Privacy Policy

At a glance

What	How Spenti handles it
Receipts, images, amounts, dates	Processed on your device and stored locally (unless you turn on Your own AI, below), with backups as described below. Never sent to Spenti by the app.
Cloud sync (Basic and Pro, optional)	Off by default. If you turn it on, your Spenti data is stored in your own iCloud (iOS) or Google Drive (Android) account, under Apple's or Google's terms — we never receive it.
Your own AI (Pro, optional)	Off by default. If you connect your own OpenAI (ChatGPT), Anthropic (Claude), Google Gemini, OpenRouter or OpenAI-compatible account, the text read from each receipt you scan and your chat questions (with the totals needed to answer them) go straight from your phone to that provider, under your own account. Never the photos, never your bank messages, never through Spenti.
Bank messages and Apple Pay payments	The bank SMS and bank-app alerts you choose (through Android notification access, or an iOS Shortcuts automation you set up), and on iOS the Apple Pay payments a Shortcuts automation you set up passes on, are read on your device only and never sent anywhere — even with Your own AI on.
Account / sign-in	Not required. Spenti has no user accounts and no login.
Advertising and tracking	None. The app contains no advertising, analytics or tracking SDKs.
In-app purchases	Handled by Apple and Google. We receive only your purchase and entitlement status.
Website forms	Only what you type into the support or feature-request form — your message or request, plus any name or email you add — stored by our processor (Cloudflare) so we can reply.
Web fonts	None shared. The Website's typefaces are served from spenti.app itself, so loading a page makes no request to Google Fonts or any other font host.
Selling your data	Never. We do not sell or share personal data for advertising.

01Who we are

Spenti (“Spenti”, “we”, “us”, “our”, the “Provider”) is a personal expense-tracking app for iOS. For any privacy question, or to exercise your rights, contact privacy@spenti.app.

This policy covers both the Spenti mobile app (the “App”) and the website at spenti.app (the “Website”). Where the two differ, we say so.

02The Spenti app: on-device by design

No account, no Spenti servers

You do not create an account, sign in, or give us an email to use the App. Everything Spenti does with your receipts — capturing an image, reading it with OCR and AI, and saving the merchant, amount, date and category — happens locally on your phone, unless you turn on Your own AI (Pro), and is stored in a database on the device. With Your own AI on, the text read from a receipt is sent from your phone to the AI provider you chose to be interpreted; the photo and the saved record stay on the device. Either way, this data is not transmitted to us and we have no way to access it.

Permissions the App may request

• Camera — only if you photograph a paper receipt. Images are processed on-device.
• Photos / photo library — so you can point Spenti at the bank slips and PromptPay receipts already saved in your gallery. Spenti reads the images you select or allow without uploading them for processing. Images may be included in backups as described below.
• Notification access (Android, optional) — only if you turn on Bank messages and grant it. Spenti then reads the notifications of the bank apps you tick and of your SMS app, so it can catch bank SMS without the SMS permission; notifications from other apps, and from WeChat, are ignored. The text is read on the device and never sent anywhere.
• Shortcuts and the “Add expense from message” action (iOS, optional) — iOS lets no app read other apps' messages. If you set up a Shortcuts automation yourself, it passes a bank message's text to Spenti's “Add expense from message” action (message triggers on iOS 17 and later, app-notification triggers on iOS 27 and later). You choose the sender, and you can delete the automation in the Shortcuts app.
• Shortcuts and the “Add Wallet payment” action (iOS 17 and later, optional) — if you set up a Shortcuts Transaction automation (“When I tap any of my cards in Wallet”), it passes the payment's amount, merchant and card name to Spenti's “Add Wallet payment” action each time you pay with Apple Pay. Spenti reads only what the automation passes; it has no access to Wallet or your cards. You can delete the automation in the Shortcuts app.
• Share to Spenti and Files — the share extension (iOS) and share target (Android) appear in other apps' share sheets, and Import from Files opens the system file picker. Spenti receives only the photos and PDFs you share or pick.
• Notifications (optional) — only if you turn on reminders or budget alerts. Budget alerts are calculated on the device from your own entries; the notification is raised locally and its contents are never sent anywhere. You can revoke any permission at any time in your device settings.

Your own AI (Pro, optional)

Spenti reads receipts and answers chat with AI models that run on your phone (On this phone, the default). With Spenti Pro you can instead connect Your own AI: your own account with OpenAI (ChatGPT), Anthropic (Claude), Google Gemini, OpenRouter (you sign in through OpenRouter) or another OpenAI-compatible service. It is off by default, and the App asks for your consent, naming the provider, before anything is sent.

• What goes: the text read from each receipt you scan, and your chat questions with the totals needed to answer them. Never the photos.
• Where: straight from your phone to the provider you chose, under your own account and your key. No Spenti server is involved and we never see it. The provider handles it as an independent controller under its own terms and privacy policy, and bills your account; Spenti charges nothing extra.
• What stays on your phone: your photos, your other receipts, budgets, backups, bank messages (even with Your own AI on) and your key.
• Google Gemini's free plan: Google may use what you send to improve its products, and people may read it. The App tells you this before you connect.
• Your key is stored in the iOS Keychain or Android Keystore in its own space, excluded from backups, never written to a log, cleared when you reinstall the App, and erased by “Delete everything on this phone”.
• How to stop: Settings › Scanning & AI › AI › On this phone. Receipts your provider read carry a “Read by your AI” tag.

Anthropic and Gemini may not be available in every country, including Myanmar. Sending to your provider happens at your request and with your consent, which you can withdraw at any time by switching back to On this phone.

When you sign in to OpenRouter, OpenRouter sends you back through a static page at spenti.app/own-ai/openrouter that hands the one-time sign-in code to the App and keeps nothing. Our host, Cloudflare, sees that request like any page view (your IP address and the address with the code in it) under its own logging, and the code cannot be used without the matching secret that stays on your phone.

Bank messages

On every plan, Spenti can file an expense from a bank SMS or a bank app's alert, without a photo. On Android, once you turn it on and grant Notification access, Spenti reads notifications from the bank apps you tick and from your SMS app; it does not use the SMS permission, and WeChat is excluded. On iOS, a Shortcuts automation you set up passes the message text to Spenti's “Add expense from message” action. Apple Pay (iOS 17 and later): a Shortcuts Transaction automation you set up passes each Apple Pay payment's amount, merchant and card name to Spenti's “Add Wallet payment” action. Either way the message or payment is read on your device only and is never sent anywhere — not to us, and not to Your own AI. Spenti saves money in as well as spending: a refund, reversal or cashback is saved as a refund when Spenti finds the purchase it refunds, and other money in is saved as money in, all on the device. The rules are tuned for Thai banks and wallets, read English-language alerts from US, UK and European banks, and use general rules for Malaysia and the Philippines; an optional on-device AI helper can read messages the rules miss. Each message or payment Spenti saves counts as one scan against your monthly allowance; duplicates and ignored messages do not. Turn it off or untick an app at any time in the App's Bank messages settings, and revoke Notification access in your device settings.

Share to Spenti, Files and PDFs

Photos and PDFs you share to Spenti from another app (the iOS share extension or the Android share target), or pick with Import from Files, are copied into the App's private storage and read on your device (unless you turn on Your own AI, in which case only the text read from them goes to your provider). PDF pages are rendered on the phone — the first 10 pages, each read as its own receipt — and the temporary files are deleted after the scan.

Widgets

The iOS home-screen and lock-screen widgets and the Android widget show this month's spending and the budget left. For them, the App keeps a small summary on the device only (on iPhone and iPad, in the App's own App Group container; on Android, in the App's private storage, excluded from device backups), and the widgets send nothing anywhere. You can hide the amounts with Settings › Privacy & backup › Show amounts on widgets; they start hidden while app lock is on.

When the App uses the network

After the AI models have been downloaded, scanning and spending chat work offline. The App uses the network to: (i) only if you switch on Check exchange rate online in Settings → Currency, which is off by default, fetch today's exchange rates for the currencies you use (Spenti supports 31) from api.frankfurter.dev, which publishes European Central Bank reference rates, at most once a day — a request for public exchange rates that does not include receipt contents or transaction amounts; with the check off, Spenti converts at its own built-in rates and this request is never made. The Myanmar kyat (MMK) is never requested: it converts at a rate built into the App, which you can change in Settings → Currency; (ii) download the on-device AI models once after installation, and any later model update, from our file host assets.spenti.app — a file download that does not upload your receipts or spending records; (iii) check for optional app and model updates by fetching a small version file from spenti.app; (iv) complete purchases and validate receipts through the App Store or Google Play; (v) open a link you tap (such as this Website or a support email); (vi) if you have enabled the optional Basic or Pro cloud sync, transfer your Spenti data to and from your own iCloud or Google Drive; and (vii) if you turn on Your own AI (Pro), send the text read from each receipt you scan, and each chat question with the totals needed to answer it, to the AI provider you connected (and, for OpenRouter, sign you in at openrouter.ai, which sends you back through a static page at spenti.app/own-ai/openrouter that hands the one-time sign-in code to the App and keeps nothing; Cloudflare, our host, sees that request like any page view, with your IP address and the code, and the code is useless without the secret that stays on your phone). Scanning, categorising, bank messages, Apple Pay payments, budget alerts and AI chat never need the network in On-this-phone mode — they run in airplane mode; with Your own AI on, each scan and chat question is one request to your provider. Without a connection Spenti simply reuses the last exchange rates it fetched. Your receipts, images and amounts are never sent to us by the App. Optional cloud backup does transfer financial data to your own cloud account. Online services receive standard connection information, such as your IP address, when contacted.

No tracking or advertising

The App contains no third-party advertising, analytics, attribution or tracking SDKs. We do not profile you, and we do not have an identifier that follows you across apps or websites.

Optional cloud sync (Basic and Pro)

Basic and Pro include an optional cloud sync and backup feature, off by default. If you turn it on, your Spenti data (receipts, images, amounts and settings) is stored in and synced through your own cloud account — iCloud on iOS, Google Drive on Android. That storage belongs to you: it is governed by Apple's or Google's terms and privacy policies, we have no access to it, and no copy passes through any server of ours. Turn sync off at any time in the App's settings; you can also delete the synced copy from your iCloud or Google Drive. Restoring a backup only adds the entries your phone lacks: it never deletes or overwrites anything already on the phone.

The room and the mascots

Spenti shows your spending in a room, with a family mascot whose mood follows your budget. The rooms and mascots ship inside the App and are drawn on your device; your choice of room, mascot and light, dark or by-the-clock setting is stored only on the device. Picking a room or a mascot sends nothing anywhere. With Make your own, you can have your own AI chat (outside Spenti) paint or write a scene and bring it in; Spenti never calls an AI for this, and the prompt it gives you to copy carries nothing about your spending. Your scenes are stored on the device and included in your backups. A scene picture you share carries “Made with Spenti” and never shows your receipts, amounts or budget.

Device backups

If you enable your operating system's backup (for example iCloud Backup or Google's device backup), your on-device Spenti data may be included in that backup. Those backups are controlled by Apple or Google under their terms and privacy policies, not ours.

Deleting your data

Because your data lives on your device, you are in control: delete individual entries in the App, use the Privacy section in Settings to find and delete anything personal, clear the App's data, or uninstall Spenti to remove its local database from that device entirely. If you used cloud sync, also remove the synced copy from your iCloud or Google Drive (or from the App's sync settings before uninstalling). “Delete everything on this phone” in Settings also erases the key for Your own AI. Anything already sent to your AI provider is held under that provider's terms; delete it in your account with them.

03In-app purchases

Spenti is free to download and offers optional in-app purchases (auto-renewing Basic and Pro subscriptions and a one-time Pro Lifetime purchase). Payments are processed by Apple and Google through the App Store and Google Play — not by us. We never receive or store your full payment card details.

To deliver what you bought and to provide support, Apple and Google share with us limited information such as your purchase and subscription status, entitlements, and anonymised or aggregated transaction data. We use this to perform our agreement with you and for our legitimate interest in supporting purchases; we do not keep a separate store of your purchase history beyond what we need to answer a support request. Their handling of your information is governed by the Apple Privacy Policy and the Google Privacy Policy.

04The spenti.app website

Hosting and security logs

The Website is a static site hosted on Cloudflare. As our hosting and security provider, Cloudflare processes standard technical data — such as your IP address, request headers, approximate location and browser user-agent — to serve pages and protect the site from abuse. This is ordinary web-server activity, is not used to build a profile of you, and rests on our legitimate interest in running a secure Website. The Website's typefaces are served from spenti.app itself rather than from a third-party font host, so no font request goes to Google or anyone else.

Contact and feature-request forms

Two forms let you write to us. They collect only what you choose to enter, stored in a database (Cloudflare D1) operated for us by Cloudflare:

• The Support form: your name (optional), email (optional), a topic, and your message.
• The Roadmap feature-request form: a feature title, an optional description of the problem it solves, and your email (optional) — there is no name field.

In both cases we also record your interface language and the time you submitted. Support messages additionally record your browser's user-agent, because it is often what explains a bug; feature requests do not.

• Why we use it: to reply to you, provide support, fix bugs and plan the roadmap.
• Legal basis (GDPR / UK GDPR): our legitimate interest in operating Spenti and responding to you, and taking steps at your request when you contact us. Under Thailand's PDPA, the processing is necessary for our legitimate interests and to respond to your enquiry.
• Email is optional — but without it we cannot reply.

Anti-spam

To tell humans from bots, form pages use Cloudflare Turnstile and a hidden honeypot field. Turnstile may process browser and device signals and issue a short-lived token; it is designed to be privacy-preserving and is not used for advertising.

Cookies

The Website uses no advertising or analytics cookies. Cloudflare may set strictly-necessary security cookies, and Turnstile may store a short-lived token, purely to keep the site working and secure.

05Who we share information with

We do not sell or rent your personal data, and we do not share it for advertising. We rely on a small set of processors (and, if you choose, the AI provider you connect), and we may disclose information where required by law:

Provider	Role
Cloudflare, Inc.	Website hosting, security (Turnstile), and the form database (D1).
Apple Inc.	App distribution and payment processing on iOS, and iCloud storage if you enable the optional Basic or Pro cloud sync.
Google LLC	App distribution and payment processing on Android, and Google Drive storage if you enable the optional Basic or Pro cloud sync.
The AI provider you connect (Pro, optional) — for example OpenAI, Anthropic, Google, OpenRouter or a service you name	Only if you turn on Your own AI: receives the text of receipts you scan and your chat questions, straight from your phone under your own account. It is not our processor: it acts as an independent controller under its own terms and privacy policy, and we have no access to what you send it.

06International transfers

Our providers (Cloudflare, Apple, Google) operate globally, so information may be processed in countries outside your own — including the United States. Where required, these transfers rely on the appropriate safeguards those providers offer, such as Standard Contractual Clauses. If you turn on Your own AI, the provider you chose may process what you send in any country where it operates, including the United States, under its own terms and safeguards.

07How long we keep information

• App data stays on your device until you delete it or uninstall the App. We never hold it. A cloud-sync copy, if you enabled sync, stays in your own iCloud or Google Drive until you remove it. If you used Your own AI, what you sent is kept by your provider under its own retention policy.
• Form submissions (support and feature requests) are kept only as long as needed to handle your request and for a reasonable period afterward — no longer than 24 months — then deleted or anonymised.
• Purchase and entitlement data from the app stores is used to keep your purchases working and is not retained beyond what we need to provide support.
• Security and server logs are produced and retained by Cloudflare under its own retention policy as part of hosting and protecting the Website. We do not receive, store or analyse them, and we keep no server logs of our own.

08Your rights

Depending on where you live, you may have rights under Thailand's Personal Data Protection Act (PDPA), the EU/UK GDPR, or California's CCPA/CPRA — including to access, correct, delete, restrict or object to processing, obtain a copy of your data, and withdraw consent. California residents also have the right to know, delete and correct, and to opt out of the “sale” or “sharing” of personal information — which we do not do. We will never discriminate against you for exercising any of these rights.

Because the App stores your data on your device, we usually cannot act on a request about App data — you already control it directly on your phone. For anything you sent through Your own AI, contact that provider. For information handled through the Website, email privacy@spenti.app and we will respond within the time the applicable law requires. You may also complain to your data protection authority; in Thailand this is the Office of the Personal Data Protection Committee (PDPC).

09Children's privacy

Spenti is a general-audience finance tool and is not directed to children under 13 (or the minimum age in your country; Thailand's PDPA affords additional protection to minors). We do not knowingly collect personal data from children. If you believe a child has sent us personal data through the Website, contact us and we will delete it.

10Security

Your App data is protected by your device's own security — passcode, biometrics and OS-level encryption. The key for Your own AI is stored in the device keychain (the iOS Keychain or Android Keystore) and excluded from backups. Information submitted through the Website is protected by Cloudflare's security controls and limited access. No method of storage or transmission is ever 100% secure, but keeping your financial data on your device removes the single biggest risk: a central server that could be breached.

11Changes to this policy

We may update this policy as Spenti evolves or the law changes. We will post the new version here and update the “Effective” date above; where changes are significant, we will make that clear.

12Contact

Provider: Spenti.
Privacy contact: privacy@spenti.app.