SpendFlow is a personal-finance web app that helps you track income and expenses, view monthly overviews and spending charts, and manage accounts, categories and budgets. This policy explains what data the app handles and how it is protected. Unlike the local-only mobile version, the web app stores your data in a secure cloud database so it is available whenever you sign in.
Information We Collect
- Account & profile — when you sign in with Google, we receive your name, email address and profile photo from Google. When you sign in with an email code, we receive only your email address. You may add an optional phone number.
- Financial data you enter — transactions, categories, accounts and budgets you create in the app.
- Preferences — currency, language, theme, first day of week and dashboard filters.
- Technical — a secure session cookie that keeps you signed in.
How Your Data Is Stored
Your financial records and preferences are stored in a managed PostgreSQL database (Supabase). Profile photos are stored in Supabase Storage. Every record is tied to your account and isolated from other users at the data layer. All traffic is encrypted in transit over HTTPS.
Authentication & Cookies
Sign-in is handled by Supabase Authentication (Google, or a one-time code sent to your email). No password is stored. After you authenticate, the server issues a signed token stored in an httpOnly cookie to keep your session active. This cookie is used only for authentication — not for advertising or tracking across other sites.
Third-Party Services
We rely on a small number of infrastructure providers that process data on our behalf:
- Supabase — sign-in / authentication, database hosting and file storage.
- Google — “Continue with Google” sign-in, if you choose it.
- Our email delivery provider — sends sign-in codes and links to your email address.
These providers only process the data needed to deliver the service.
How We Use Your Data
Your data is used solely to provide the app's features — recording transactions, computing balances and charts, and syncing your preferences. We do not sell your data, show ads, or use your financial information for any purpose beyond running SpendFlow.
Data Sharing
We do not share your personal or financial data with third parties, except the infrastructure providers listed above that are required to operate the service.
Security
Access to your data requires authentication, traffic is encrypted with HTTPS, and records are scoped to your account. No method of transmission or storage is 100% secure, but we take reasonable measures to protect your information.
Data Retention & Deletion
Your data is retained while your account is active. You can delete individual transactions, accounts and categories at any time inside the app. To delete your account and all associated data, contact us using the button below.
Children's Privacy
SpendFlow is not directed to children under 13 and we do not knowingly collect data from them.
Changes to This Policy
We may update this policy from time to time. Material changes are logged below with the version and date they took effect.
Contact
Questions about this policy or requests to delete your data:
Policy version 1.0 — last updated 2026-07-14