Privacy Policy

The data controller is the person who operates Spend X Save — an individual based in Malaysia. Write to spendxsave.support@gmail.com about anything to do with your data: access, correction, deletion, or a question about this policy.

• •Account details: your email address and an encrypted password, handled by our authentication provider.
• •The financial records you create: accounts (name, type, currency), transactions (date, amount, currency, direction, note, category), and investment valuations.
• •Your preferences: selected display currency and default date range, stored in your browser.
• •Product events: which of four steps happened — signing up, creating a first account, reaching a Free plan limit, or pressing an upgrade button — recorded against your account with no amounts, notes or account names.
• •Landing analytics on the public pages: page views, scroll depth, visible time and button presses, with a random visit id kept in your browser tab. No cookie and no fingerprint, and we do not store your IP address with these events; the id is linked to your account only if that visit signs up.
• •Subscription records if you pay: plan, status, renewal date and the payment provider’s customer identifier.

We do not collect your bank login details or connect to your bank. If you import a statement file, the rows in it become transactions; the file itself is not kept.

• •To provide the service — storing and displaying your records, and computing totals and charts.
• •To authenticate you and keep your records separate from everyone else’s, enforced at the database level.
• •To manage your subscription and support requests.
• •To see where people stop in signing up and starting to use the app, so that step can be made easier. These are counts of four steps, never your financial records, and they are not used for advertising or profiling.
• •To understand where visitors stop on the public pages, so the page and the sign-up flow can be made clearer. This is aggregate behaviour, not your financial records.
• •To send service messages such as a password reset, or an optional monthly summary you can unsubscribe from.

We do not use your financial data for advertising, profiling, or automated decisions affecting you.

• •We do not sell your data.
• •We do not share your financial records with advertisers or data brokers.
• •We do not show third-party ads in the app.
• •We do not use third-party analytics or advertising trackers.

• •Supabase — database, authentication and file storage. Records are isolated per user with row-level security.
• •Vercel — application hosting and serving requests.
• •The payment provider you check out with — receives your email and billing details, never your financial records.
• •An email delivery provider — sends password resets, reminders and optional summaries.

These providers process data on our instructions. Some operate outside Malaysia and Singapore, so your data may be transferred internationally, protected by contractual and security measures.

We may also disclose data where the law requires it, or to establish or defend legal claims.

Your records are kept while your account exists. When you delete your account, your accounts, transactions, valuations and subscription record are deleted with it. Billing records may be retained longer where tax or accounting rules require it.

• •Access and portability — export everything as CSV or JSON from Settings, at any time.
• •Deletion — delete your account and all associated records yourself from Settings.
• •Correction — edit or delete any record in the app, or ask us to correct something.
• •Objection and restriction — contact us and we will explain what we can do.
• •Withdrawal of consent — unsubscribe from optional emails at any time without losing access.

These rights exist under the Malaysian Personal Data Protection Act 2010 (as amended) and the Singapore Personal Data Protection Act 2012. If you are not satisfied with our answer, you may complain to the data protection authority for your country — these are the regulators’ own sites:

• •Jabatan Perlindungan Data Peribadi (Personal Data Protection Department) (Malaysia) — https://www.pdp.gov.my/
• •Personal Data Protection Commission (Singapore) — https://www.pdpc.gov.sg/

We use essential cookies to keep you signed in, and browser local storage for interface preferences such as your display currency and date range. We do not use advertising or cross-site tracking cookies. The product events described in section 2 are written by our own server, not by a script in your browser, so they set no cookie and are not shared with anyone.

The public-page analytics use a random id in your browser’s sessionStorage, not a cookie. It is created when the tab opens and gone when the tab closes, it is not shared across sites, and Do Not Track or Global Privacy Control turns the measurement off entirely.

Data is encrypted in transit and at rest. Every record is scoped to your user id and enforced by database row-level security, so another user cannot read your records even if they guess an identifier. No system is perfectly secure; if a breach affects you we will notify you and the relevant authority as required by law.

The service is not intended for children, and we do not knowingly collect their data.

We may update this policy. Material changes will be announced in the app or by email before they take effect.

Privacy questions or requests: spendxsave.support@gmail.com.