Skip to content

Privacy Policy

Last updated: 2026-10-10

Controller

Mihai Stana Ionescu, tax ID 03236201D, Ana Frank, 20, Valdemoro Madrid Spain. For any privacy matter: [email protected].

What data we process

  • Account: name, e-mail, language, currency, preferences and password (stored only as a hash; we never see it).
  • Financial data you enter: names and balances of your accounts, expected incomes and expenses, payments you mark, due days, categories and savings goals. We do not connect to your banks.
  • Bank statements you import: the date, amount and description of each movement are stored on your account, so you can see them and match them to your bills. The uploaded file itself is deleted once read.
  • Payments: if you subscribe to Pro, Stripe processes your card details. We only receive a customer identifier, the subscription status and invoices; never your card number.
  • Gifts: if you give Pro, Stripe processes the payment and we keep your e-mail and name, the amount, the recipient's e-mail and your optional message, and which account the gift went to. We use the recipient's e-mail only to tell them about the gift and to add it to their account: we create no account for them.
  • Invitations: your invitation code and, if you signed up with someone's link, who invited you and whether the invitation earned its month of Pro. The person who invited you is only told that a friend set up Xpenses, not who. To stop invitations to oneself we compare a keyed hash of the network address you sign up from with the inviter's recent ones (stored as a hash, never the address, and deleted with the days you used Xpenses).
  • Shared wallets: the e-mail of the person you invite, which member created each record in the wallet, and a history of who added, paid, edited or deleted what, which the wallet's members can see.
  • Technical data: IP address, server logs and technical session cookies. If you add our widget, the name of that device and when its widget last read your data. If you allow notifications in our app, a notification token for that phone, sent through Google's Firebase Cloud Messaging (and Apple's push service on iPhone).
  • Imported files: a file you upload to import your bills is only read to find them, and deleted after the import or within a day if you leave it unfinished.
  • Visit statistics: on our public pages (not inside the app) we count which pages are visited, the site or search engine you came from, the language and the type of device, without cookies and without storing your IP address: a visitor is a code that changes every day, so nobody can be followed from one day to the next. Kept 400 days. When you sign up, we also keep on your account the source and the first page of that visit.
  • Days you use Xpenses: when you are signed in, we note the dates on which you open the app (only the date), to count how many people use it. Kept 400 days.
  • Partner offers: some public pages show offers from partners, marked as advertising. When you click one, we count the click with the offer and the page it was on, nothing about you, and send you to the partner, whose own privacy policy applies from then on. Kept 400 days.
  • Analytics: only if you accept it in the cookie banner.
  • Face ID or fingerprint lock (apps, Pro): checked by your phone. We never receive or store biometric data.

Why, and on what legal basis

  • Providing the Service, managing your subscription and sending service e-mails (reminders, warnings, the Monday weekly summary, the monthly money date of shared wallets, monthly report, the month of Pro an invitation earns, invitations, two getting-started tips in your first days): performance of the contract. You can turn reminders, the weekly summary and the report off in Settings, and the tips off from their own e-mail.
  • Security, abuse prevention and backups, and the cookieless visit statistics: legitimate interest.
  • Invoicing and accounting and tax obligations: legal obligation.
  • Measuring website usage with Google Analytics: consent, which you can withdraw at any time.

We do not sell your data or use it for third-party advertising. We make no automated decisions with legal effects on you.

Who we share it with

Only with providers that process it on our behalf under contract:

  • Hosting of the Service: Contabo GmbH.
  • Stripe (payments and invoicing).
  • Mailgun (sending e-mails).
  • Google (Analytics, only with your consent; Firebase Cloud Messaging, for notifications in the apps; sign-in with Google, if you choose it, which gives us your name, e-mail address and Google account id).
  • Statsdot (visit statistics on the website and the web app, not in the native apps: page, referring site, country, device and actions such as signing up or subscribing; no cookies, no IP address stored, nobody followed across days or sites).
  • bunny.net (website fonts; receives your IP address when the page loads).
  • Apple and Google, if you use our apps from their stores.

Some of these providers may process data outside the European Economic Area (for example in the United States). Such transfers rely on a European Commission adequacy decision (such as the EU-US Data Privacy Framework) or on standard contractual clauses.

People you share a wallet with see that wallet's data.

AI assistants (ChatGPT, Claude)

You can connect Xpenses to an AI assistant such as ChatGPT (OpenAI) or Claude (Anthropic) and ask it about your numbers. This only happens if you connect it yourself and approve access on our consent screen.

  • What the assistant can read: only the wallet you have open, and only to answer your questions: the month-end forecast per account, what you can spend a day until payday, upcoming bills (name, amount, due date) and a month's totals by category. Access is read-only unless you switch on "Allow changes" for an assistant in Settings > AI assistants: it can then also mark your bills as paid and add bills, which the assistant asks you to confirm first. It can never delete anything, nor see your e-mail address, password or payment details.
  • What we store: the assistant's registration (its name and the address it returns to after sign-in) and the access tokens we issue to it. An access token lasts one hour and is renewed with a refresh token valid for 90 days. We do not receive or store your conversations with the assistant.
  • Who processes the answers: the figures you ask for are sent to the assistant's provider, which processes them, together with your conversation, under its own terms and privacy policy as an independent controller. Both may process data outside the European Economic Area.
  • Legal basis: performance of the contract, at your request.
  • How to stop: disconnect the assistant at any time in Settings > AI assistants; its tokens are revoked at once. Deleting your account deletes them too.

How long we keep it

For as long as you have an account. If you delete it, we immediately delete your account and the data of your wallets; backups are overwritten within 30 days. We keep invoices for the periods the law requires. Wallet invitations expire after 7 days, and the wallet history is deleted after 12 months.

Your rights

You can access, rectify, erase, object to, restrict and port your data by writing to [email protected]. Much of it you can do yourself: edit your data and delete your account in Settings, and download all your data as an Excel file with "Export data", free on every plan. If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or your local supervisory authority.

Children

The Service is not intended for children under 16.

Security

We explain how we protect your data on the security page.

Changes

If we change this policy materially, we will tell you by e-mail or in the app.