Legal

Privacy Policy

SpendMe (“we,” “us,” or “our”) is operated by OdysseyDevelopments LLC, a Florida limited liability company. This policy explains what information we collect, how we use it, and the choices you have when you use www.spendme.org and the SpendMe iOS app. Effective date: October 21, 2026.

Overview

We try to collect only what we need to run SpendMe. We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not track you across other companies’ apps and websites. SpendMe has no advertising SDKs and does not use your device’s advertising identifier.

Information we collect

Website and waitlist. If you join the waitlist, we collect your email address so we can send launch updates. We may use Brevo to manage contacts and email. Our hosting provider (Vercel) may process standard server logs (IP address, browser type, pages visited) for security and performance. We use Vercel Web Analytics and Speed Insights on this site to measure page views, performance, and aggregated waitlist conversion events (no email addresses are sent to Vercel Analytics).

Account data (app). When you create an account, we store information such as your email address, profile name, subscription tier, appearance preferences, and marketing choices. Product-update email from the app is off by default; we record when you turn it on, and you can turn it off in Settings. Sign-in may be provided through Supabase Auth using Google, email, or Apple where enabled.

Finance data (app). You may enter categories, transactions, bills, paycheck schedules, planned events, Plan2Buy items, safety net settings, and related budgeting data. This data is stored in your SpendMe account so the app can show your budgets and plans.

Photos and receipts (app). If you scan a receipt or choose a photo for a Plan2Buy item, the image is stored in private cloud storage with your account so it syncs across your devices. Receipt text is read on your device using Apple’s text recognition, and you review it before anything is saved. The camera or photo library is accessed only after you choose to scan a receipt or select an image. SpendMe does not automatically search external services for Plan2Buy product prices or images. You enter each goal’s target amount and may optionally choose its photo.

Merchant logos (app). To show a logo next to a merchant in your transactions, the app looks up that merchant’s website domain (for example “example.com”) from a public icon service, DuckDuckGo or Google, and keeps the icon on your device. Only the merchant’s domain is requested, never your name, account, or amounts, but those services will see your device’s IP address and the domain. Logos are cached on your device, so each domain is requested once.

Welcome questions (app). The short questions at setup (such as your goals) are saved on your device to build a starting plan. With “Help Ask learn” on (the default), the multiple-choice option you picked, never text you typed, is included in usage analytics linked to your account when you are signed in. Turn this off in Settings → Ask.

Bank linking (optional). See Bank account linking (Plaid) below for how we handle linked accounts.

Ask, the AI money coach (app). When you ask a question, typed or spoken, it is sent with a summary of your numbers to generate an answer. See Ask and the AI money coach below. Do not include passwords, account numbers, or government IDs in questions.

Product analytics. We collect first-party usage events (such as which screens and features are used, your app version, and platform) to understand how features are used. Events are tied to your account when you are signed in, or to a random identifier stored on your device when you are not. We design analytics to avoid sending account balances or other highly sensitive finance details. Product analytics events linked to your account, and subscription event records from our subscription provider (RevenueCat), are deleted when you delete your account.

Support and bug reports. If you send a bug report from the app, we receive what you write (the issue, what you were doing, and steps to reproduce) and your account email so we can reply. Please do not include passwords or account numbers. Reports are delivered to our team by email through Resend. Feedback sent through the website form reaches the same support inbox.

Security and operations. Our servers handle IP addresses for rate limiting and security, and keep request and error identifiers, app version, and timestamps in operational logs. We do not currently apply one fixed retention period to every log.

Device permissions. The app asks for the camera (receipt scanning), photo library, microphone and speech recognition (voice Ask), and notifications (local reminders for bills, budgets, goals, and subscriptions) only for those features. Face ID app lock uses the iOS result; SpendMe never receives your biometric data. The app does not use your location.

Apple Watch and Home Screen widget. The Apple Watch app shows your numbers and can ask Ask a question; it follows the same Ask permission you chose on iPhone. The Home Screen widget shows the SpendMe brain and opens Ask. It does not show financial data.

Bank account linking (Plaid)

Bank linking is optional. Free includes one linked bank and Pro includes unlimited banks, each with the supported accounts and cards you select. If you choose to, you may link one or more bank accounts through Plaid, a third-party service. When you connect an account, Plaid collects your bank credentials in a secure flow controlled by Plaid. SpendMe does not receive or store your bank login password.

With your permission, Plaid provides us read-only transaction data (such as date, amount, and merchant description), account details, and cached balances so we can show them in your SpendMe ledger. Balances are cached and may lag behind your bank. We store a secure token on our servers to refresh transactions until you disconnect the bank or delete your account. While the app is open it requests a refresh about once an hour, and our servers also refresh linked banks in the background when Plaid notifies us of new activity or a connection has not synced in about an hour. We do not use Plaid to initiate payments, ACH transfers, or other money movement in the current app. Plaid's use of your data is also described in Plaid's end-user privacy policy.

If your Pro access ends, banks beyond the Free limit stop updating and keep their last saved balances. They are scheduled for removal at a date shown in the app (in your local time), and you can resume Pro before then to keep them; at removal we use the same cleanup described below.

You can disconnect a linked bank at any time in the app under Settings → Bank imports. When you disconnect, we first call Plaid to remove the Item. If Plaid cannot be reached, the connection stays visible with imports paused so you can retry, and we never discard an access token we have not revoked. Once Plaid confirms, we delete the access token and connection records, the transactions imported from that bank, linked cards, and unconfirmed bill reminders detected from it. Transactions you entered yourself and your budgets remain, and confirmed bill history is kept.

For privacy questions or requests, contact spendmeapp@outlook.com.

Ask and the AI money coach

Ask is SpendMe’s AI money coach. It is not a licensed financial, investment, tax, or legal advisor, and its answers are estimates based on the numbers in your app. See our Disclaimer.

• Your permission first. The first time you ask, SpendMe asks whether you want the full AI coach. Nothing is sent to an AI provider unless you allow it. If you decline, Ask answers from your device only. You can change this any time in Settings → Ask.
• What is sent to answer you. Your question, the last few turns of the conversation, a summary of your finances (such as available-to-spend, bills due, safety net, card balances, and income), and a short memory summary that can include excerpts of your recent questions. This goes to our server functions (Supabase) and then to an AI provider (Google Gemini or OpenAI) to generate the reply.
• What we keep. We do not save the text of your questions or answers on our servers. We keep a daily count of Ask messages to apply plan limits. AI providers process requests under their API terms and may retain request data for a limited period; we have not verified every provider’s retention or training terms, so please do not include sensitive details in questions.
• Voice. If you talk to Ask, Apple’s speech recognition turns your speech into text. Apple may process that audio under its own privacy policy. SpendMe does not record or store audio. Answers can be read aloud on your device.
• Memory. Ask remembers your recent questions on your device, so its suggestions and answers fit you. With cloud Ask allowed, excerpts of that memory can be sent as context with a question. Clear it any time in Settings → Ask, or by deleting your account.
• How Ask learns. “Help Ask learn” is on by default. While it is on, usage analytics include the topic of the question (for example “budgets” or “can I afford it”), the outcome, and whether you typed or spoke, linked to your account when you are signed in. They never include your words, amounts, merchants, or account details. We do not use your financial data to train AI models, and it is not pooled with other people’s. You can turn this off in Settings → Ask.
• Changes you approve. When Ask offers to add a bill, paycheck, expense, or similar, nothing is saved until you confirm.

How we use information

• Provide, maintain, and improve SpendMe
• Authenticate you and keep your data tied to your account
• Import and display bank transactions when you link an account
• Process subscriptions and one-time purchases through Apple (App Store), verify them with Apple, and recognize purchases and founding-member access
• Send product updates you signed up for (you can opt out)
• Respond to support and security reports
• Comply with law and enforce our terms

What we do not do

• We do not sell your personal data
• We do not email you balances or private finance details as marketing
• We do not share Plaid access tokens with third parties other than Plaid and our own backend services

How we protect data

We use industry-standard practices appropriate for a small engineering team, including encrypted connections (HTTPS), hosted authentication and database services (Supabase), and row-level access controls so each signed-in user can access only their own data. Sign-in sessions and tokens are kept in the iOS Keychain on your device only and are not included in device backups or transfers. Plaid access tokens are stored on our servers, not in the mobile app, and are not exposed to other users. API keys and vendor secrets are kept out of our public source repository and stored in secure environment configuration.

No method of transmission or storage is completely secure. If you believe your account has been compromised, contact us immediately.

Third-party services

We rely on service providers that process data on our behalf:

• Supabase: authentication, database, and server functions
• Plaid: bank linking and transaction import (when you connect a bank)
• Apple: App Store, Sign in with Apple, and in-app purchases. We send Apple-signed purchase records to our servers, which check them with Apple, so Pro access reflects a genuine, current purchase
• Google: sign-in, and Gemini AI to answer Ask questions on our servers
• OpenAI: AI to answer Ask questions on our servers (depending on plan and availability)
• Apple speech and text recognition: turns spoken Ask questions and receipt photos into text on your device or Apple’s servers
• DuckDuckGo and Google: public website-icon lookup for merchant logos (merchant domain only)
• RevenueCat: subscription, lifetime purchase, and purchase records
• Brevo: waitlist and email (website)
• Resend: transactional and product-update email, and delivery of in-app bug reports to our team
• Vercel: website hosting

Each provider has its own privacy policy. Plaid's use of your data is also described in Plaid's end-user privacy policy.

Your consent

We obtain your consent before collecting and using personal data in the ways described here. Creating an account and using SpendMe implies consent to process data needed to run the service. Connecting a bank through Plaid Link is optional and requires a separate, affirmative action in the app. Product-update emails from the app are off by default and require your affirmative choice in Settings, and waitlist updates require an explicit signup on the website. Either can be withdrawn at any time. This privacy policy is available in the SpendMe app (Settings and subscription screens) and at this URL before and during bank linking.

Your choices

• Marketing email: off by default; turn Product updates on or off in Settings, unsubscribe from any message, or contact us
• Bank connections: disconnect linked banks in app settings; we revoke the Plaid item and remove the connection data and transactions imported from that bank
• Account deletion: delete your account in the app (we revoke every linked bank at Plaid first; if Plaid cannot be reached, nothing is deleted so you can retry) or follow our Account & data deletion instructions to remove your cloud profile and finance data, including bank link data
• Ask: turn off “Help Ask learn,” turn off reading answers aloud, or clear Ask’s memory in Settings → Ask
• Sign out: ends your session on the device

Depending on where you live, you may have additional rights to access, correct, or delete personal information. Contact us and we will respond within a reasonable time.

Data retention and your rights

OdysseyDevelopments LLC maintains a defined data retention and disposal program for SpendMe. We keep information only as long as needed for the purposes in this policy, then delete or anonymize it. This program is reviewed at least once per year and after material product or vendor changes (such as new bank-linking features).

Retention periods.

• Active account data: profile, finance entries, budgets, and linked-bank data are retained while your account is active and you use the service.
• Plan2Buy photos and receipts: images you choose are kept with the goal or expense, can be removed by editing or deleting it, and are deleted with your account data when you delete your account.
• Plaid-linked data: access tokens, connection records, and imported transactions are retained while the bank remains connected and are removed when you disconnect it or delete your account, as described in the Plaid section above.
• Analytics and subscription records: product analytics events and subscription event records (including those from RevenueCat) tied to your account are deleted when you delete your account. If you signed in with Apple, we also revoke the Sign in with Apple connection.
• Waitlist and marketing: email addresses are kept until you unsubscribe, ask us to delete them, or they are removed during list cleanup.
• Support and security: correspondence and incident records may be kept longer when needed to resolve issues, protect the service, or meet legal obligations.
• Server and backup copies: hosting and database providers may retain short-lived backups. We rely on their automatic expiry and do not use backups to restore deleted user data except where required for disaster recovery with continued protection of that data.

Disposal. When data is no longer required, we delete it from production systems using application flows (account deletion, bank disconnect, unsubscribe) and database deletion. Plaid Items are revoked through Plaid's API when you disconnect or when we process account deletion, and deletion is not completed until revocation succeeds. We do not sell or repurpose disposed data.

Legal holds. We may retain specific information longer when required by law, regulation, litigation, or enforceable government request. When a hold ends, data is deleted according to this policy.

Consumer requests. You may request access, correction, or deletion of personal information by contacting spendmeapp@outlook.com. We verify requests to protect your account and respond within a reasonable time (and within 45 days where a state law sets that deadline), consistent with applicable privacy laws in the United States and Canada.

Florida residents

If you reside in Florida, we handle your personal information in accordance with applicable Florida law, including the Florida Information Protection Act (FIPA) regarding security of personal information and breach notification when required. We do not sell your personal information. If a statute such as the Florida Digital Bill of Rights applies to our processing of your data, you may contact us to exercise rights provided by that law.

You may submit privacy requests (access, correction, deletion) to spendmeapp@outlook.com. We verify requests to protect your account. Florida consumers with concerns about our practices may also contact the Florida Attorney General's office for general consumer information.

Other U.S. state privacy rights

Depending on where you live, you may have rights to know, access, correct, delete, or opt out of certain processing (such as targeted advertising or sales of personal data). We do not sell personal information or share it for targeted advertising, so there is nothing to opt out of, and we treat browser opt-out signals such as Global Privacy Control accordingly. To exercise rights that apply to you, email spendmeapp@outlook.com. You may also appeal a decision about your request by replying to our response. We will not discriminate against you for exercising privacy rights permitted by law.

Categories we collect. In the past 12 months we collected: identifiers (email, name, account and device-level random IDs); financial information you enter or import (transactions, balances, bills); commercial information (subscription and purchase status); user content (notes, receipts, photos you choose); usage data (product analytics); and approximate network information (IP address in server logs). We collect these directly from you, from Plaid at your direction, and from Apple and RevenueCat for purchases. We use them for the purposes listed in “How we use information” and disclose them only to the service providers listed above.

Canada

SpendMe can be used in Canada, and bank linking supports Canadian institutions. By using SpendMe you consent to your information being transferred to and processed in the United States and where our vendors operate. Under Canadian privacy law (such as PIPEDA, and Quebec’s Law 25 where it applies) you may ask to access or correct your personal information, withdraw consent, or ask how it is handled by contacting spendmeapp@outlook.com. You may also contact the Office of the Privacy Commissioner of Canada.

Children

SpendMe is for adults 18 and older (see our Terms) and is not directed at children. We do not knowingly collect personal information from anyone under 18. Contact us if you believe a child has provided us data.

International users

SpendMe is offered in the United States and Canada. If you use the service from another country, your information may be processed in the United States or where our vendors operate.

Security contact

Report security or privacy concerns to spendmeapp@outlook.com. We aim to acknowledge serious reports within three business days.

Changes to this policy

We may update this privacy policy from time to time. When we do, we will post the revised policy on this page and update the effective date. Continued use of SpendMe after changes means you accept the updated policy.

Contact

OdysseyDevelopments LLC
Questions about this policy: spendmeapp@outlook.com