Spendo Privacy Policy

Effective date: September 14, 2026 Last updated: October 6, 2026

Spendo helps you organize expenses, income, accounts, budgets, recurring transactions, and savings goals. This Privacy Policy explains what personal information we process, why we use it, who can receive it, and the choices available to you.

1. Who is responsible for your information

Spendo is operated by Ensight Tech, based at Potthofstraße 9, 58095 Hagen, Germany ("we", "us", or "our"). We are responsible for the personal information processed through Spendo.

Telephone: +49 1521 9569952
Website: ensight-tech.de

For privacy questions or requests, email admin@ensight-tech.de.

This policy applies to the Spendo app and our handling of related support requests. Services you independently use, such as Google sign-in or an app you choose to receive an export, also have their own privacy policies.

2. Information we process

Account information

When you create or use an account, we process your account identifier, email address, display name, and profile image or image URL, where available. Firebase Authentication handles sign-in credentials and authentication tokens. If you choose Google, Apple, or Microsoft sign-in, we receive the basic account information needed to sign you in; we do not receive your provider password.

Financial information you enter

We process the information you add or import, including transaction amounts, dates, income or expense types, merchant or product names, descriptions, categories, currencies, account names and balances, transfers, budget limits, savings goals, and recurring transaction schedules. Information entered in free-text fields becomes part of your transactions.

Spendo's financial accounts are transactions you maintain in the app. The current app does not connect to your bank to retrieve transactions or initiate bank payments. Please do not enter bank passwords, card security codes, or other unnecessary secrets in your transactions.

Receipt scanning

If you use receipt scanning, Spendo processes camera images, receipt images you select from your device, or supported PDF files you open or share with Spendo. Text extraction and recognition take place on your device, including Google ML Kit text recognition for supported images. Spendo does not upload the original receipt image or PDF to its cloud database as part of scanning. Extracted details are used to suggest transaction information and categories; review them before saving.

When you save a scanned transaction with a category selection, Spendo can retain recognized receipt text, a matching identifier, and the selected category and category profile to personalize later scans. These learned preferences are stored locally and are included in settings backup for Plus and Gold accounts. Saved transaction details are treated like other financial transactions. The original files and temporary working copies may remain in device storage managed by the app or operating system.

Household information

If you create or join a household, we process its name, invitation code, owner and member identifiers, member display names, shared monthly budget, shared income and expense transactions, and budget totals. Shared transactions can include amounts, dates, descriptions, categories, currencies, and the member who added them. Your email address may appear as your member name if your account has no display name.

Preferences, activity, and technical information

We process settings such as language, currency, appearance, home layout, notification preferences, and app-lock preference. We also transaction account activity timestamps to manage recurring transactions and inactivity notices.

Cloud notification delivery uses a device registration token, platform information, token update times, and notification transactions, including delivery or confirmation status. Our infrastructure providers may process IP addresses, service requests, device or installation identifiers, and technical logs to deliver, secure, and maintain their services.

Silent synchronization messages tell your other registered devices, or household members' devices, that transactions have changed. These messages contain account and, where relevant, household identifiers, but no transaction amounts, descriptions, or receipt images. We also process deleted transaction identifiers, deletion times, the account that performed a deletion, and a hashed source-device notification token to coordinate deletion across devices and avoid notifying the originating device.

Local plan enforcement stores per-account usage counters, reservation identifiers, action types, quantities and timestamps on the device. These counters track monthly transaction creation and receipt scans; cloud backup and shared household allowances are enforced using separate server-side usage records. Signing out does not reset local usage. Account deletion removes its local usage ledger as part of cleanup.

Free recurring reminders are scheduled locally through your device’s notification system. Their notification content can include the schedule name, amount, and currency. Scheduling and confirming these reminders do not send the schedule or confirmation to Firestore, Cloud Functions, or Firebase Cloud Messaging. Confirmation saves a transaction on the device; it may later be backed up if you enable an eligible paid plan. Local confirmation identifiers are retained to prevent the same occurrence being added twice, including after its transaction is deleted, and are removed when the app’s local account data is cleared. This local reminder flow does not disable the separate analytics and diagnostics described below.

Usage analytics and diagnostics

We use Google Analytics for Firebase to measure feature use and app navigation. Events can be associated with your account identifier and preferences such as your plan, currency, and theme. We use Sentry for error reports and performance diagnostics, which can include app and device information, stack traces, navigation events, and screenshots attached to some errors. Screenshots can contain information visible on screen; masking is configured for supported text capture. Feedback you choose to submit can include your message and an attached screenshot.

Support communications

If you contact us, we process your contact details, message, and any attachments you choose to send. Only include financial information necessary to explain your request.

3. How we use information

We use personal information to:

• Create and authenticate accounts and maintain signed-in sessions.
• Store, synchronize, display, and organize your financial transactions and preferences.
• Calculate balances, spending summaries, budgets, and progress toward goals.
• Run recurring transaction features and deliver reminders or account-related notices.
• Provide household budgets and membership features you choose to use.
• Support imports, exports, receipt scanning, and device widgets.
• Respond to support and privacy requests, prevent misuse, troubleshoot failures, and meet applicable legal obligations.

Spendo does not sell your personal information or use your financial transactions for targeted advertising. The current app does not integrate advertising networks or use your transactions to make lending, credit, or eligibility decisions.

4. Storage and service providers

Spendo stores transactions and preferences locally on your device. Signed-in accounts use Google Firebase for account and subscription information. Plus and Gold provide cloud backup of supported settings and personal financial transactions. Gold allows creation of one household; existing households can retain earlier Plus sponsorship. Invited members may join and use a household without their own paid plan, with shared allowances based on the owner’s eligible plan. Free accounts can recover previously backed-up settings and personal transactions together through the recovery offered after sign-in and plan verification, once for that sign-in. Recovery does not enable ongoing paid backup. Local caches support offline access; cloud data is not deleted merely because you uninstall the app.

We use Google Firebase for authentication, Cloud Firestore storage, Cloud Functions, Firebase Cloud Messaging, Remote Config, and App Check. App Check uses device or app attestation to protect backend access, including Google Play Integrity on Android and Apple DeviceCheck on Apple platforms. These services process the information necessary to provide account access, synchronization, scheduled actions, notifications, and app configuration. Apple or Google notification services may also process push notifications for your device.

Google Analytics for Firebase and Sentry also process the usage and diagnostic information described above. See Sentry’s privacy policy.

For information about Google's handling of service data, see Firebase Privacy and Security and Google's Privacy Policy.

5. When information is shared

We disclose information to service providers as needed to operate Spendo, and in the following circumstances:

• Households you join: other members can see shared household details, member names, budget information, shared income and expense transactions, and spending totals. Household reports use shared transactions; personal transactions remain separate. Treat invitation codes as private. Leaving a household or deleting your account does not necessarily remove historical contributions from its combined total.
• Exports and sharing you initiate: information you save, print, or share goes to the destination you choose. Those copies are outside Spendo's control.
• Legal and security needs: where required by law, or where legally permitted and necessary to protect people, investigate misuse, or establish or defend legal claims.
• A business transfer: if Spendo is involved in a merger, acquisition, or transfer of operations, relevant information may be transferred subject to applicable privacy requirements and notice where required.

6. Permissions and device privacy

Camera access is used for receipt scanning. File access or a system file picker is used when you choose receipt images or PDFs, import transactions, or export information. Notifications require the permissions applicable to your device. You can manage these permissions in device settings; declining an optional permission may prevent the associated feature from working.

If you enable app lock, your device's authentication system checks your fingerprint, face, or device credential. Spendo receives the authentication result, not your biometric template or device passcode.

Notifications and home-screen widgets may display financial information to someone who can see your device. You can manage notification previews and remove widgets through your device settings.

7. Retention and account deletion

We generally retain account information and financial transactions while your account exists and they are needed to provide the features you use. Inactivity alone does not delete your account: after more than three calendar months since the last activity received by the server, cloud recurring schedules may be disabled and their routine notifications stopped. Activity while offline cannot update the server until connectivity is available. A push notice and an in-app reminder may explain the change; schedules remain disabled until you enable them again.

Completed cloud notification-delivery records, ordinary notification inbox entries, and resolved cloud recurring confirmations are scheduled for deletion after 30 days. Entries still awaiting your confirmation are retained until resolved. Automatic expiry is asynchronous, so removal may occur after the retention period. Device notification tokens last updated more than 90 days ago are removed by periodic cleanup. This cleanup does not delete your financial transactions or saved receipt-matching preferences.

You can request account deletion in Profile → Edit Profile → Delete account. You will be asked to confirm and authenticate again. You can export your transactions before deletion.

Deleting an individual personal transaction first queues its deletion locally; the cloud copy is removed when deletion synchronization succeeds. Household deletion requires an online request by the transaction's author or household owner. Once processed, the server replaces the transaction's financial contents with a compact deletion marker containing its identifier, deletion time, deleting account identifier, and, for household transactions, original author identifier. These markers and local lists of deleted identifiers prevent an older device from uploading the same transaction again. They have no scheduled expiry and remain until the associated account or household data is deleted, or the relevant local app data is cleared. Separate batch deletion events, including deleted identifiers and the hashed source-device token, are scheduled for cleanup after 90 days; cleanup may occur later. Other devices apply deletions when they reconnect and process synchronization, rather than necessarily immediately.

Successful account deletion removes your Firebase sign-in account, your user document and its associated collections, and your household membership. Households with remaining members may continue under another owner, and combined historical totals may remain. A household with no remaining members is removed by the deletion flow.

If you cannot access the app, email admin@ensight-tech.de with the subject "Spendo account deletion" and the email address associated with your account. We may ask for information reasonably necessary to verify ownership. Never send your password.

Deleting an account does not erase files you exported, copies held by other people, or device backups outside our control. Local caches on other devices may remain until cleared. Limited technical transactions or backups, where maintained, may persist until their normal deletion cycle, or longer where required by law or necessary for a specific security incident or legal claim. Any retained information is limited to that purpose.

8. Security

We use authentication, access controls, and encrypted network connections to help protect information. Local app lock provides an additional access control where enabled. No storage or transmission method can guarantee absolute security. Keep your device and account credentials secure, particularly when using shared devices or exporting financial transactions.

9. Your privacy rights

Depending on the law that applies to you, you may have rights to access, correct, delete, or receive a portable copy of your personal information; object to or restrict certain processing; withdraw consent where processing relies on it; and complain to the relevant data protection authority.

You can edit supported information and export transactions in the app. For other requests, contact admin@ensight-tech.de. We respond within the period required by applicable law and may verify your identity first. Withdrawing consent does not affect processing that was lawful before withdrawal.

Where applicable law requires a legal basis, we process information as necessary to provide the service you request, for legitimate interests in maintaining and securing the service where permitted and balanced against your rights, to comply with legal obligations, or with consent where required. Optional device permission requests do not replace any separate consent required by law.

10. International processing

Our service providers may process information in countries other than your country of residence. Privacy laws may differ between countries. Where applicable law requires safeguards for international transfers, we use the applicable provider arrangements and legally required transfer mechanisms. Contact us for information about safeguards relevant to your data.

11. Children

Spendo is intended for a general audience managing personal finances and is not directed to children under 13. We do not knowingly collect personal information from children under 13, or below a higher age where applicable law requires parental authorization, without that authorization. If you believe a child has provided information contrary to this policy, contact us so we can investigate and take appropriate action.

12. Changes and contact

We may update this policy when our features, practices, or legal obligations change. We will update the date above and provide additional notice for material changes where required. Where a new use requires consent, we will obtain it before that use begins.

For questions, complaints, or privacy requests:

Ensight Tech
Potthofstraße 9
58095 Hagen
Germany
Telephone: +49 1521 9569952
Email: admin@ensight-tech.de
Website: ensight-tech.de