Privacy policy

What SpentStory does

SpentStory is a personal expense tracker. You upload a bank statement PDF from your own device. We extract debit transactions, categorise them, and show charts and totals. We do not connect to your bank account.

Bank statement PDFs

Statement files are processed in memory and deleted immediately after extraction. We do not keep copies of your PDFs. Extracted transactions (date, description, amount, category) are stored in your account until you delete them or delete your account.

Account data

Sign-in is handled by Supabase Auth (email/password or Google). We store your email, display preferences, currency, and expense data in our application database. Session cookies are host-only and HttpOnly — tokens are not stored in browser local storage.

Email

We send transactional email for account verification, password reset, welcome messages, and security alerts (for example, when someone tries to sign up with your email).

Payments

Paid subscriptions are not available yet. When they launch, they will be processed by Safepay. Card and wallet details are collected on Safepay's checkout pages; we do not store full payment card numbers on our servers. We store your plan tier, subscription status, and billing references needed to provide the service.

Analytics and cookies

The marketing site (spentstory.com) may load Cloudflare Web Analytics. That service is designed to be privacy-friendly and does not use cross-site tracking cookies. The app (app.spentstory.com) uses essential session cookies for sign-in and does not load third-party analytics scripts.

Deletion

You can delete individual statements or your entire account from Settings. Account deletion removes your profile and expenses. Some anonymised signup analytics may be retained for aggregate reporting.

To stop the free trial and upload limits being reset by deleting and re-creating an account, we keep a one-way fingerprint of your email address (not the address itself), the date you first signed up, and a record of recent uploads (date, outcome and processing cost, never their contents) after deletion.

Contact

Questions about this policy: [email protected].