Privacy Policy
Last updated: September 9, 2026
This Privacy Policy describes how Expencil ("Expencil", "we", "us") collects, uses, stores, shares and protects your information when you use the Expencil application — on the web at app.expencil.com or through the Expencil apps for Android and iOS (together the "Service") — or visit this website at expencil.com. The controller responsible for this processing is Sasan Ebrahimi - Oriexai Solutions, Germany — full contact details are in the Impressum.
In short: we store the account details and expense data you give us so the app can work. We show no ads, we sell nothing, and we run no advertising or third-party analytics trackers — the only usage data we record is a handful of our own product events, which you can switch off in the app. Signing in uses an email address and a password — there are no third-party sign-in providers. If you buy Pro, payment runs through Stripe on Stripe's own pages — your card details never touch our servers. And you can delete your account yourself at any time, effective immediately.
1. Information we collect
Information you provide
- Account information. When you sign up we collect your email address and a password (stored only in securely hashed form by our authentication provider), plus the display name you choose and the app language you pick.
- Expense data. The content you enter while using the Service: expenses with their amounts, currencies, dates, categories, payment-method labels and notes; recurring-expense definitions and their schedules; the monthly category budgets you set; and the spaces you create.
- Group data. The groups you create or join, the expenses recorded in them with their descriptions, payers and per-member splits, the payments members record between each other, and the personal archive mark you can set on a group. Balances are computed from these records; they are not stored separately.
- Invitations. If you invite someone to a shared space by email, we collect the email address you invite so we can deliver the invitation. Invite links for spaces and groups store only a random token, its expiry and who created it.
- Billing information. If you subscribe to Pro, your payment details (card number, billing address, any tax information) are collected and processed by Stripe on its own checkout and billing pages — they never touch our systems. We store only your subscription's state: the plan and version you bought, whether it is billed monthly or yearly, the current period's end date, whether it will renew, and Stripe's customer and subscription reference IDs so we can recognize your payments.
Information collected automatically
Our hosting and authentication providers record standard server logs (such as IP address and browser type) for security and abuse prevention, and your browser — or, in the Android and iOS apps, the device — stores a session token and small preferences (such as your theme and currently selected space) so you stay signed in. We use no advertising cookies, no tracking pixels, no advertising or device identifiers and no third-party analytics — in the app or on this website.
- Usage analytics (first-party, optional). To understand whether the product works, the Service records a small set of usage events in our own database — never with a third-party analytics service: opening the app (at most once per day), viewing the first-run welcome tour, running into a plan limit, and starting a Pro checkout. An event carries only the event name, the moment it happened, coarse context (for example your platform — web, Android or iOS —, your app language, and on your first visit which site referred you), and a reference to your account so we can count unique users. These events are deleted after 12 months, and deleting your account anonymizes them immediately. You can turn this off at any time in the app under Settings → About → "Share usage analytics"; we also honor your browser's "Do Not Track" and Global Privacy Control signals automatically.
- On the Android and iOS apps. Optional conveniences stay on your device: reminders for due recurring charges are scheduled locally by the app, and the optional app lock uses your device's biometric check (Face ID, fingerprint or passcode) — the operating system performs it, and no biometric data ever reaches us. The apps contain no advertising or tracking SDKs.
2. How we use your information
- To create your account, authenticate you and keep your session secure.
- To provide the Service's features: storing and syncing your expenses, logging recurring charges automatically when they fall due, computing dashboard statistics and budget progress, computing group balances and settle-up suggestions, and converting amounts between currencies using public reference exchange rates.
- To show your display name to the other members of the shared spaces and groups you belong to.
- To send transactional emails only: signup confirmation, password reset and space-invitation notifications. We send no marketing email.
- To operate paid subscriptions: starting a checkout when you ask to upgrade, recognizing your payments through Stripe's notifications, and applying the plan you bought to your account.
- To understand, through the first-party usage events described above, whether the product works — how many people sign up, come back or run into a plan limit — unless you have switched analytics off.
- To protect the Service against abuse and to comply with legal obligations.
We do not use your information for advertising, we do not build marketing profiles, we do not sell or rent your information to anyone, and we do not use it to train machine-learning models.
3. Who can see your data inside the app
- Personal space. The expenses, recurring definitions and budgets in your personal space are visible only to you.
- Shared spaces. If you create or join a shared space, the members of that space can see the records in it together with each contributor's display name. Your email address is not shown to other members.
- Groups. The members of a group can see the group's expenses, splits, payments and balances, together with each member's display name. Nobody outside the group can see any of it.
- Invite links. Anyone holding a valid invite link can see the name of the space or group (and, for a space, its owner's display name) before joining, and can join as a member. Links expire after 14 days and can be revoked or regenerated by the owner at any time.
This isolation is enforced by row-level security policies in the database itself, not only by the app's interface.
4. Service providers
We use a small number of infrastructure providers to run Expencil. They process data only on our behalf and to provide their service to us:
- Supabase — database and authentication for the Service (stores your account, expense and group data).
- Netlify — hosts the Expencil web application and this website.
- Resend — delivers our transactional emails (signup confirmation, password reset and space invitations).
- Stripe — payment processing for Pro subscriptions (checkout, renewals, the billing portal and invoices). Stripe processes your payment data under its own privacy policy; we receive only your subscription's state, never your card details.
Daily reference exchange rates are fetched from the European Central Bank's public data. No personal data is sent when doing so. Beyond the providers above we share your personal information with no third party, unless we are legally required to.
5. Data retention and deletion
- We keep your data for as long as your account exists, so the Service can show your expense history. The first-party usage events described in Section 1 are deleted after 12 months in any case.
- You can delete individual expenses, recurring definitions, categories, budgets, groups and shared spaces you own directly in the app at any time. Deleting a space or a group deletes the records inside it for everyone.
Deleting your account
You can delete your Expencil account yourself at any time, without contacting us: in the app under Settings → Account → Delete account (available on the web, Android and iOS), or on the web at app.expencil.com/delete-account if you no longer have the app installed (explained step by step on our account deletion page). You confirm with your password and a typed confirmation; the deletion takes effect immediately and cannot be undone.
- What is deleted immediately: your login, your profile (name, email address and language), your personal space with all its expenses, recurring definitions, categories, payment methods and budgets, your memberships in shared spaces and groups, your app roles, your subscription records, and every invitation addressed to your email address. Usage events we record for product statistics are anonymized at the same moment — the reference to your account is removed and only the aggregate remains.
- What stays: expenses and payments you recorded in shared spaces or groups that belong to other people remain part of that space's or group's bookkeeping, shown as "Deleted user" — without your name or email address. Shared spaces and groups you own are handed over to their longest-standing member; if nobody else is in them, they are deleted with your account. Invoices for a paid subscription that were already issued are retained by our payment provider Stripe for as long as tax and accounting law requires, and nowhere else — they contain no expense data.
- Subscription: a paid subscription ends immediately when you delete your account. Payments already made are not refunded; your statutory right of withdrawal within 14 days of purchase is unaffected (see the Terms).
6. Security
All traffic between your device and the Service is encrypted with HTTPS/TLS. Passwords are stored only as secure hashes, and changing or resetting a password signs other devices out. Every database table is protected by row-level security rules, so an account can only ever read and write the data of the spaces and groups it belongs to. Access to production infrastructure is restricted to the operator of the Service.
7. Your rights
Under the EU General Data Protection Regulation you can ask us, at any time and free of charge, for access to the personal data we hold about you, for its rectification or erasure, for restriction of its processing, to object to its processing, and to receive the data you provided in a portable format. Most of this you can do directly in the app — your data is visible and editable there, and account deletion is described above. For anything else, email support@expencil.com and we will respond within a month. You also have the right to lodge a complaint with a data-protection supervisory authority, in particular in the EU member state where you live.
8. Children
Expencil is not directed at children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.
9. Changes to this policy
If our data practices change, we will update this page and its "Last updated" date before the change takes effect. Significant changes will also be announced in the app.
10. Contact
For any question about this policy or your data, contact us at support@expencil.com or by phone at +49 177 1814305.