SpendPal — Privacy Policy

Effective date: 14 June 2026 Last updated: 5 October 2026

This Privacy Policy describes how SpendPal ("SpendPal", "we", "our", or "us") collects, uses, stores, and shares information when you use the SpendPal mobile application (the "App") and our website at https://spendpal.ai (the "Site").

SpendPal is operated by Alexandru Irimia, an individual developer based in the United Arab Emirates. You can reach us at support@spendpal.ai.

1. Summary

SpendPal is designed so most of your data stays on your own device and in your own iCloud account. We do not sell your data, we do not run advertising, and we do not share your data with data brokers. The only third parties involved in operating the App are Apple (for device storage, iCloud sync, in‑app purchases, and on‑device AI) and Google (for receipt scanning via the Gemini API, anonymous sign-in, the database that counts scans, and reports of crashes and failed scans). The App contains no analytics or advertising SDKs. Details are below.

2. Information We Collect

2.1 Information you create inside the App

When you record an expense, the following data is stored locally on your device using Apple's SwiftData framework and (if you have iCloud enabled) synced across your devices using Apple CloudKit's private database:

• Expense amount, currency, date, category, subcategory
• Shop / vendor name you enter or that is detected from a receipt
• Line item names and prices (from receipts or manual entry)
• Notes, tags, and recurring expense settings you create
• Shortcut and quick-entry configurations
• Item alias / rename rules you set up

This data is stored in your private iCloud account. We do not have a server that stores or processes a copy of your expense data. We cannot read, query, export, or modify this data; only you and the devices you sign in to your iCloud account on can.

2.2 Receipt images and PDFs

When you scan a receipt, your device reads the text from it on the device itself, using Apple's Vision framework. The photo or PDF stays on your device. Only the resulting text leaves the device, after we remove phone numbers, email addresses, card numbers, and — if you have told us your name — your name, which some receipts print from a loyalty card. Your name itself never leaves your device; it is used only to find and mask itself.

The text goes to our scanning service — a Google Cloud Function we operate in the European Union (Belgium, europe-west1) — which counts the scan against your allowance, passes the text to Google's Gemini API, and returns the result to your device. It holds the text only for the length of that request: it does not store it and does not write it to any log.

The one exception, and you choose it. If we read a total we cannot verify against the receipt text, the review screen offers to re-read the bill with the photo attached. That upload happens only when you tap that button, and only for that one scan. If you never tap it, no receipt image ever leaves your device.

The text we send, and the image if you choose to send one, typically contains:

• Shop name, store address, time/date of purchase
• Items purchased and their prices
• Payment method indicators (e.g. card last 4 digits, if shown on the receipt)
• Loyalty program numbers (if shown on the receipt)

What we do NOT do:

• We do not send the receipt image at all unless you ask us to, per scan, on the review screen.
• We do not store the receipt text or image on our servers, during or after the scan. The scan happens once; the parsed JSON result is what the App keeps (on your device / in your iCloud).
• We do not associate the image with your name, email, phone number, or any account you hold with us (we have no such accounts).

What Google does with it: the data is processed by Google according to the Gemini API Additional Terms of Service and the Google Privacy Policy. Under those terms, Google may process the content to operate, improve, and develop its AI services. If you do not want your receipt content sent to Google, do not use the scan feature — manual entry, the Add tab, and Shortcuts work entirely on‑device.

2.3 Scan credits and subscription status

Our server keeps a count of the scans made this month under your anonymous identifier (§2.4), the time of the last scan, and whether the account is Pro. That count decides how many scans you have left; the App keeps a copy only to display it.

If you subscribe, the App sends our server the subscription transaction record Apple signed, so the server can check it with Apple's certificates rather than take the App's word for it. That record contains the product, the purchase and expiry dates and Apple's transaction identifiers — no payment details, name, email or Apple ID. We store the transaction identifier, the expiry date, whether it was refunded, and which anonymous identifiers it covers. Apple also notifies our server directly when a subscription renews, expires or is refunded. Apple is the payment processor; we never see your card details.

How scans go. When you save a scanned receipt, or leave one without saving it, the App tells our server how the scan went: whether the total could be checked against the receipt, whether the items added up to it, whether you edited anything before saving, whether the photo was re-read, and whether the receipt came from a photo, a PDF or another app. The server adds this to daily totals that do not record who sent it. Nothing from the receipt is sent: no amounts, shop or items. We use these totals to see how well scanning works.

2.4 Anonymous identifier (Firebase Authentication)

So that scans can be counted, the App signs in anonymously with Firebase Authentication. This creates an anonymous user ID (a random string) tied to your install of the App. This ID is not linked to your name, email, Apple ID, or any other identity. We do not use this ID to track you across other apps or websites.

2.5 Remote configuration (Firestore)

The App reads feature switches (for example, pausing scanning during an outage) from a Firestore database that we maintain. The App itself only ever reads from it. Our server writes the scan counts and subscription records described in §2.3 there; your expense data, receipt text and images, and settings are never written to it.

2.6 In-App Purchase data

When you subscribe, the transaction is processed by Apple. What our server receives and keeps about it is described in §2.3: the Apple-signed transaction record, never your payment card details, billing address or Apple ID email.

2.7 Feedback and contacting us

Send feedback (Settings → Support) stores what you choose to answer — a 1–5 rating of scanning, which features you use most, and anything you type — in our Firestore database, together with your anonymous identifier (§2.4), the app version, the app language and your device model. It asks for no name or contact details, so we cannot reply to it; please do not type personal information into it. We keep it until you ask us to delete it: quote the Support ID shown in Settings → Support.

Contact us opens an email in your own mail app, addressed to support@spendpal.ai. The draft includes your Support ID, the app version, your device model, iOS version and app language, all visible and editable before you send. If you send it, we receive your email address and whatever the message contains, and use them only to answer you.

Report a bad read (on the review screen after a scan) also opens an email in your own mail app, addressed to support@spendpal.ai. Attached are the receipt photo (or PDF) and a file with the text read from it, the answers our scanning service gave and the version on your screen; the message carries the same details as Contact us. Every attachment is shown before you send, and you can remove any of them. A receipt photo can show personal details, such as the last digits of a card. If you send one, we use it only to understand and fix that kind of misread. Reports are deleted from our mailbox automatically 20 days after they arrive. A receipt that helps us test future versions of the scanner may be kept apart from email, never published or shared, and deleted whenever you ask: reply to your report or quote your Support ID.

2.8 Crash and error reports (Firebase Crashlytics)

If the App crashes, or a scan fails in a way the App cannot recover from, a report is sent to Firebase Crashlytics, operated by Google, so we can find and fix the fault. A report contains the technical details of the failure (for a crash, where in the App's code it happened; for a failed scan, which step failed and why, such as a label the App did not recognise), your device model, iOS version, App version and App language, and random identifiers Crashlytics creates for your install. It never contains your receipts or their text, items or prices, your expenses, or your Support ID, and it is not linked to your identity. Crashlytics also counts sessions: each time the App is opened, it records a random session ID, the time and the same device details, so that it can tell what share of uses ended in a crash. A session record says nothing about your scans or expenses. Google keeps crash and error reports, and the identifiers that go with them, for 90 days.

2.9 Data we do NOT collect

To be explicit, SpendPal does not collect: your name, email address (unless you email us), phone number, mailing address, precise location, contacts, calendar, photos library (we only access the specific photo you pick for a scan), microphone, advertising identifier (IDFA), analytics about how you use the App (beyond the scan count and daily scan totals in §2.3, and the crash and error reports in §2.8), or any data from other apps.

3. How We Use Information

We use the information described above only to:

• Provide and operate the App (record expenses, scan receipts, sync via iCloud)
• Process your in‑app purchases via Apple, and confirm a subscription with Apple's signature
• Count scans against your monthly allowance, and block abuse of the scanning service
• Read the feedback you choose to send, to decide what to improve
• Find and fix crashes and failed scans, from the reports in §2.8
• Measure how well scanning works, from the daily totals in §2.3
• Comply with applicable law

We do not use your information for advertising, profiling, automated decision‑making with legal effects, or sale to any third party.

4. Legal Basis for Processing (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, our legal bases for processing are:

• Performance of a contract (Article 6(1)(b) GDPR) — for processing necessary to provide the App's features (recording expenses, performing scans you request, processing purchases).
• Legitimate interests (Article 6(1)(f) GDPR) — for counting scans and blocking abuse of the scanning service, for reading feedback you choose to send, and for crash and error reports that let us fix faults. We believe these interests do not override your rights because the data is tied only to an anonymous identifier and is kept to what those purposes need.
• Consent (Article 6(1)(a) GDPR) — for any feature that explicitly asks for it (such as access to the camera, photo library, or notifications). You can withdraw consent at any time in iOS Settings.

5. Sharing With Third Parties

We share data only with the service providers listed below, and only as needed to operate the App. We do not sell personal data. We do not share data with advertisers or data brokers.

We will only disclose data to other parties (such as law enforcement) if required by a valid legal request under the laws of the United Arab Emirates or another jurisdiction with binding authority.

6. Your Choices and Rights

6.1 Controls inside the App

• Stop using scan features — manual entry, quick entry, and shortcuts work entirely on-device with no data sent to Google.
• Disable iCloud sync — turn off iCloud for SpendPal in iOS Settings → [your name] → iCloud → SpendPal. Your data will then live only on the device.
• Delete all local data — uninstalling the App removes the local database. To also remove iCloud data, sign in to icloud.com → Manage Account Storage → SpendPal.
• Camera, Photo Library, and Notifications permissions — control these in iOS Settings → SpendPal.

6.2 Rights under GDPR / UK GDPR

If you are in the EEA, UK, or Switzerland, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Erase your data ("right to be forgotten")
• Restrict or object to processing
• Receive your data in a portable format
• Lodge a complaint with your local data protection authority

Because we do not maintain a server-side copy of your expense data, most of these rights are exercised directly through the App (delete local data, sign out of iCloud). For the limited data we do hold — your anonymous identifier, its scan counts and subscription record, and any feedback you sent — contact us at support@spendpal.ai, quoting the Support ID from Settings → Support, and we will action your request within 30 days.

6.3 Rights under the California Consumer Privacy Act (CCPA / CPRA)

If you are a California resident, you have the right to know, delete, correct, and limit the use of your personal information, and the right to non-discrimination for exercising these rights. We do not "sell" or "share" personal information as those terms are defined under the CCPA. Submit requests to support@spendpal.ai.

6.4 Rights under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021)

If you are in the UAE, you have rights to access, correct, erase, restrict processing of, transfer, and object to processing of your personal data. Submit requests to support@spendpal.ai.

7. Data Retention

• On-device data lives until you delete it inside the App or uninstall.
• iCloud-synced data lives in your iCloud account until you delete it there.
• Receipt text and images sent for scanning — we do not retain them after the scan returns. Google's retention is governed by Google's own policy.
• Scan counts and subscription records — kept while your anonymous identifier exists, or deleted sooner on request (quote your Support ID).
• Anonymous Firebase Auth UID — retained until you delete the App or we delete the Firebase project.
• Feedback sent from the App — kept until you ask us to delete it (quote your Support ID).
• Crash and error reports — kept by Google for 90 days.
• Daily scan totals — kept while the App is offered; they record no one.
• Emails to support — kept in our mailbox for as long as needed to answer and follow up on your request.

8. Security

We use the security mechanisms provided by Apple and Google: TLS for all network requests, Apple's Keychain for sensitive storage, CloudKit private container access controls, and Firebase App Check (where supported) to limit API abuse. No system is perfectly secure, but we treat the limited data we do hold with reasonable care.

9. International Data Transfers

The App is operated from the United Arab Emirates. Our scanning service runs in the European Union (Belgium). Firebase services (including the Gemini API) are operated by Google globally and may process data in the United States, the European Union, and other countries where Google maintains infrastructure. Where required, we rely on Google's Standard Contractual Clauses and equivalent transfer mechanisms.

10. Children

SpendPal is not directed to children under the age of 13 (or under 16 in the EEA / UK). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact support@spendpal.ai and we will delete it.

11. Changes to This Policy

We may update this Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, surface a notice inside the App on next launch. Continued use of the App after the update constitutes acceptance of the revised Policy.

12. Contact

If you have questions, requests, or complaints regarding this Policy or your data, contact:

Alexandru Irimia SpendPal United Arab Emirates Email: support@spendpal.ai