Privacy Policy

Expense Tracker (“the app”) is an independently run, single-developer app for tracking personal income and expenses. This page explains what data the app collects, how it’s used, and how you can control it.

Data we collect

Account data. Your email address and password. Passwords are hashed (bcrypt) before storage — we never store or can see your plain-text password. We also store whether your email address has been verified, plus a hashed, single-use token for email verification or password reset while one is outstanding.

Guest accounts. If you choose “Try without an account”, we create an account with no email address and no password, tied only to a session cookie on your device. It holds the financial data you enter, and it is permanently deleted 30 days after it was created unless you add an email and password first. Without them it cannot be recovered if the cookie is lost.

Financial data you enter. Transaction amounts, descriptions, dates, categories, and recurring transaction rules that you add yourself. The app does not connect to bank accounts or cards, and does not import financial data automatically — everything comes from what you type in.

We don’t collect analytics, advertising identifiers, or any usage tracking beyond what’s needed to keep you signed in (a session cookie).

Sign-in attempt records. To limit brute-force and abuse, each login, signup, and verification-resend attempt is recorded with the email address entered and the IP address it came from. These records are deleted automatically after 24 hours.

How we use your data

Solely to provide the app’s core functionality: storing and displaying your transactions, categories, and the summaries and charts built from them. We do not use your data for advertising, and we do not sell or share it with third parties for their own purposes.

Where your data is stored

Your data is stored in a Postgres database hosted by Supabase, and the app itself is hosted on Vercel. Transactional emails (such as email verification) are sent through Resend, and encrypted database backups are stored with Cloudflare R2. These providers process data on our behalf as infrastructure providers, under their own security and privacy practices — we don’t share your data with them for any other purpose.

Security

Data is transmitted over HTTPS. Passwords are hashed with bcrypt before being stored. Sign-in sessions use signed, HTTP-only cookies. Every request for your data is scoped to your account, so other users of the app cannot see or access your transactions or categories.

Data retention and deletion

Your data is kept for as long as your account exists. In Settings you can export your data as CSV at any time, and “Start fresh” permanently deletes all your transactions and recurring rules. Deletions are permanent, not archived.

You can delete your account and all associated data yourself at any time in the app under Settings → Delete account (see how to delete your account). If you can’t log in, email us at maxtasy888@gmail.com. Account deletion removes everything from the live database.

Guest accounts are deleted automatically 30 days after creation.

Backups. The production database is backed up daily. Backups are encrypted before leaving our servers and the newest 30 are kept, so data you delete may remain in backups for up to about 30 days before being overwritten. Backups are only ever used to recover from data loss.

Children and teens

The app is intended for people aged 13 and over, including teenagers. It is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has given us personal data, email us and we will delete it.

Depending on where you live, you may need a parent’s or guardian’s permission to create an account, since the minimum age for this differs between countries. Teens can delete their account and data at any time, the same way as everyone else (see above).

Changes to this policy

If this policy changes, we’ll update the date at the top of this page.

Contact

Questions about this policy or your data? Email maxtasy888@gmail.com.