Privacy Policy

Information you give us. To create an account we need only an email address and a password. We ask for no name, phone number, postal address, date of birth, or government identifier. Your password is stored only as a bcrypt hash and is never recoverable, by us or anyone else. You may also set contact preferences and enable two-factor authentication.

What you record in the app. Expenses, income, categories, tags, payment-method labels, notes, budgets, recurring subscriptions, investment accounts, contributions, valuations and savings goals. This is financial information and is treated as sensitive. Payment-method labels are names you choose (for example "Chequing"), and we store no card numbers, expiry dates, security codes, or banking credentials.

Collected automatically. Your IP address and browser user-agent, recorded with your active sessions and in our security audit log alongside sign-in and account events. These keep your account safe: they let you review your active sessions, let us detect suspicious sign-ins, and enforce rate limits. They are not used for analytics, advertising, profiling, or to determine your location. We run no geolocation of any kind.

From other people. The only information we ever receive about you from someone else is an email address supplied by an existing user when they invite you to a shared household. It is stored solely to deliver and manage that invitation. We obtain nothing from data brokers, public databases, marketing partners, or social platforms.

We process your information only to:

• create your account, sign you in, and keep it working;
• provide the service itself: recording, organising and analysing what you enter;
• enable shared households, where you choose to use them;
• send administrative messages: email verification, password resets, security alerts, and deletion notices;
• send the notifications you have switched on, such as budget alerts, subscription reminders and monthly summaries;
• answer your questions when you contact support;
• keep the service secure with rate limiting, abuse prevention, and the audit log;
• meet our legal obligations.

We do not profile you, make automated decisions with legal or similarly significant effects, or use your information for marketing. We send no promotional email; every message is either administrative or a notification you turned on and can turn off.

Under Canadian law (PIPEDA, and Quebec's Law 25 where it applies) we rely on your consent, given when you create an account and use the service. You may withdraw it at any time by deleting your account.

We may also process information without consent in the narrow cases the law allows, principally to investigate or prevent fraud and abuse, and to comply with a subpoena, warrant, court order, or other legal requirement.

Three service providers, and no one else:

• Resend delivers our email. It processes your email address and the content of the message.
• Hostinger hosts the servers and database.
• Browser push services (Google's for Chrome, Mozilla's for Firefox), only if you turn on push notifications. Notification content is encrypted end-to-end between our server and your browser, so the push service relays data it cannot read.

We may also disclose information if required by law, or in connection with a merger, sale or acquisition of the business.

We do not sell your personal information, and we do not share it for advertising.

We set four cookies, all strictly necessary: two keep you signed in, one protects against cross-site request forgery, and one carries you through the two-factor step. We use no analytics, advertising, or tracking cookies, no web beacons or pixels, and we permit no third party to place any tracking technology on the service. Because these four are strictly necessary, blocking them stops you being able to sign in.

We do not track you across other websites, so there is nothing for a "Do Not Track" browser signal to switch off.

Your information is kept while your account exists. Specifically:

• If you delete your account it is deactivated immediately and permanently erased after a 7-day grace period. During those 7 days you can restore it from a link we email you. After that it cannot be recovered. One deliberate exception is described in Shared households.
• Encrypted backups are kept for 30 days. Deleted data can therefore persist in a backup for up to 30 days after erasure, isolated from any further use, until that backup expires.
• If you never verify your email, the pending account is purged after 24 hours.
• Sessions expire after 30 minutes of inactivity, and 24 hours regardless.
• Expired tokens and aged audit-log entries are pruned automatically each day.

Passwords are hashed with bcrypt. Two-factor secrets are encrypted, and sensitive actions require re-verification. Traffic is encrypted in transit with TLS. Session cookies are host-locked and inaccessible to JavaScript. The application connects to the database with a least-privilege account, and our administrative console holds no permission to read your financial records at all. It can see only account-management information such as your email address, plan, and sign-in activity.

No system is perfectly secure, and we do not claim otherwise. If a breach ever affects your information, we will tell you.

Inspendia is for adults. You must be 18 or older to use it. We do not knowingly collect information from children, and we do not ask for anyone's age. We collect only an email address and a password. If you believe a child has created an account, contact us at support@inspendia.com and we will delete it.

You can access, correct, export and delete your information, and you do not need to ask us to do it. In your account settings you can export a complete archive of everything you have entered as JSON (or your transaction ledger as CSV, for spreadsheets), and delete your account outright. Both are available to every user, everywhere, on every plan, regardless of which privacy law applies to you.

You may also withdraw consent, object to processing, or ask us to restrict it, by emailing support@inspendia.com. If you do not have an account (for example if you received a household invitation you never accepted), email us and we will tell you what we hold and remove it.

A household is shared by design. If you create or join one, the other members can see your email address and every transaction, budget, expense split and settlement you add to it.

Your personal records stay private. Household data and personal data are held separately, and nothing in your own ledger is ever visible to household members. Only what you deliberately add to the household is shared.

If you invite someone, we email the address you provide and store it to manage the invitation. Unaccepted invitations expire.

What happens to household entries if you delete your account. Entries you added to a shared household stay in that household. They are no longer linked to you. Your email address is gone with your account, and the entry shows only "former member", but the amounts, dates and categories remain visible to the other members.

We do this because a household ledger is a shared record: the other members' balances, splits and settlements are calculated from it, and removing one person's entries would silently rewrite what everyone else is owed. If you want an entry gone, delete it from the household before you delete your account. Everything in your personal records is erased in full.

We will update this policy when the service changes. The date at the top always reflects the current version, and we will tell you directly about material changes.

Privacy Officer enquiries, questions about this policy, and requests about your information:

Inspendia is independently built and operated from Toronto, Ontario, Canada. Questions about your information reach the person named above directly.

Your information is stored on servers rented from Hostinger. Depending on the data-centre region, it may be held or processed outside Canada, where it can be subject to the laws of that country and accessible to its courts and authorities. Email us and we will tell you the current hosting region.