Privacy Policy

Spentto is built to help you understand your spending — not to profit from your data. This policy explains what we collect, why we collect it, and how we protect it.

1. Information We Collect

We collect only what is necessary to provide the service:

• Account information — email address and password (hashed, never plain text)
• Receipt images — photos or files you upload for scanning
• Expense data — items, amounts, categories, and dates you save
• Spending groups — group names and members you create
• Usage data — pages visited, actions taken, and error logs (no personal identifiers attached)

We do not collect payment card numbers, bank credentials, or financial account access. Spentto reads receipts after the fact — it does not connect to your bank.

2. How We Use Your Information

• To process receipt images using AI and extract expense line items
• To display your spending history and monthly analytics
• To authenticate your account and keep it secure
• To send transactional emails (account verification, password reset)
• To improve the accuracy of our receipt scanning models

We do not sell, rent, or share your data with third parties for advertising.

3. Receipt Images and AI Processing

When you upload a receipt, the image is sent to our AI provider for text extraction. Raw images are deleted after processing is complete — only the extracted structured data (items, prices, dates) is stored in your account.

Extracted data is not used to train external AI models without your explicit consent.

4. Google Sheets Integration

If you connect Google Sheets, Spentto requests permission to create and update a spreadsheet in your Google Drive. This access is used only to sync your expense records to that spreadsheet. We do not read other files in your Drive.

You can disconnect Google Sheets from the Settings page at any time. We do not use your Google account data for advertising.

5. Data Storage and Security

Your data is stored on servers provided by Supabase in secure, access-controlled data centers. We use TLS encryption in transit and encryption at rest. Passwords are hashed and are never recoverable by us.

6. Cookies and Analytics

Spentto uses Google Analytics to understand how visitors use the site (page views, session duration, referral source). This data is aggregated and does not identify individual users. We use session cookies for authentication only — no advertising cookies are set.

7. Your Rights

You have the right to:

• Access all personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and all associated data
• Export your expense data in a portable format

To exercise any of these rights, email us at info@spentto.com. We will respond within 7 business days.

8. Data Retention

We retain your data for as long as your account is active. If you delete your account, all personal data and expense records are permanently deleted within 30 days.

9. Changes to This Policy

If we make material changes to this policy, we will notify you by email or with an in-app notice at least 14 days before the changes take effect.

10. Contact

Questions about this policy? info@spentto.com