Privacy Policy
Last updated 2026-08-01
This policy explains what personal data expenie collects, why, where it is processed, and who processes it on our behalf. We keep expenie's data footprint deliberately small.
1. Who controls your data
expenie is operated by Umar Bashir, an individual based in India (the “Operator”, “we”, “us”), who is the data controller. For any privacy question or request, contact mail.umarbashir@gmail.com.
2. Data we collect
Everything you enter lives in a private workspace tied to your account. The full list:
| Category | What it includes | Source |
|---|---|---|
| Account & identity | Your name, email address, whether your email is verified, and an optional profile image. | You, at sign-up |
| Authentication | A hashed password (never stored in plain text). If you sign in with Google: the OAuth tokens and profile Google returns. | You / Google |
| Session & device | Session tokens and, for each session, your IP address and browser user-agent. | Captured automatically at sign-in |
| Billing | Your Dodo customer and subscription identifiers, plan interval, subscription status, and period dates. We do not store your card or bank details. | Dodo Payments / your subscription |
| Financial records (the ledger) | The accounts, categories, transactions (amount, date, note, payee), loans, budgets, and recurring rules you create. This is the sensitive core of expenie. | You, entered manually |
| AI capture (Pro, optional) | When you use Pro AI capture: the text or receipt image you submit for drafting, plus the short context we send so drafts can map to your workspace (for example currency and account/category labels). We do not store receipt images as a lasting gallery in v1; images are processed for the request and not kept as permanent ledger attachments. We may store usage counters (for example monthly use against a soft cap) without the raw image. | You, when you run AI capture |
| On-device preferences | Small settings stored in your browser (sidebar state, install-prompt dismissal). These stay on your device. | Your browser |
3. How we use your data
- to provide the service — store and display your ledger;
- to authenticate you and keep your account secure;
- to manage your Free/Pro plan, subscription, and billing;
- to send transactional email (password resets, welcome messages, and optional quiet-day reminders when you have not logged anything that day);
- if you use Pro AI capture, to send your capture input to our AI subprocessor so it can propose expense or income drafts you still review and confirm before anything is posted to your ledger;
- to understand aggregate, anonymous usage so we can improve expenie; and
- to meet legal, tax, and accounting obligations.
We do not sell your data, and we do not use it for advertising or share it with advertisers. AI capture drafts are never posted to your statement until you confirm them.
4. Cookies and local storage
expenie uses only what it needs to function. There are no advertising or cross-site tracking cookies, so no cookie-consent banner is required.
| Name | Type | Purpose |
|---|---|---|
| Session cookie | Essential cookie | Keeps you signed in. |
| sidebar_state | Functional cookie | Remembers whether the sidebar is open. |
| expenie-sidebar-collapsed | Local storage | Remembers the collapsed sidebar rail. |
| expenie-install-snoozed-until | Local storage | Remembers that you dismissed the install prompt. |
| expenie service-worker cache | Cache storage | Caches static assets (icons, offline page) for the installable app. No account or financial data is ever cached. |
5. Analytics
We use Vercel Web Analytics to measure aggregate traffic (such as page views). It is privacy-friendly and cookieless — it sets no cookies and does not build a cross-site profile or identify you personally.
6. Who processes your data (subprocessors)
We rely on a small set of trusted providers to run expenie. Each receives only what its function requires:
| Provider | Role | Data it handles |
|---|---|---|
| Neon | Database hosting | Stores your account and ledger data at rest. |
| Vercel | Application hosting & analytics | Processes app requests; provides cookieless web analytics. |
| Dodo Payments | Subscription billing | Your name, email, and account identifier; holds your payment/card details directly (we never receive them). |
| Resend | Transactional email | Your email address and name, to deliver messages such as password resets, welcome emails, and quiet-day reminders. |
| Optional sign-in (if you choose it) | Your Google profile (email, name, image) when you sign in with Google. | |
| OpenAI | AI capture (Pro only, when you use it) | Processes the text and/or receipt image you submit for AI capture, plus limited workspace context needed to propose drafts (for example currency and account/category labels). OpenAI does not receive your password, full ledger export, or other users' data. We configure the integration to minimize retention of prompts where the API allows (for example preferring not to store inputs for model training/improvement when that option is available). OpenAI's own privacy policy and data-processing terms apply to processing on its systems. |
Free users who never use AI capture do not send capture content to OpenAI. Manual entry never requires OpenAI.
7. Where your data is processed
Our database and hosting run in the United States (Neon and Vercel, US East region), and our other providers may process data in the United States or elsewhere (including OpenAI when you use Pro AI capture). If you are in India or another country, your data is transferred to and processed outside your country under appropriate safeguards. By using expenie you understand this transfer is necessary to provide the service.
8. Payment data
Subscription payments are handled entirely by Dodo Payments. expenie never sees or stores your card number or bank details — we keep only the identifiers and status needed to manage your subscription.
9. How long we keep it, and deletion
We keep your data for as long as your account exists. You can delete your account at any time from Settings; doing so permanently removes your workspace — every account, category, transaction, loan, budget, recurring rule, and your login records — from our database.
Some data necessarily survives account deletion: emails already delivered remain with our email provider, and billing and tax records are retained by Dodo Payments as required by law. Capture content already processed by OpenAI is subject to OpenAI's retention practices for that processing. These are outside our direct control once created.
10. Your rights
You can access and correct most of your data directly in the app, and you can delete your account yourself. For any other request — a copy of your data, a correction you cannot make yourself, or a question about how we handle it — email mail.umarbashir@gmail.com and we will respond within a reasonable time.
11. Security
Passwords are stored hashed, connections are encrypted in transit, and access to production data is limited. No system is perfectly secure, but we take reasonable measures to protect your information and keep our data footprint small.
12. Children
expenie is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a minor has created an account, contact us and we will remove it.
13. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you.
14. Contact
For any privacy question or request, contact mail.umarbashir@gmail.com. See also our Terms & Conditions.