Privacy Policy

Last updated: 14 October 2026

SpendSmart AI ("the app", "we", "us") is a personal expense tracker operated by KCH Labs, a sole proprietorship of Heston Baptist Dsouza based in Mumbai, India. We are the data controller (and Data Fiduciary under India's DPDPA 2023) for your personal data. This policy explains what data we handle and why. We do not sell your data and we do not show ads.

1. The short version

• The app is local-first: your data lives on your device and works fully offline. It syncs to the cloud only when you're online and signed in.
• We never sell your data. We never show ads. We never use your expense data to train AI models.
• Our staff cannot see your transactions, amounts, merchants, or receipts. Administrative tools expose account metadata only (see §8), and every administrative look-up is logged.
• Some features send your data to AI, speech, and payment providers to work. Those are listed in §4 and §11.
• You can export everything, and delete everything, from inside the app at any time (§7).
• Some things never leave your device at all: your reminders, your achievement badges, and your logging streak are worked out on the phone itself and are never stored on our servers.

2. Data we collect

• Account: your email address, used for authentication, password recovery, and important service communications. We will never sell your email or use it for marketing without your consent.
• Expenses: the transactions you enter (amount, currency, merchant, category, date, payment method, and notes), plus your budgets, savings goals, custom categories, and recurring expenses.
• Receipts: receipt photos you choose to scan. A copy may be stored privately with the expense it came from.
• Category corrections: when you change the category the app picked, we store the words you entered and the category you chose, so the correction follows you to your other devices.
• Country & preferences: the country you select, plus currency, language, and theme, which we store to provide localized currency, payment methods, and merchant recognition.
• Payment handle (optional): if you choose to tell your groups where to send money, we store the payment method you select and the handle you enter, for example a UPI ID, a PayPal address, a phone number or bank details. There is none until you add one, and you can clear it at any time. We never ask for a card number for this purpose: card rails are deliberately excluded, because a card number is not an address to send money to. Section 3a explains who can see it.
• Subscription state: your plan, status, renewal date, and a payment-provider customer identifier, so we know whether you have Pro.
• Notification token: if you sign in and allow notifications, a push token for that device is stored against your account. Your reminders do not use it. They are scheduled on your device and fire without contacting a server, which is why they keep working offline. The token is used for one thing: telling you when someone in a shared group pays you, or adds, changes or comments on a shared expense. Those messages name the group and the person, and never an amount or a description, because a notification can appear on a locked screen. You can turn them off in Settings under Reminders. The token is deleted when you sign out on that device, and we delete it automatically if the app is uninstalled.
• Feedback you choose to send: a rating, an optional comment, an optional display name, and your country (see §6).
• Messages you send us: if you use the contact form on our website, we store the category you pick, your subject and message, and the email address you give us, so that we can reply. As with feedback, we keep a one-way salted hash of the sending IP address to rate-limit the form, never the address itself.
• Usage counters: a per-day and per-month count of how many AI parses you have run, used solely to enforce plan limits and prevent abuse. These are counts only, never the content.

2a. Why we are allowed to handle it

If you are in the UK or the European Economic Area, the GDPR requires us to name a lawful basis for each use. These are ours.

• To run the service you asked for (performance of a contract, Article 6(1)(b)): your account, your transactions, budgets, goals, recurring rules, receipts, groups and subscription state. Without this data there is no expense tracker.
• With your consent (Article 6(1)(a)): usage analytics in the app, analytics cookies on our website, and publishing your feedback as a testimonial. Each of these is off until you turn it on, and you can withdraw at any time, as set out in section 7.
• Our legitimate interests (Article 6(1)(f)): keeping the service secure and available. This covers crash and error reporting, the bot check on sign-up, and the hashed-IP rate limiting on our public forms. We use the least data that works, which is why those records are counts and one-way hashes rather than addresses.
• A legal obligation (Article 6(1)(c)): payment, tax and accounting records, and responding to a lawful request from an authority.

In India, we handle your personal data as a Data Fiduciary under the DPDPA 2023, on the basis of your consent and of the legitimate uses that Act permits.

3. Where your data is stored

Cloud data is stored with our cloud database provider (database, authentication and file storage), on infrastructure located in the United States. Access is protected by row-level security, so you can only read and write your own data. Receipt images are held in a private storage bucket scoped to your user account and served only through short-lived signed links.

3a. Shared groups

If you create a group to split expenses, the records inside it are shared with every member of that group. Group expenses, the amounts each person owes, and any payments recorded between you are readable by all members, and any member can edit or delete them. That includes people you add by name who do not have an account yet: once they claim their place in the group, they can see the group's history, including entries made before they joined.

Groups are online only. Your device keeps a read-only copy of the last update so you can look at a group without a connection, but adding, changing or settling anything requires one. This copy is removed when you sign out or delete your data on that device.

Nothing outside a group is shared. Your own transactions, budgets, goals, categories and settings are never visible to other members, and creating a group does not expose any of them. Group data is not deleted when you delete your account: your name is kept on the entries you were part of, and your user account is detached from them, so the other members' record of who owed what stays correct. See section 7 for what "delete my account" does and does not remove.

If you have saved a payment handle (see section 2), it is shown inside your groups beside your name, so the people who owe you know where to send the money. It is visible to the members of the groups you are in and to nobody else, and it leaves with you: when you leave a group, or delete your account, the copy held on that group's record is cleared automatically. SpendSmart AI does not process the payment, does not verify the handle, and never learns whether money moved. Recording a payment in the app is your own note that it happened somewhere else.

3b. View links for a group

A group can be shared with people who are not in it, using a view link. This is off unless a member turns it on, and there is no view link for any group until somebody creates one.

While a view link is on, anyone with the link can open a read-only web page showing every member of that group by the name used inside it, what each of them owes or is owed, the group's expenses, and the suggested payments to settle up. They do not need an account, and they do not need the app. Treat the link itself as the key: anyone it is forwarded to has the same access.

The page deliberately does not show email addresses, account identifiers, comments written on an expense, or an expense's edit history, and it can never be used to join the group or to change anything.

Any member of the group can stop sharing at any time, from the group's People screen. The link stops working for everyone immediately. Creating a new link also switches off the previous one, so there is only ever one link to withdraw.

3c. Invite links

When a member adds you to a group before you have an account, they can send you an invite link. It opens a page that is not the app and does not ask you to sign in. That page is addressed to one person: it shows the group's name, the name you were added under, whether you are owed money or owe it, how much, and, when you owe, who to pay and how much to send each of them, by the names used inside the group.

If a receipt in that group was split line by line, the page also shows you the lines of that receipt: what each item was called, its price and quantity, so you can tick the ones that were yours. It tells you how many other members have already taken a line, never which ones.

The page deliberately does not show anyone's email address, any account identifier, the full membership list, any other member's balance, notes or comments written on an expense, or an expense's history. Nothing on it can change the group other than the lines you claim for yourself.

Treat the link as the key. Anyone holding it sees what you see, so it is worth the same care as the message it arrived in. The link is a single-use, single-person address that expires, and any member of the group can withdraw it at any time; once you have claimed your place, it stops showing figures at all. We ask search engines not to index these pages, and we deliberately run no analytics and set no cookies on them, so the link itself is never handed to a third party.

4. AI, voice, and camera features

AI processing (Anthropic)

Several features send your financial data to Anthropic (the Claude AI API) for processing:

• Expense text you type or dictate, for smart categorization.
• Receipt images you scan, to read the amount, merchant, and date.
• Bank and credit-card statements you import: only when the file needs AI parsing. OFX, QFX, and CSV statements are read entirely on your device and are never sent to Anthropic or to us. A PDF, or a file our on-device parsers cannot read, is sent as the full file so the transactions can be read from it.
• A summary of a month's transactions when you generate monthly AI insights.

We never add your name, email, or account identifiers to these requests. A document you upload, particularly a bank or credit-card statement, may itself contain personal details such as your name, account number, or balance; that content is transmitted to Anthropic as part of the file. Under Anthropic's API data-use policy, data sent to the Claude API is not retained beyond the request and is not used to train models.

Voice input (Apple and Google)

If you use the Voice button to speak an expense, the app uses your device's built-in speech recognizer to turn your speech into text. To give the best accuracy on Indian merchant names and mixed Hindi–English speech, recognition runs in network mode: the audio is sent to your platform's speech service (Apple on iOS, Google on Android), which returns a transcript. That transcript is then handled exactly like typed text (see AI processing, above).

We do not record your audio, and we never store audio on our servers or send audio to Anthropic. The audio is processed by Apple or Google under their own privacy policies. The microphone is used only while you're actively holding or tapping the Voice control. If you'd rather no audio ever left your device, just don't use the Voice feature; every other way of adding an expense works without the microphone.

Camera and photos

The camera and photo library are accessed only when you choose to scan a receipt. The image is downscaled on your device, sent to Anthropic to be read (see above), and may be stored in your private receipts bucket with the expense. An image you share into the app from another app is read the same way, and is kept only if you switch on "Keep the capture with this entry".

5. Analytics

In the app, off by default. If, and only if, you turn on "Share anonymous usage data", the app sends a small number of product events to our product-analytics provider to help us understand which features people use. These events are limited to milestones such as viewing the upgrade screen, starting a checkout, completing sign-up, activating Pro, and logging a first expense. The only details attached are your platform (iOS/Android/web), your country code, and a pseudonymous account identifier. No expense amounts, merchants, notes, names, or email addresses are ever sent. This is opt-in: nothing is sent until you switch it on, and you can switch it off at any time in Settings.

On our website (the marketing and blog pages) we use Google Analytics to understand aggregate traffic, such as page views and where visitors come from. Google Analytics sets cookies for this purpose and is blocked by default until you accept the cookie banner. It's never sent your expense content, name, or account identifiers.

We use a crash and error reporting provider for both the app and our servers. It's configured so that it doesn't attach your IP address, cookies, request bodies, or account identifiers, only anonymous, content-free error information.

We do not run advertising, we do not use advertising or cross-site tracking cookies, and we never sell your data.

6. Feedback and testimonials

If you send feedback from inside the app, we store your rating, your optional comment, an optional display name, and your country. If, and only if, you tick the box giving permission, we may publish your rating, display name, and country as a public testimonial on our website. We never publish your email address. You can ask us to remove a published testimonial at any time by emailing us.

To stop automated abuse of this one publicly-writable form, we keep a one-way, salted cryptographic hash of the sending IP address for rate-limiting. The raw IP address is not stored and the hash cannot be reversed to recover it.

7. Your rights and controls

• Access & export: you can export your transactions to CSV or PDF, or download a JSON copy of your account data from within the app at any time. That file contains your transactions, categories, budgets, savings goals, recurring expenses, saved templates, settings and subscription status. Three things are deliberately not in it: receipt images (they are image files, not data rows), shared group records (they belong to a group rather than to you alone, and section 3a explains why they outlive your account), and the merchant corrections you have saved (these are stored with your account so they follow you between devices, and are deleted with it). If you want any of those, or a copy of everything we hold in one place, email info@spendsmartai.online and we will put it together for you within 30 days, free of charge.
• Deletion: Settings includes "Delete my account", which permanently erases your account and all associated data, including your receipt images, from our servers, in line with the GDPR right to erasure and India's DPDPA 2023. A separate "Delete all data" option clears your expense data while keeping the account.
• Correction: you can edit or delete any individual transaction, budget, goal, or preference directly in the app.
• Withdraw consent: you can turn off usage analytics in Settings at any time. On this website, "Cookie settings" at the foot of every page reopens the cookie banner whatever you chose before, and choosing Decline there takes effect immediately and deletes the analytics cookies already on your device. Withdrawing is exactly as easy as agreeing was, and it does not affect anything that happened while your consent was in force.
• Complaint: if you're in the EU/UK you may lodge a complaint with your local supervisory authority; in India, with the Data Protection Board.

What survives account deletion, and why. A small amount of data is deliberately retained after you delete your account, because we're legally or operationally required to keep it: payment and subscription records (needed for tax, accounting, refunds, and chargebacks), administrative access logs (needed to prove our staff didn't misuse your data), and cookie-consent records (needed to prove we honoured your consent choice). If you sent feedback, your name and comment are erased, and only an anonymous rating and country remain. None of this retained data contains your expenses, receipts, or email address.

8. Staff and administrative access

We think you should know exactly what we can see. Our administrative tools let us view account metadata only: your email address, sign-up date, last sign-in, country, subscription status, and whether your account contains data at all.

Our staff cannot read your transactions, amounts, merchants, notes, or receipt images through any administrative tool. That restriction is enforced in the database itself, not merely by policy. Every time a staff member opens a user record, the access is written to an audit log first; if the log write fails, the access is refused.

We may send ourselves an internal operational summary (for example, counts of new subscriptions and a record of administrative actions) through a private team messaging channel. It contains no expense data.

9. Data retention

We retain your account information and expense data for as long as you keep your account. To be precise about what that means, because "active" is a word that can hide a deletion: we do not delete accounts for inactivity, and we do not currently have a dormancy policy. If you never open the app again, your data stays exactly where it is until you delete it, ask us to, or the service shuts down. If that ever changes we will tell you before it affects you, and we would not delete anything without warning you first at the address on your account.

When you delete your account, that data, including receipt images, is removed from our active systems immediately and purged from encrypted backups within 30 days.

Other records are kept as follows:

• Crash and error logs (which never contain your expense content or identifiers): up to 90 days.
• Payment and subscription records: retained as required by Indian tax and accounting law.
• Administrative access logs: a record of which staff member opened which account record, and when. These are kept for as long as we operate the service, and outlive the deletion of the account they refer to. That is deliberate: their only purpose is to let us, or a regulator, show after the fact that nobody looked at something they should not have, and a log that is deleted on request is a log that cannot answer the question it exists for. They record the access, never the contents of what was accessed, and our staff cannot read your expenses through any tool in the first place (see section 8).
• Cookie-consent records: a random visitor identifier, your choice, a timestamp, and the policy version in effect. This record contains no name, email address, or IP address, and exists solely to demonstrate we honoured your consent decision. For abuse prevention, the sending IP address is recorded for the day to rate-limit this endpoint. It is not linked to your consent record and is not used for anything else.
• Contact messages: retained while we are dealing with your question and for up to 12 months afterwards, so we can pick up a follow-up, then deleted.
• Receipt images, when you delete the expense: deleting a transaction does not currently delete the receipt image attached to it. The image stays in your private storage, where only you can reach it, until you use "Delete all data" or "Delete my account" in Settings, either of which removes it. We are changing this so that a deleted expense takes its image with it, and we would rather tell you than let you assume it already works that way.
• Anti-abuse usage counters: counts only, no content, retained while your account is active.

10. Children

SpendSmart AI is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you're under 18, please don't use the service or provide any personal information. If you believe a person under 18 has provided us with personal information, contact us at info@spendsmartai.online and we will delete it.

11. Sub-processors and international data transfers: who else handles your data, and where

Running SpendSmart AI means a few other companies handle some of your data on our behalf. We name a provider where you deal with it directly, where it receives the actual contents of what you write or upload, or where its name is the one you will see on a payment. For the remaining infrastructure we describe each provider by what it does and where it is, which is the level of detail data-protection law asks for and the level our industry publishes. If you want to know the specific company behind any category below, email info@spendsmartai.online and we will tell you.

Some of these providers are outside India. Where personal data is transferred internationally we rely on Standard Contractual Clauses or an applicable adequacy decision. We review this section before adding a provider, and update it when one changes.

Named

• Anthropic, PBC (United States): AI processing of expense text, receipt images, bank and credit-card statements, and monthly insights, through the Claude API. This is the only provider that receives the contents of what you write or upload, which is why it is named rather than described. Inputs are not retained beyond the request and are not used to train models.
• Apple Inc. (United States): Sign in with Apple, where Apple confirms your identity to us; speech recognition for the Voice feature on iOS; App Store subscription billing. If you choose to hide your email address when signing in, Apple gives us a private relay address instead of your own and forwards our messages to you, so we never hold your real address.
• Google LLC (United States): sign-in with Google, where Google confirms your identity to us and we receive the email address and name on that Google account; speech recognition for the Voice feature on Android; Google Play subscription billing; Google Analytics on our public website.
• Dodo Payments, Inc: subscription payments on the web, acting as merchant of record. This is the name that appears on your card statement, which is why it is named. Receives your email address and a pseudonymous account identifier to create your billing record.

By category

• Cloud database, authentication and file storage (United States): stores the data you sync and your receipt images, and runs sign-in. This provider holds your expense data, but our own staff cannot read it through any tool (see section 8).
• Website hosting and content delivery (United States): serves spendsmartai.online and the web app.
• Subscription management for the mobile apps (United States): receives a pseudonymous account identifier and your subscription status, not your email address.
• Transactional email delivery (European Union): sends account email such as sign-in confirmations, password resets and replies to messages you send us. Receives your email address and the contents of that email. Nothing about your expenses is sent by email.
• Crash and error reporting (United States): receives anonymous, content-free error data only, never your expense content, name, or account identifiers.
• Product analytics (United States), only if you opt in: receives funnel event names, platform, country, and a pseudonymous account identifier. No expense content, name, or email address.
• Over-the-air app updates and push notifications (United States): receives a device push token, and relays our group notifications to Apple or Google for delivery. The message text it relays names a group and a person, never an amount or a description.
• Internal team messaging: carries the operational summary described in section 8. Contains no expense data.

12. Changes to this policy

If we make a material change to how we handle your data, we'll update the "last updated" date above and, where the change is significant, notify you in the app before it takes effect.

13. Jurisdiction

This service is operated from India and governed by the laws of India, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (DPDPA).

14. Contact

Questions about your privacy, or want to exercise any right above? Email us at info@spendsmartai.online, or write to KCH Labs, Legend II, D201, Kandarpada, Dahisar West, Mumbai 400068, India.

Who answers. SpendSmart AI is run by one person, so there is no queue and no contact form standing between you and a decision. Data protection questions, and any grievance under the DPDPA 2023, are handled by Heston Baptist Dsouza, KCH Labs, at the email and address above. We acknowledge a request within 2 business days and answer it within 30 days. If we need longer, because a request is complex, we will tell you why before that period is up.