This policy explains what personal data SpendMind collects when you use the SpendMind apps for iPhone and Android, the web app at app.spendmind.io and this website, why we use it, who helps us process it, and how you exercise your rights. A short, plain-language version is on our page What we store, in plain words.
1. Who is responsible for your data
The data controller is West Side Software, Inc., a Delaware corporation, 131 Continental Dr, Suite 305, Newark, DE 19713, United States (“SpendMind”, “we”).
For any question about your data or to exercise your rights, write to [email protected].
2. What we collect, and when
You use the app without an account
On the free plan without an account, your expenses, income, budgets, categories, savings and settings are stored on your phone only. We don’t receive them. If you delete the app, they are gone unless you exported them first.
You create an account
- Account data: email address, username, display name and profile picture if you add one, language, currency and app preferences.
- Sign-in data: handled by our authentication provider (see section 5). Your password is never stored by SpendMind.
You use Premium features that need our servers
Sync between devices, shared spaces and the web app work by storing your data on our servers:
- Your records: expenses and income (amount, date, category, payment method, shop, tags, notes, custom fields), recurring entries, budgets, categories, savings pockets, debts and investments, and the receipt photos you attach.
- Shared spaces: the spaces you belong to, your role in each one, invitations, and which member recorded or changed each entry.
- Subscription status: whether you have Premium, a trial or a free plan, and when it ends. Payments are handled by Apple or Google: we never receive your card details.
Receipt scan (Premium)
When you scan a receipt, the photo is sent to read its text and fill in the amount, date, shop, currency, lines and a suggested category. The photo is then kept with the expense. We also record each scan attempt (date, result, the account it counts against) to apply the monthly allowance and to detect abuse.
Monthly insights (Premium)
Insights are computed by our own rules from your figures. An AI model then writes the sentence from those computed figures (for example “Groceries: 18 % above your 3-month average”); it does not receive your individual entries.
Technical data
To keep the service running and secure, we process technical data: IP address, device type and operating system, app version, request logs and error reports. Error reports are configured not to collect personal data such as your IP address or email, and sign-in tokens and cookies are removed from them before they are sent.
What we never collect
We never ask for your bank login, and we don’t connect to your bank. We don’t sell your data and we don’t show advertising.
3. Why we use your data, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Provide the app, your account, sync, shared spaces and the web app | Performance of our contract with you |
| Receipt scan and monthly insights | Performance of our contract (Premium features you choose to use) |
| Manage your plan, trial and subscription status | Performance of our contract |
| Keep the service secure, prevent abuse, apply usage limits, fix errors | Our legitimate interest in running a reliable and secure service |
| Answer your messages | Our legitimate interest, or the contract if it concerns your account |
| Keep records required by law | Legal obligation |
4. Who can see your data
- You, and in a shared space, the other members of that space, according to their role. They see the space’s records and your username, never your email address or your personal space.
- Our service providers listed below, only to the extent needed to provide their service, under contracts that bind them to protect your data.
- Authorities, only when the law requires it.
5. Our service providers
| Provider | What it does for us | Where |
|---|---|---|
| Clerk | Sign-in and account security | United States |
| Neon | Database (your records and account) | European Union (Frankfurt) |
| Cloudflare | Storage of receipt photos and profile pictures; hosting of this website | Worldwide network |
| Railway | Hosting of the SpendMind API | European Union and United States |
| RevenueCat | Subscription status from the App Store and Google Play | United States |
| Mistral AI | Reading the text of scanned receipts | European Union (France) |
| Anthropic | Extracting the receipt fields from that text; writing the sentence of monthly insights | United States |
| Sentry | Error reports | European Union (Germany) |
| Grafana Labs | Technical monitoring (performance, logs) | United Kingdom |
Apple and Google process your payment when you subscribe, as independent controllers under their own privacy policies.
To show stock, fund and crypto prices, and exchange rates, we query market data providers (Finnhub, Financial Modeling Prep, EODHD, CoinGecko, ExchangeRate-API) with ticker symbols and currencies only. They receive no personal data.
Under their API terms, Mistral AI and Anthropic do not use the content we send them to train their models.
6. Transfers outside the European Union
Some providers are located in the United States or the United Kingdom. These transfers are covered by an adequacy decision (the United Kingdom, and US companies certified under the EU–US Data Privacy Framework) or by the European Commission’s Standard Contractual Clauses.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account and records | As long as your account exists |
| After you delete your account | Erased right away; backup copies are gone within 30 days. Entries you added to other people’s shared spaces stay there, with nothing that identifies you |
| Receipt scan attempts | As long as your account exists |
| Server logs and error reports | 6 months |
| Messages you send us | Up to 3 years after our last exchange |
Data on your phone stays there until you delete it or uninstall the app.
8. Your rights
You can, at any time:
- access your data and get a copy;
- take it with you: export everything from the app as JSON or CSV;
- correct it, directly in the app;
- delete it: delete entries in the app, or delete your account;
- object to processing based on our legitimate interest, or ask us to restrict it;
- set instructions for what happens to your data after your death.
Write to [email protected]. We answer within one month. If you think your rights are not respected, you can file a complaint with the French data protection authority, the CNIL (cnil.fr), or the authority of your country.
9. Security
Data travels encrypted (HTTPS) between the apps and our servers. Access to our systems is limited to what each person needs. On your phone, you can lock the app with a PIN. No system is perfectly secure: if a breach put your data at risk, we would inform you and the authorities as the law requires.
10. Children
SpendMind is not meant for children under 15 on their own. A teenager can use it with a parent’s permission, for example as a contributor in the family’s shared space.
11. This website
This website does not use advertising or tracking cookies. It stores two preferences in your browser (light or dark theme, and the currency you chose for prices). To show prices in your currency, it asks our server for the country of your connection, as seen by Cloudflare; this is not stored.
12. Changes
We may update this policy, for example when we add a feature or a provider. We will show the date of the latest version below, and tell you in the app before a change that affects you significantly takes effect.
Last updated: October 17, 2026.