The Short Version
Your data is yours. Messages between you and your connections are end-to-end encrypted — we relay them, but we cannot read them. Your financial data, calendar, documents, and personal content live on your device, not our servers.
We do see some data in order to operate the service: your email address, who you connect with, and the routing metadata needed to deliver messages. This policy explains exactly what we store, what we can observe, what we can't, and why.
We store only what is necessary to operate the service. Here is the complete list:
This is equally important. Our servers never store, receive, or process:
All messages between users are end-to-end encrypted using well-established public-key cryptography. At launch, this uses X25519 key exchange with XSalsa20-Poly1305 authenticated encryption. We may update the specific algorithms over time to adopt stronger standards, but we will always use end-to-end encryption where only the sender and recipient can read the message.
What this means in practice:
For group communication: Your device encrypts the message separately for each recipient. Our server sees individual messages to individual recipients — it has no concept of groups.
For shared photos (moments): Photos are encrypted with a random key on your device. The encrypted photo is uploaded to our server. The decryption key is sent to each recipient through the encrypted message channel. Compromising our photo storage alone does not expose your photos (no key), and compromising the message channel alone does not expose photos (no photo data).
Our server has its own user identity in the system, with its own encryption keypair. This is the only way our server can read any message content — when you explicitly send a message addressed to the server.
Achievement reporting (default: on): When you earn an achievement, your device encrypts an achievement event and sends it to the server. We decrypt it because it's addressed to us. This contains only the achievement ID and the time it was earned — no personal content. You can turn this off in Preferences at any time, and your device will simply stop sending.
Superlative reporting (default: on): When you record a superlative, anonymizable metadata (category, frequency) may be sent to the server. You can turn this off in Preferences.
When you address a message to us, you know you're doing it. We never request, pull, or silently collect data from your device.
You can choose to share specific categories of data with our server. Each category is an independent toggle in Preferences, and all default to OFF.
| Category | What you send us | What we do with it |
|---|---|---|
| Zip code | Your 5-digit zip code | We look up your statistical area and send you a package of public Census/BLS data for local peer comparisons. We do not track your location. |
| Household size | A number | Combined with zip code to refine your peer comparison data |
| Review completion | That you completed a review (type only) | Aggregate engagement analytics |
| Goal progress | Active and completed goal counts only | Aggregate engagement analytics |
We never receive your actual financial figures, goal details, review content, or any other personal data through these opt-ins. The comparison math ("your housing is 32% of income, your area's median is 28%") happens entirely on your device.
Your opt-in preferences are stored on your device, not our server. If you reinstall the app, all opt-ins reset to OFF.
We serve pre-cached packages of public statistical data from the U.S. Census Bureau and Bureau of Labor Statistics. This is public government data, not derived from our users. We fetch it on an annual schedule when new data vintages are published and cache it on our server.
We use this data to provide you with local and demographic peer comparisons. The comparison calculations happen on your device — we send you the public statistics, and your device does the math using your private financial data that we never see.
If you link with a partner, both of you share financial summaries, review status, and profile updates through the same encrypted message channel used for all other communication. We relay these messages but cannot read them.
What we know about your partnership:
What we do not know:
We can observe that messages are being exchanged between partner accounts (see Section 7), but we cannot see what those messages contain.
In operating the service, we necessarily observe certain metadata. We believe in being explicit about this.
We want to be honest: even without reading message content, metadata can reveal patterns. A burst of messages to the same 15 recipients suggests a group. Frequent exchanges between two users suggest an active relationship. A message to the server user followed by a response suggests an opt-in data exchange. We are aware of this and may implement metadata-reduction measures (message padding, batched sends) in the future, but these are not in place today.
Our server logs record request paths, HTTP status codes, response times, and error information for operational purposes. Logs may include IP addresses. Logs never include passwords, authentication tokens, message content, encryption keys, or decrypted server-user message content. Logs are retained for a limited period for operational troubleshooting and then deleted.
If you subscribe through the iOS App Store, Apple processes your payment. We receive only a transaction ID to verify your subscription status. Apple's privacy policy governs their handling of your payment information.
If you subscribe through our website, Paddle acts as our Merchant of Record. Paddle processes your payment, collects applicable taxes, and handles refunds. We receive only a subscription ID and customer ID. We do not receive or store your payment card details, billing address, or tax information. Paddle's privacy policy governs their handling of your payment information.
We fetch publicly available statistical data from U.S. government APIs. No user data is sent to these agencies.
We do not use any advertising networks, analytics services, or other third-party services that receive your personal data. If we add any operational third-party services in the future (such as error monitoring), we will update this policy and those services will not receive message content or encryption keys.
| Data | Retention |
|---|---|
| Account information | Until you delete your account |
| Encrypted messages | Until you acknowledge receipt, or expiry (whichever is first) |
| Encrypted photo blobs | Until all recipients acknowledge, or expiry (whichever is first) |
| Subscription records | Until you delete your account |
| Engagement events | Until you delete your account |
| Refresh tokens | Until expiry, logout, or account deletion |
| Connection/partner records | Until you delete your account |
You can delete your account at any time from within the app. When you do:
We may retain a hashed version of your email address for a limited period after deletion to prevent abuse. This hash cannot be used to recover your email address or any other data.
Data on your device is not affected by account deletion. Your on-device data (calendar, documents, financial records, reviews, etc.) remains on your device. The app handles on-device data export separately.
You can export all server-held data associated with your account at any time. This includes your profile information, subscription history, public key history, connection history, and partner link history. It does not include message content (messages are encrypted and transient — they're deleted after you receive them).
Spendplan is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us and we will delete the account.
If we receive a valid legal request (subpoena, court order, or similar), here is what we can and cannot provide:
We can provide:
We cannot provide, because we do not possess it:
We will notify affected users of legal requests unless prohibited by law (e.g., a gag order). If we are ever compelled to make structural changes that would weaken our privacy protections, we will make reasonable efforts to notify users before those changes take effect.
We do not currently publish a transparency report. If we receive a meaningful volume of legal requests, we will begin publishing one.
The Company is based in the United States. If you are located in the European Economic Area (EEA), United Kingdom, or other jurisdictions with data protection laws:
Legal basis for processing: We process the limited personal data described in this policy on the basis of contractual necessity (operating the service you signed up for) and legitimate interest (preventing abuse, maintaining security).
Your rights: You have the right to access, correct, export, and delete your personal data. The App provides these capabilities directly — you can export your server-held data and delete your account at any time without contacting us.
Data transfers: Your data is processed on servers that may be located in the United States. By using the service, you acknowledge this transfer. We protect your data through end-to-end encryption (meaning we cannot access message content regardless of where servers are located) and through the security measures described in this policy.
Data minimization: Our architecture inherently minimizes data collection. We store only what is listed in Section 1, and most user content never reaches our servers.
If you have questions about your rights under GDPR or other data protection laws, contact us at contact@spendplan.co.
We believe privacy claims should be verifiable, not just promised. To that end:
If we make material changes to this policy, we will notify you through the app before the changes take effect. We will not retroactively reduce the privacy protections described here without your explicit consent.
The commitments in this policy regarding end-to-end encryption and our inability to access your message content are codified in our company's operating agreement and are binding on any future owners or acquirers of the company.
If you have questions about this privacy policy or your data:
Email: contact@spendplan.co
Spendplan LLC
8401 Mayland Dr Ste A, Richmond, VA 23294