SpendWhy — Privacy Policy

Last updated: 2026-06-24

SpendWhy ("the app", "we", "us") is a personal finance application operated by ZYNTHYR OÜ, a company registered in Estonia. This policy explains what data the app handles, why, where it is stored, and the choices you have.

If you have questions, contact us at privacy@spendwhy.com.

1. Summary

Your financial ledger (transactions, accounts, categories, receipt details) is stored in an encrypted database on your own device.
Receipt photos are scanned on your device (text recognition runs locally); the images are not uploaded to our servers.
We use a cloud backend (Supabase, hosted in the EU/Ireland) for your account sign-in and for the bank synchronisation feature only.
Bank synchronisation is optional and uses a regulated open-banking provider (Enable Banking) with your explicit consent. Access is read-only and you can revoke it at any time.
We do not sell your personal or financial data.

2. Data we collect and why

Account data. When you create an account we store your email address to authenticate you. Sign-in is handled by Supabase Auth.

Financial data you enter. Transactions, accounts, categories, budgets and notes you create are stored in an encrypted local database on your device.

Receipt images. If you scan a receipt, the photo is processed on your device using on-device text recognition (Google ML Kit) to extract amounts and text. The image itself is not transmitted to us.

Bank synchronisation data (optional). If you connect a bank, we use Enable Banking, a licensed PSD2 account-information service. With your consent, it provides read-only access to your account details and transaction history. We store, in our backend:

the bank connection metadata (which bank, consent status, an authorisation reference);
the mapping between a bank account and an account in your ledger;
transactions fetched from your bank, which are then synced into your device.

Device security data. If you enable the biometric app lock, it is handled by your device's secure hardware (via the operating system). Biometric data never leaves your device and is never sent to us.

Diagnostics (optional). The app may send anonymised crash reports (Sentry) and product-usage analytics (PostHog) to help us fix bugs and improve the app. These contain technical information (e.g. error traces, device model, app version), not your financial records. Where required, this is governed by your in-app/OS choices.

3. Where your data is stored

On your device: the financial ledger, in an encrypted SQLite database.
Supabase (EU — Ireland): your account email, bank-connection metadata, bank-account mappings, and bank transactions staged for synchronisation. Access is protected by row-level security so you can only access your own data.

4. Third parties we use

Provider	Purpose	Data
Enable Banking	Open-banking aggregator (PSD2)	Bank account & transaction data, with your consent
Supabase	Authentication & backend hosting (EU)	Account email, bank-sync data
Google ML Kit	On-device receipt text recognition	Runs locally; no data sent to us
Sentry (optional)	Crash reporting	Technical diagnostics
PostHog (optional, EU)	Product analytics	Anonymised usage events

We do not sell your data and do not share it for advertising.

5. Bank connections and consent

Connecting a bank is entirely optional. When you do:

you authenticate directly with your bank; we never see your bank credentials;
access is read-only (we cannot move money);
consent is time-limited under PSD2 and you can revoke it at any time, in the app or with your bank.

6. Data retention and deletion

Your local data stays on your device until you delete the app or the data. You can request deletion of your account and the data we hold in our backend by contacting privacy@spendwhy.com; we will delete it within 30 days, subject to any legal retention obligations.

7. Security

The on-device database is encrypted with a key held in your device's secure storage.
Backend access is protected by per-user row-level security.
An optional biometric/PIN app lock protects access to the app.

8. Your rights

Under the GDPR you can request access to, correction of, or deletion of your personal data, and you may object to or restrict certain processing. Contact privacy@spendwhy.com to exercise these rights. You may also lodge a complaint with your local data-protection authority.

9. Children

SpendWhy is not directed at children under 16 and we do not knowingly collect their data.

10. Changes to this policy

We may update this policy; the "Last updated" date above reflects the latest version. Material changes will be communicated in the app.

11. Contact

ZYNTHYR OÜ — privacy@spendwhy.com