Privacy policy

Introduction

Expenselix is operated by Yassin Mohamed, based in the United Arab Emirates, who is the data controller for everything described here. This policy covers the app and the Expenselix website together.

Expenselix is offline-first. Your transactions, accounts and budgets are written to a database on your phone first, and if you never sign in they never leave it. Two things do leave by default — product analytics and crash reports — and you can switch them off in Settings › Personal data & privacy. This policy explains everything we handle and why.

Information we collect

Your account — your email address, your name if you give one, and a password hash, or the identifier Apple or Google returns if you sign in with them. Authentication is handled by Supabase.

Your money — transactions, accounts, transfers, categories, category groups, merchants, tags, budgets, recurring transactions, planned payments, templates, in-app notifications and any notes you write. Expenselix has no bank connection: it cannot read your accounts, cannot import statements, and never asks for banking credentials.

Receipts — when you photograph a receipt the text is read on the phone itself, by Apple's Vision framework on iOS or Google's ML Kit on Android, and on recent iPhones an on-device Apple language model pulls the fields out of it. The photo is not uploaded in order to scan it, and the extracted text is not sent to us. A screenshot of a bank alert is handled the same way — read as an image, on the device. Expenselix never reads your text messages: it does not ask for SMS permission and cannot open your inbox.

Analytics — which screens you open, which features you use, crash reports, your device model, OS version and app version. All of it is tied to your account ID, never to your name or email address.

We never send the contents of your transactions: no notes, no merchant names, no search terms and no receipt text. Amounts are the single exception, and only ever as a coarse band — an event may record that a transaction fell in the 50–200 range, never the figure itself.

Feedback — Contact developer in Settings opens our public feedback board, run by UserJot, where you can report bugs, request features, vote and comment. To sign you in, we send UserJot your account ID and your first and last name. Everything you post or comment there is public: anyone can read it, and your name is shown next to it — or "Member" if you haven't added a name to your account. We don't send UserJot your email address.

Exchange rates — when the app needs a rate it fetches a public rates file from jsDelivr, falling back to Cloudflare Pages. The request carries nothing about you or your account, but like any web request it exposes your IP address to whoever serves it.

How data is stored

Your data is stored on your device in SQLite and stays there by default. Once you sign in it is also synced to our servers so another device can catch up, and the app syncs in the background when connectivity returns.

Photos and PDFs you attach to a transaction are uploaded to storage scoped to your account, and so is any image you pick as a custom icon for an account, category or merchant. Nobody else can read them, and we do not open, scan or analyse them. Deleting an attachment in the app deletes the stored file.

If you add a home-screen widget, the figures it shows — balances, recent transactions, budget progress — are copied into a container shared with the widget, so the system can draw it without opening the app. That means they can appear on your home screen, and on your lock screen if your phone shows widgets there. Signing out clears it.

How long we keep data

Your data stays on your device until you delete it, or until you delete the app — removing the app removes the local database with it.

Whatever has been synced stays on our servers while your account is open, so another device can catch up. Deleting your account removes the account record and everything synced with it immediately, rather than queueing it for later.

Two things survive that. If you joined the waitlist on our website, that email address is held separately from your account and deleting the account does not remove it. And if you ever subscribed, RevenueCat keeps your account ID and purchase history — never your name or email — because the purchase itself stays with Apple or Google, and that record is what lets you restore it if you come back. Ask us and we will delete either.

Feedback you post stays on the board after you delete your account, because other people may have voted on it or commented. Deleting your account removes your name and account ID from UserJot, so what remains is no longer linked to you — but anything personal you wrote in the post itself stays unless you ask us to delete it.

Product analytics and crash reports follow the retention settings of our analytics provider and are tied to your account ID, not your name or email. You can switch them off at any time in Settings › Personal data & privacy, and you can ask us to delete them.

Backups held by Apple, Google or your own device backup are outside our control and follow their own retention rules.

Subscriptions and payments

Purchases are made through the App Store or Google Play, so we never see your card details. Apple and Google tell RevenueCat, our subscription infrastructure, that a purchase happened, and RevenueCat tells the app whether your subscription is active. What we keep there is your subscription status and its renewal date.

Before you sign in those sit against an anonymous purchaser record. Once you sign in, that record is keyed to your account ID — the same identifier used for sync — so from then on it is no longer anonymous.

The website

The Expenselix website is a set of static pages. It sets no advertising cookies, runs no analytics and does not track you across sites. It saves your theme choice on your own device so the page looks the way you left it, and your language is simply part of the address of the page you are on.

One thing does leave the page: if you join the waitlist, your email address, the platform you picked (iOS or Android) and the language you were reading in are sent to our servers, so we can tell you when the app is available on your device. Telling you that is the only thing we use it for, we do not sell it, and any email we send you about it will carry a one-click way off the list. You can also ask us to remove you at any time.

Third-party services

Expenselix uses the following services:

•Supabase — authentication, database and file storage.

•Expenselix Cloud (hosted on Render) — account management, sync and the website waitlist.

•PostHog (EU-hosted) — product analytics and crash reporting.

•RevenueCat — subscription status.

•Resend — transactional email, such as one-time codes and account notices.

•UserJot — the public feedback board, for the bug reports, feature requests, votes and comments you choose to post.

•Apple and Google — sign-in, app distribution and payments.

•jsDelivr and Cloudflare Pages — the public exchange-rate file the app downloads. They receive no account information, only the request itself.

Each of these processes data on our instructions and for the purposes above. We do not use advertising or cross-app tracking, and we do not sell your data.

Data security

Authentication tokens are stored in platform-native secure storage — Keychain on iOS, EncryptedSharedPreferences on Android. The on-device database is not separately encrypted with a password of its own; it is protected by your phone's disk encryption and passcode, and you can add an app lock in Settings. The app lock is checked by the operating system: your face or fingerprint is never given to Expenselix and never leaves your phone. Everything that syncs travels over HTTPS and is stored behind row-level security, so one account cannot read another's rows. We never see your Apple or Google password.

Why we are allowed to process your data

If you are in the EU or UK, the law asks us to name a legal basis for each thing we do with your data.

•Running the app — your account, your synced data and your attachments are processed to perform the contract between us, because without them there is no service to give you.

•Subscriptions — processed to perform that same contract, and to keep the records the law requires of us.

•Analytics and crash reports — our legitimate interest in knowing the app works and where it breaks. You can switch them off at any time, and switching them off costs you no functionality.

•The waitlist — your consent, given when you typed your address in. You can withdraw it at any time.

•Feedback — our legitimate interest in fixing what you report and deciding what to build next. Nothing is sent unless you send it.

•Security and abuse prevention — our legitimate interest in keeping one account from reaching another's data.

Your rights

•Export — every transaction can be exported as CSV from Settings, including while the app is read-only.

•Delete — you can delete any transaction, account or category at any time.

•Delete your account — from Settings. The account record and everything synced are removed immediately, not queued for later. This does not cancel a subscription: cancel that with Apple or Google as well, or you will be charged again.

•Access and correction — ask us for a copy of your data or to have it corrected, and we will answer within 30 days.

•Portability — the export is a set of plain CSV files you can take anywhere; ask us if you want a fuller copy.

•Withdraw consent — turn analytics and crash reports off in Settings › Personal data & privacy, or ask us to take you off the waitlist.

•If you are in the EU or UK you can also object to processing and complain to your data protection authority.

Expenselix is not intended for children under 13, or under the higher age your country sets for agreeing to online services on your own, and we do not knowingly collect their data.

Changes to this policy

We may update this policy as the app changes. The date at the top always shows the current version, and if a change materially affects how we handle your data we will tell you in the app before it takes effect. Continuing to use Expenselix after a change means you accept the updated policy.

Contact us

If you have any questions about this policy or your data, contact us at support@expenselix.com.