Privacy Policy

Last updated: October 14, 2026

Information we collect

• Account information: email address, display name, account type (individual or business), and an optional profile picture.
• Financial data you enter: transactions, budgets, loans, investments, subscriptions, categories, and custom currency rates.
• Authentication data: your password is never stored by us — authentication is handled by Supabase Auth, which stores a securely hashed credential.

We do not collect location data, contacts, browsing history, or advertising identifiers. Neither the website nor the iPhone, iPad and Mac apps run analytics or ad-tracking code.

How we use your information

• To operate your account and sync your financial data across your devices.
• To calculate the budgets, charts, and insights shown in the app, which run entirely on your own data.
• To send you account-related emails, such as email confirmation and password reset.
• To send the emails you turn on yourself: scheduled financial reports and scheduled backups.

We do not sell your data. Your financial data and account details are never shared with anyone for advertising or marketing.

Business ("team") accounts

If you sign up as an employee of a business account, the business owner (your employer within the app) can view the transactions, categories, and other financial data associated with that business account. This sharing is limited to the business relationship you explicitly join at signup and is enforced by database-level access rules — an employee account cannot see any other business's data.

Where your data is stored

Your data is stored with Supabase, our database and authentication provider, and the web app is hosted on Vercel. Both providers process data on our behalf under their own privacy and security commitments. Access to your data is protected by row-level security rules so that only you (and, for business accounts, linked team members) can read or write it.

The iPhone, iPad and Mac apps also keep an offline copy of your data on your device, so you can see and edit it without a connection; it is deleted when you sign out.

Receipt and document scanning

When you scan a receipt, invoice or bill, the photo or PDF is read on your own device to fill in the transaction form. On iPhone, iPad and Mac this uses Apple's built-in text recognition; on the web it runs in your browser. The document itself is never uploaded to us or to anyone else. Only the transaction you choose to save is stored.

Scheduled reports and backups

If you turn them on, we email you financial reports and, on Plus and Business plans, a scheduled backup: a password-protected (AES-256) ZIP of all the data in your account. The password is shown only in the app and is never included in the email. A backup too large to attach is stored privately and sent to you as a download link that expires after 7 days; the stored file is deleted after 30 days. Backups are available only to the account owner, never to team members. You can turn reports and backups off at any time in the app.

Payments

Subscriptions bought in the iPhone, iPad or Mac app are processed by Apple through the App Store; subscriptions bought on the website are processed by Stripe. We never see or store your card details. We receive only what we need to know which plan you have: the plan, its status and renewal date.

Service providers

• Supabase — database, authentication and private file storage.
• Vercel — hosting of the website.
• Brevo — sending emails (account emails, reports and backups).
• Stripe and Apple — payment processing.

Exchange rates are European Central Bank reference rates, downloaded from the public Frankfurter service (frankfurter.dev); no personal data is sent with that request.

Cookies and local storage

Our website sets no advertising or tracking cookies. The web app keeps your sign-in session in your browser's local storage, which is needed for it to work.

Your choices

• You can edit or delete any financial data you've entered at any time from within the app.
• You can update your profile information and password from Settings.
• You can permanently delete your account and all associated data from Settings → Security → Delete Account. This action is immediate and cannot be undone.

Children's privacy

eXpenx is not directed at children under 13, and we do not knowingly collect data from children under 13.

Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date above.

Contact

Questions about this policy or your data can be sent to contact@expenx.eu.