Privacy policy

Effective

This policy explains what information Expenda collects, why, and the choices you have. It covers the Expenda apps for Android, iOS and desktop, and the website at expenda.io.

Who we are

Expenda is operated by IGOR BEZRUCHKO PR BEOGRAD, a sole proprietorship registered at Čika-Ljubina 12, stan 3, Beograd, Serbia, with registration number 68526205 and tax ID 115650152. We are the controller of the personal information described here. Send questions and requests to us at support@expenda.io.

What we collect

Your account

To create an account you give us your email address. You can add a display name and a profile photo. You sign in with a password, a one-time code sent to your email, or your Google account. If you choose Google, Google shares your name, email address and profile picture with us.

Your financial records

Expenda stores the records you create: wallets and their balances, transactions, categories, planned payments, subscriptions, budgets and your settings. They are saved on your device and synchronised with our servers, so you can use more than one device and recover your data if a device is lost.

Expenda does not connect to your bank and cannot move money. Everything in your ledger is something you entered or imported.

Attachments

You can attach photos and documents, such as receipts, to a transaction. They are uploaded to our cloud storage and kept with the transaction.

Usage analytics

The Android and iOS apps send usage analytics to Google Firebase Analytics: which screens you open, and which sign-in method you used. Analytics never includes amounts, names, notes or anything else you type, and no account identifier is attached, so analytics cannot be linked to you. We do not collect advertising identifiers, and advertising features are turned off.

Analytics is on until you turn it off in More → Preferences → Share usage analytics. The choice is stored on each device. The desktop app sends no analytics.

Crash reports

When the Android or iOS app crashes or hits a serious error, it sends a report to Google Firebase Crashlytics. A report contains the app version, device model, operating system version, where in the code the error happened, and the app's recent diagnostic log lines. Those log lines are written to leave out personal information, and error messages from our own code are removed before sending. No account identifier is attached. Crash reports are not covered by the analytics setting. The desktop app sends no crash reports.

What stays on your device

Bank statements you import are read on your device. We receive the transactions you choose to keep, not the statement file. CSV exports and backups are created on your device and go only where you send them.

The camera is used only when you take a photo of a receipt or for your profile, and only after you allow it.

The website

expenda.io does not use cookies, analytics or advertising. Our servers keep standard request logs, such as IP address, browser type and the page requested, to keep the site secure and working.

How we use your information

We use your information to:

  • provide Expenda and keep your data in sync across your devices;
  • sign you in and keep your account secure;
  • answer your questions and requests;
  • understand which features are used and fix crashes and errors.

We do not sell your information, use it for advertising, or build profiles about you.

We process personal information under Serbia's Law on Personal Data Protection and, for people in the European Economic Area or the United Kingdom, the GDPR. We rely on these legal bases:

  • Contract for your account, financial records and attachments, which we need to provide the service you signed up for.
  • Legitimate interests for usage analytics, crash reports and security logs, which help us keep Expenda reliable. You can object to analytics at any time with the setting above.
  • Consent for camera access, which you can withdraw in your device settings.

Who we share it with

We use service providers who process information on our behalf and only on our instructions:

  • Google provides Firebase Analytics, Firebase Crashlytics and Google sign-in.
  • Cloud hosting and storage providers run our servers and store your records and attachments.

We may also disclose information when the law requires it, or to protect the rights and safety of our users and the service. If Expenda is sold or merged, your information may transfer to the new operator, who must keep this policy's promises.

International transfers

Our providers may process information outside your country. Where the law requires it, we rely on safeguards such as the European Commission's standard contractual clauses.

How long we keep it

We keep your account, records and attachments while your account exists. Items you delete go to the trash and are removed for good when you purge them. When you delete your account, we delete your information from our servers within 30 days, unless the law requires us to keep something longer.

Analytics and crash reports are not linked to your account and are deleted by Google on its own schedule.

Your rights and choices

You can ask to access, correct, export or delete your information, and to restrict or object to how we use it. You can also complain to Serbia's Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs) or to the data protection authority where you live.

Children

Expenda is not meant for children under 16, and we do not knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.

Security

Data is encrypted in transit. Access to our systems is limited to the people who need it to run the service. No system is perfectly secure, so please use a strong password and keep your devices locked.

Changes to this policy

When we change this policy we update the effective date at the top. If a change is significant, we tell you in the app or by email before it takes effect.

Contact

Email support@expenda.io, or write to IGOR BEZRUCHKO PR BEOGRAD at the address Čika-Ljubina 12, stan 3, Beograd, Serbia.