CSV at any time, free — we recommend doing so occasionally.

If you create a free account

We store the details you give us when signing up:

Email address (to identify your account and reset your password)
Full name (so the app can greet you and your partner can recognize you)
Password — stored only as a cryptographic hash; we cannot read it
Optionally, a phone number if you add one to your profile
App preferences you choose to save, such as your display currency

Your financial entries do not sync on a free account. They remain on your device only.

Everything above, plus the financial entries you create sync to our server: amounts and currencies, descriptions, categories, dates, notes, tags, payment-method labels, recurring-bill settings, and — if you use partner sharing — the sharing status of each record. If you additionally turn on receipt sync (off by default), the compressed receipt photos you scan are stored with their expenses too. This is what makes backup, multi-device sync, and partner sharing possible; it is the only purpose this data is used for.

What we never collect, on any tier

Receipt photos — unless you opt in. Scanning happens on your iPhone with Apple’s Vision framework, whether you take the photo with the camera or pick one from your photo library; no server of ours ever reads or analyzes a receipt. The photo is kept on your device with its expense. Only if you turn on receipt sync (Pro, off by default) are compressed copies uploaded to your account so your other devices — and your partner, on shared records — can view them. Enabling it uploads the eligible receipts already saved on the phone as well as new ones. Disabling it stops future uploads; it does not remove copies already uploaded — to remove one, delete the receipt or its expense, or delete your account, and the server copy goes with it.
Bank data. Spendimo connects to no banks, holds no credentials, and reads no accounts. Everything in the app is there because you typed or scanned it.
Location, contacts, photos (beyond the receipt photo you take or pick yourself).
Behavioral analytics, advertising identifiers, or tracking data of any kind. We do not use behavioral analytics or advertising tracking: no advertising SDK and no usage-analytics service is present in the app, and no AI system — ours or anyone’s — processes your data. The subscription reporting described below is about purchases, not about what you do in the app.

Why we’re allowed to process your data

European law (GDPR) requires us to name a lawful basis for each use:

What	Why	Lawful basis
Account data (email, name, password hash)	Operating your account, signing you in, resetting passwords	Contract — Art. 6(1)(b)
Synced financial entries (Pro)	Providing the sync, backup, and sharing service you subscribed to	Contract — Art. 6(1)(b)
Sharing records with your partner	Only happens when you explicitly mark a record as shared	Consent — Art. 6(1)(a), withdrawable at any time
Subscription events (via RevenueCat)	Activating your purchase, preventing fraud, counting subscriptions	Contract — Art. 6(1)(b) and legitimate interest — Art. 6(1)(f)
Account emails (password reset, email verification, password-change notices)	Account security you requested	Contract — Art. 6(1)(b)
The email address you enter to invite a partner	Delivering that one invitation, and showing you who you invited while it is open (kept at most 7 days — see below)	Legitimate interest — Art. 6(1)(f), the invitee’s and yours
Apple’s anonymous ad-attribution postback (only after installing from an ad)	Knowing which ad campaign led to an install, so we can pay for the ones that work	Legitimate interest — Art. 6(1)(f); the report contains no personal data

We do not profile you, score you, or make automated decisions about you.

Sharing is opt-in twice over: both people link accounts by explicit invitation, and then each individual record is private unless you mark it shared when creating it. Your partner sees only the records you shared — never your private entries, never your totals. Shared records use an approval flow: your partner can approve or dispute them, and deleting an approved shared record requires their consent too.

Inviting a partner by email. You invite your partner by entering their email address. We send one email to that address containing a join link and code, naming you (your name and your account email) as the person inviting them — that is the only email we ever send to someone who has not signed up, and we send nothing else to that address afterwards. Inviting an address tells you nothing about whether it belongs to a Spendimo account — the app shows the same result for every address. The address you entered is stored with the invitation only while the invitation is open — until it is accepted, declined, cancelled, or expires after 7 days — and is then deleted from the invitation (immediately when it is answered or cancelled, within a day of expiring); it is not used for anything else, not added to any list, and not shared with anyone. Whoever opens the link joins with the account they choose to use, and you confirm it is really your partner before any record is shared — a forwarded email or a mistyped address can at most produce a request you decline. The one exception to that confirmation step: if a verified Spendimo account already uses exactly the address you typed, that account sees the invitation inside the app and can accept it directly, because the address match is the proof you asked for. Invitation links expire after 7 days.

You can stop at any time. Unsharing and ending a partnership remove the shared records from your ex-partner’s view; the removal signal contains no record content. The real-time “something changed” notification between partners is exactly that — a content-free ping; your data is never inside it.

What your partner does with information they’ve seen while records were shared is, like anything you tell another person, between the two of you.

The complete list of companies that touch your data

Hetzner Online GmbH (Germany) — hosts our server and database, in a German data center. All synced financial data lives here, inside the EU. Hetzner processes it under a data processing agreement (Art. 28 GDPR) and is ISO 27001 certified.
RevenueCat, Inc. (United States) — provides subscription management and subscription reporting. RevenueCat receives a pseudonymous account identifier (a random UUID) and Apple purchase information — never your email, name, or any financial entry. The identifier is random, but because our server can match it to your account, the purchases RevenueCat holds are linked to you, not anonymous. RevenueCat turns those purchase events into the subscription reports we look at — how many subscriptions are active, started, renewed, or cancelled, and each subscription’s own purchase history. That is why Spendimo’s App Store privacy label lists Purchase History under “Analytics”: it reports on purchases, not on what you do in the app. Like any service reached over the network, its requests also carry basic device context (device model, OS and app version, language, an app-scoped Apple device identifier, and when the app last contacted RevenueCat), used to operate the subscription service — never for advertising or tracking. RevenueCat’s software only activates when you sign in or open the subscription screen; using Spendimo without doing either sends RevenueCat nothing at all. Transfers to RevenueCat are covered by the EU–U.S. Data Privacy Framework, under which RevenueCat is certified.
Apple — processes your payment as an independent company under its own terms and privacy policy. We never see your payment details.
Brevo (France, EU) — delivers our account emails: the password-reset code, the email-confirmation link and verification code, the notice that your password was changed, and partner invitations. Receives the recipient’s email address and the message content, only when one of those messages is sent — for account emails that is your address and first name; for a partner invitation it is the address you entered plus the invitation itself, which names you (your name and your account email) and carries the join link. Delivering an email necessarily discloses its recipient and content to the email processor.

Hetzner, RevenueCat, and Brevo process this data on our behalf, only for the purposes described on this page, under data processing agreements (Art. 28 GDPR) with us. Each is required to protect your data to at least the standard described in this policy and required by Apple’s App Store Review Guidelines, and none may use it for its own purposes. Apple is the exception in one respect: it handles your payment as an independent company under its own terms, not as our processor.

These are the services used by the Spendimo app. The website also uses the service described below.

Website: Google Tag Manager

This website loads Google Tag Manager to manage website tags. Loading begins after your first tap, scroll, or keyboard interaction, or three seconds after the page finishes loading, whichever happens first. Partner-invitation pages and the email-confirmation page do not load Tag Manager. The email-confirmation page sends the one-time token from your link to our own server when you tap Confirm, and makes no other request.

Downloading the Tag Manager script makes a connection to Google, which receives normal connection information such as your IP address and browser headers. Our current container has no analytics or advertising tags. The loading timer and ordinary page interactions do not record a consent choice or grant permission for analytics cookies. Google’s handling of information is described in its Privacy Policy.

The website also stores your chosen light or dark appearance and website language locally in your browser when you change those settings. On your first homepage visit in a tab session, it checks your browser’s language preferences to select an available translation, unless you have already chosen a language. A session storage flag prevents repeated automatic language detection. These language settings are processed in your browser and are not sent to a separate language-detection service.

When you install Spendimo from an ad

We advertise Spendimo, for now on Google Ads. If you tap one of those ads and then install the app, Apple’s SKAdNetwork — a privacy feature built into iOS — lets the ad platform learn that its ad led to an install, without learning who you are.

Here is exactly what happens. Your iPhone itself, not the Spendimo app, sends one to three small “install-validation postbacks” to the ad platform in the weeks after the install, on a schedule Apple randomizes. Because we have asked for it in the app’s configuration, your iPhone sends us an identical copy. A postback contains: the ad platform’s identifier, a short campaign number, Spendimo’s App Store ID, a random one-time transaction ID, whether the app was a re-download, and a tiny “conversion value” that the app sets (0–3: installed, saved a first entry, signed in, subscribed to Pro). Depending on how many people installed from that campaign, Apple may add or withhold a two-letter country code. There is no identifier for you or your device, and Apple designs the whole scheme so that no party can tie a postback to a person. Apple signs each postback; we count only the ones whose signature verifies.

The Spendimo app does not contain any advertising software and makes no request of its own for this. The one thing the app does is tell iOS how far the install got (the conversion value) — a single call to an Apple API. We do not use Apple’s App Tracking Transparency prompt, because nothing here is tracking under Apple’s definition: no data that identifies you or your device leaves the device.

If you did not install from an ad, none of this happens at all. If you did, the postbacks go to the ad platform (Google — see its Privacy Policy) and to our server in Germany, where we keep them as our own count of installs per campaign. They are not linked to your account and cannot be, since they contain nothing that identifies you.

Where your data lives

Synced financial data is stored exclusively in Germany, inside the European Union. For the app, the only data that leaves the EU is the subscription information sent to RevenueCat in the United States (the pseudonymous identifier, purchase state, and the device context described above), protected by the EU–U.S. Data Privacy Framework. Account emails are delivered by Brevo from within the EU.

How long we keep it, and how deletion works

We keep account and synced data for as long as your account exists.

You can delete your account from inside the app (Settings → Account). This is a real deletion, not a deactivation. What happens, in order:

Immediately: your account record, your synced entries, and any receipt images you uploaded are erased from our production database and file storage.
If you ever shared records with a partner, blank, anonymized markers remain in place of the shared records — stripped of every amount, description, and name — solely so your ex-partner’s app knows to remove its copies. They contain no personal data.
Right after, in the background: we ask RevenueCat to erase the record it holds under your pseudonymous identifier, and — if you signed in with Apple — ask Apple to revoke the sign-in token. These requests retry until the other side confirms; they normally complete within minutes. If one keeps failing, we keep only what is needed to finish it by hand: the request itself, with no name, email, or entries.
Within 30 days: encrypted backups of our database are kept for at most 30 days, so any copy of your data inside a backup expires within 30 days of the deletion. Apple keeps its own record of your purchases under its own terms; that is Apple’s, not ours, and stays.

One important note: deleting your account does not cancel an active subscription, because subscriptions are managed by Apple, not us. If you have an active subscription, the app’s deletion confirmation reminds you of this and offers a direct link to Apple’s subscription settings.

Data on your device is always yours to delete by removing the app.

Your rights

If you’re in the EU or another jurisdiction with data protection laws, you have the right to:

Access the data we hold about you
Correct it (most of it you can edit directly in the app)
Delete it (the in-app account deletion does exactly this)
Export it — the app’s free CSV export gives you every transaction in full precision, anytime
Restrict or object to processing
Withdraw consent for partner sharing at any time

To exercise any of these, email [email protected] — we’ll respond within one month. You also have the right to complain to your data protection authority (in the Netherlands, the Autoriteit Persoonsgegevens; in Germany, your state’s supervisory authority).

If you’re in Turkey (KVKK)

The Turkish Personal Data Protection Law (KVKK, Law No. 6698) gives you the same substance of rights as listed above — access, correction, deletion, and objection. Our data protection representative in Turkey is Ebubekir Yazici; KVKK requests can be sent to [email protected] in Turkish or English.

Age

Spendimo is not intended for anyone under 18, and we do not knowingly collect data from anyone under 18.

Changes to this policy

If we change this policy, we’ll change the date at the top and, for meaningful changes, say so plainly in the app’s release notes. We will never quietly weaken the commitments on this page.

Contact

Questions about privacy: [email protected]