Your money is your business.

The short version

• Xpense works without an account. Until you sign in, your data stays in your browser, on your device. We never receive it.
• If you sign in with Google, your Xpense data is saved to your account so it follows you across devices. It is encrypted in transit and at rest, and other people using Xpense can’t see it. It is not end-to-end encrypted: the service stores it in a form it can read, so that it can sync and calculate your figures. We don’t read it, sell it or use it for advertising.
• We don’t sell your data or show ads. You choose limited or full usage analytics; either way they never include your amounts, notes or names (see Analytics below).
• You can download everything, or delete your synced copy, at any time from the account menu.

What we collect

If you never sign in

Your entries, goals, budgets, shopping trips and settings are stored in your browser’s local storage on your device. They aren’t sent to us. Xpense does not add its own encryption to this copy: it is protected by your device’s own security (a screen lock and disk encryption), so anyone who can open your browser profile can read it. Clearing your browser data removes them, so download a backup if you want to keep a copy.

If you join the waitlist

We store the email address you give us and the date, only to decide who to invite and to let that person in. We don’t send marketing email. Ask us to delete it at any time.

If you sign in with Google

• Account details from Google: your name and email address, and your profile picture if Google provides one. We use them to sign you in and show who you are in the app. We never see your Google password.
• Your Xpense data: the entries, goals, budgets, bills, to-dos, shopping trips and settings you create, saved as one document linked to your account.
• Setup answers: the optional details you give when you first sign in (your name, currency, what you want from Xpense, income, pay day, usual bills and who you share costs with). They are used only to personalise the app, are all skippable, and you can change or remove them any time.
• Sync details: a version number and the time of the last save, used to keep your devices in step and avoid overwriting changes.

Cookies and similar storage

We use a sign-in session cookie so you stay signed in, and local storage in your browser for the app’s data and sync state. These are necessary for the app to work. We don’t use advertising cookies. Our usage analytics (see Analytics below) keep an anonymous id in your browser’s local storage.

Analytics

We measure how Xpense is used so we can keep it working and improve it. We use Mixpanel, who process this for us under our instructions, for that purpose only. You choose how much on the banner shown the first time you visit, and can change it any time in Preferences. Two levels:

• Limited: page views, errors, how fast pages load, whether syncing works, that the app was opened, and the sign-in and waitlist steps. No id is kept on your device, Mixpanel is asked not to locate you from your IP address, nothing is recorded, and nothing is linked to your account. This is the least we need to run the app, and it is a condition of using it (see our terms): inside the app it runs from the start, before you have chosen.
• Full: the above, plus which screens and features you use (that an entry was added, a bill paid, a goal created, a setting changed, or data exported, with rough sizes such as “1–5 entries”, never the entries themselves), an anonymous id kept in your browser’s local storage, your browser, device type and approximate location, and a link to an anonymous account id (not your email) while you are signed in. On our public pages (home, sign-in, privacy, terms) we may also record clicks, how far you scroll and recordings with all text and inputs hidden. We never record your screen inside the app.

At either level we never record amounts, notes, descriptions, category, goal, trip or store names, your email address or your name.

Your data is not misused or shared. We do not sell it, and we do not share it with advertisers, data brokers or anyone else for their own purposes. It is used only to run and improve Xpense, and the only provider that sees analytics is Mixpanel, acting for us.

Browser privacy signals. On our public pages a Global Privacy Control or Do Not Track signal means nothing is sent. Inside the app they limit you to the limited level, which is the minimum needed to use it.

Deleting it. Deleting your account stops it, and we ask Mixpanel to delete the analytics history tied to your anonymous id (Mixpanel can take up to 30 days to finish). If you want to check, or you only want the history deleted, ask us.

How we use it

• To run the app: show your data, keep it in sync and keep your account secure.
• To protect the service: limit abuse and fix errors.

We don’t use your financial data for advertising, profiling or sale to anyone. We don’t currently run AI on your data. If we add a feature that sends your files to an AI provider, we will update this policy and ask for your clear consent first.

Who handles it

We use a few providers to run Xpense. They process data only to provide their service to us:

• Google: sign-in.
• Neon: database and sign-in service. Synced data is stored in a Postgres database hosted on Amazon Web Services in the United States (US East, Ohio).
• Vercel: hosting of the website and app.
• Mixpanel and Microsoft Clarity: usage analytics and heatmaps, only if you agree.

We may disclose information if the law requires it.

Your choices

• Download your data: account menu, “Download my data”. You get a file with everything.
• Delete your synced copy: account menu, “Delete synced data”. This removes it from our database, except for one safety copy that we keep for 30 days in case you deleted it by mistake (we can restore it for you if you ask). The copy on your device stays until you clear it.
• Sign out and clear this device: removes the data from the browser you’re using.
• Delete your account: Preferences, “Delete my account”. This permanently removes your account, your synced data, your profile, your email choices and your place on any invite or waitlist. It can’t be undone, so download your data first.

How long we keep it

Your synced data is kept until you delete it or ask us to delete your account. While it is kept, we also keep short-lived safety copies of it so that a mistake or a bug can be undone: one copy a day for 14 days, and a copy taken just before a save that removes many entries or before you delete your synced data (kept for 30 days). Deleting your account removes these copies immediately. Backups made by our database provider may take a short time to age out after deletion.

Security

Data travels over encrypted connections (HTTPS), and our database provider encrypts stored data at rest. Through the app, your synced data can only be reached by your signed-in account, and requests are checked and rate limited.

To be clear about what that means: your data is not end-to-end encrypted. The people who run Xpense, and our database provider, could technically access the database. We don’t read your data, and we limit access to what is needed to run and secure the service. No system is perfectly secure, so keep your Google account protected and download occasional backups.

Children

Xpense isn’t designed for children under 13, and we don’t knowingly collect their information.

Terms

Using Xpense is also covered by our terms of use.

Changes to this policy

If we change what we collect or how we use it, we’ll update this page and the date above, and tell you in the app for significant changes.

Contact

Questions or requests? Write to support.credeer.com.