Privacy Policy
Expensaw ("we", "our", "us") · Last updated: 11 November 2026
This policy explains what personal data Expensaw collects, why, where it is kept, and the choices you have. It applies to the Expensaw app on Android and on the web (app.expensaw.com) and to this website.
1. Who we are
- Operator: Expensaw, operated by Abhishek Tanwar (an individual). He is the data fiduciary under India's Digital Personal Data Protection Act, 2023 and the controller under the EU/UK GDPR for the personal data described here.
- Contact for all privacy questions: contact@expensaw.com
- Grievance Officer and data protection contact: Abhishek Tanwar — contact@expensaw.com (see the grievance page)
2. What we collect
You give us
- Account: your email address and a password (stored only as a secure hash by our authentication provider), or your Google account email and name if you choose "Continue with Google". A display name is optional.
- Age check: when you create an account you confirm your year of birth. It stays on your device; our records keep only that you meet the minimum age for your country, not the year.
- Your money records: expenses, income, budgets, goals, bills, subscriptions, accounts and transfers, investments, commitments and notes that you enter.
- Receipt photos: stored on your device. If you use receipt scanning, the photo is sent once to be read and is not stored by us.
- Voice: if you use voice entry, the recording is sent once to be transcribed and is not stored by us.
- Questions to the AI: if you switch on AI insights, the question you ask and the figures needed to answer it.
- Messages you send us by email.
Collected automatically — only if you allow it
- Crash reports (only if you allow them — at sign-up they follow the "Usage analytics" switch, and the Privacy Center gives them their own switch): technical details of the error and your device and app version. No money records.
- Usage analytics (when "usage analytics" is on): which screens are used, with a random identifier. Never your email, name, amounts or what you bought.
We do not collect bank or card numbers, banking passwords, your SMS messages, your contacts or your precise location. We do not sell your data and we do not show advertising.
3. Why we use it — and your consent
| Purpose | When it happens | Legal basis |
|---|---|---|
| Run the app on your device and keep your account | always (required to use the app) | DPDP: consent for the service · GDPR: contract |
| Cloud backup and sync across your devices | only if you switch it on | your consent |
| AI insights (Ask AI, AI reports, smart categories) | only if you switch it on | your consent |
| Usage analytics | only if you switch it on | your consent |
| Crash reports | only if you allow them (with usage analytics at sign-up, or their own switch in Privacy Center) | your consent |
| Product emails (monthly, unsubscribe in one tap) | only if you switch it on | your consent |
| Account emails (confirm sign-up, reset password) | when you ask for them | needed to provide the service |
Every optional purpose is off until you switch it on, and you can switch it off at any time in Profile → Privacy Center. Switching off takes effect immediately.
4. Where your data is kept
| Data | Where |
|---|---|
| Your records on the phone app | on your device first |
| Your records in the web app | in your browser's local storage on that device |
| Cloud backup and your account (if switched on / signed in) | our database provider Supabase, data centre in Tokyo, Japan — encrypted in transit and at rest, and locked to your own account |
| AI questions | sent through our own server to Anthropic (USA) to produce the answer |
| Voice recordings | sent through our own server to Deepgram (USA) for transcription, with the option to use them for model training switched off |
| Receipt photos (when scanned) | sent through our own server to Anthropic (USA) to read the receipt |
| Crash reports | Sentry |
| Usage analytics | PostHog (EU data centre) |
| Account emails | sent from our mailbox, hosted by GoDaddy |
| The website and the web app | served by Cloudflare |
| Purchases (Android app) | Google Play, with RevenueCat keeping track of your Premium status |
| "Continue with Google" |
Your name is never sent to the AI. The AI providers process your request under their commercial terms, which do not allow them to use it to train their models.
5. How long we keep it
- While your account exists, we keep your records so the app works.
- When you delete your account (Profile → Privacy Center → Delete my account), your account and all your records in our database are deleted at once, and the app removes your personal data from that device. Copies in our providers' backups expire within 30 days.
- Crash reports and analytics are kept by those providers for a limited period, typically up to 90 days.
- Emails you send us are kept as long as needed to answer you.
- Records of purchases are kept by Google Play and RevenueCat under their own legal obligations.
6. Your rights
From Profile → Privacy Center you can:
- See and export all your data as one file.
- Correct anything by editing it.
- Delete your account and data yourself, in two steps.
- Withdraw consent for any optional purpose with one switch.
By email (contact@expensaw.com) you can also ask us to explain how we use your data, nominate a person to exercise your rights if you die or become unable to (India), or raise a complaint. We reply within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India, your EU/UK data protection authority, or the authority where you live. Residents of California: we do not sell or share personal information.
7. Children
Expensaw is for adults and older teenagers who may legally agree to data processing on their own: the minimum age depends on your country (for example 18 in India, 16 in much of the EU, 13 in the USA and UK). The app asks your year of birth before an account is created and does not let younger people sign up. If you believe a child has given us data, write to contact@expensaw.com and we will delete it.
8. Security
Connections are encrypted (HTTPS/TLS), stored data is encrypted at rest, database rules allow each account to read only its own records, and the keys to our AI and voice providers are held only on our server — never in the app. On the phone you can add a PIN or fingerprint/face lock. If a personal-data breach happens, we will inform the Data Protection Board of India and affected users as the law requires.
9. International transfers
Our database is in Japan, which the European Commission recognises as giving adequate protection. Some providers are in the USA; we use them under their data-processing terms and only for the purposes above. India's DPDP Act allows these transfers.
10. Cookies and similar storage
The website uses no cookies and no trackers. The web app stores your sign-in and settings in your browser's local storage so it works; it uses no advertising cookies.
11. Changes to this policy
If we change this policy in a way that matters, we will tell you in the app or by email before the change applies. The latest version is always at https://www.expensaw.com/privacy.
12. Contact
Privacy questions, requests and complaints: contact@expensaw.com (Grievance Officer: Abhishek Tanwar).