Spendwell

Your information

Privacy Policy

How Spendwell handles your information.

Last updated

The essentials

Spendwell uses your information to run your account and budgeting tools. Wallet information is shared with that wallet’s members according to their access. There is no advertising or analytics tracking configured.

1. Who is responsible

Spendwell is operated by Guido Pili, an individual based in Italy and responsible for the personal information handled by this service (the data controller where that term applies).

For privacy questions or requests, email contact@spendwell.dev. This policy covers the Spendwell application; third-party services have their own privacy policies.

2. Information we handle

  • Account information: your Google sign-in identifier, verified email address, name and, when supplied by Google, profile-image URL. We also keep account creation and last sign-in times. We do not receive your Google password.
  • Budgeting content: the information you or other wallet members enter, such as transactions, amounts, dates, descriptions, categories, wallet entities (for example, people, vehicles or homes), budgets, subscriptions, accruals, deadlines, funds, transfers, schedules, comments and change histories.
  • Shared-wallet information: wallet names, memberships, roles, preferences and invitations, including an invited person’s email address when the inviter provides one.
  • Security and service information: sign-in sessions, temporary sign-in state and hashed session and shortcut-key tokens. Hosting and delivery providers receive network and request information, such as IP addresses and browser information, when serving requests. Operational logs may contain error and execution details.

Do not enter bank passwords, payment-card security codes or unnecessary sensitive information in descriptions or comments. Spendwell records the budgeting information you enter; it does not connect to your bank account.

3. Why we use your information

We use this information to authenticate you, provide and maintain your budgeting tools, calculate and display wallet activity, apply scheduled records, manage invitations and sharing, protect the service, investigate errors and respond to your requests.

Where a legal basis is required, providing your account and requested features relies on performing our service agreement with you. Security, troubleshooting and managing invitations rely on our legitimate interests in operating a safe, reliable shared-budgeting service, balanced against your rights. We may also process information where required by law.

We do not sell your personal information, run advertising or use your financial records for advertising. No analytics or advertising tracking is configured. Necessary cookies and browser storage are described in the Cookie Policy.

4. Sharing and service providers

Other wallet members. A shared wallet is not private to you alone. Members can see wallet content and member information, including names, email addresses and roles, as permitted by their access. Owners manage membership; owners and editors can change financial records. Only share information you are entitled to share, and treat invitation links and shortcut keys as confidential.

The service also uses these providers:

  • Amazon Web Services (AWS): application hosting, database and operational infrastructure. The primary application and database region is Frankfurt, Germany (eu-central-1). AWS Privacy Notice.
  • Google: account authentication and, when available, delivery of your profile image to your browser. Google receives requests when you sign in or your profile image loads. Google Privacy Policy.
  • UNPKG: delivery of the htmx JavaScript library used by the interface. Your browser contacts this external content-delivery service when it loads the library, including on public pages. This exposes normal request information to that service; it is not an analytics integration. About UNPKG.

These third-party services may process information outside your country, including outside the European Economic Area. Hosting the primary database in Frankfurt does not mean all third-party processing stays in the EU. Contact us with questions about international processing.

Information may also be disclosed if required by applicable law or a valid legal request, or where necessary to address fraud, abuse or a security incident.

5. Security

Spendwell uses HTTPS in production, protected sign-in sessions, hashed session and shortcut-key tokens, and wallet-based access controls. No internet service can guarantee absolute security. Keep your Google account, devices, invitation links and shortcut keys secure, and revoke a shortcut key if you believe it has been exposed.

6. Retention and deletion

Account and wallet content generally stays in the live service until you or someone with the appropriate permissions deletes it. We do not automatically delete financial content just because an account is inactive. Temporary security information, including sign-in sessions, has separate expiry periods. Archiving, pausing or cancelling a record can preserve its past activity and history; those actions are not the same as deletion.

You can delete your account from Account. Account deletion removes your sign-in identity, profile, sessions, shortcut keys and memberships. Any wallet where you are the only owner is also deleted, even if it has other members. Make another member an owner first if you want that wallet to remain.

Wallets that have another owner remain, along with their shared financial records and comments. Direct authorship links to your deleted account are cleared, but text and other information entered by you or other people may still identify you. Invitations created by others may also contain your email address. Contact us if you need additional information removed from retained shared content.

Logs and backups

Log and backup retention and deletion schedules are not yet finalised. If personal information is present in infrastructure logs, recovery copies or backups, deletion from the live application does not necessarily remove those copies at the same time. We are not currently promising a fixed deletion deadline for those copies. Contact us for current details.

7. Your choices and rights

You can review your account, edit budgeting records according to your role, leave shared wallets, revoke shortcut keys and delete your account using the application. To request access to, a copy of, correction of or deletion of personal information beyond those controls, email contact@spendwell.dev. We may need to verify your identity before acting on a request.

Depending on applicable law, you may also have rights to restrict processing, object to processing based on legitimate interests, receive portable data, or complain to a relevant data-protection authority. These rights depend on your circumstances and may have legal limits. If you contact us about information belonging to someone else in a shared wallet, we must also respect their rights.

You can lodge a complaint with Italy’s Garante per la protezione dei dati personali, or another competent data-protection authority. You do not have to contact us before lodging a complaint.

8. Changes to this policy

We will update this page when our practices change. The date at the top identifies the latest revision. We will provide any additional notice required by applicable law.

Questions? Contact contact@spendwell.dev.