SpendFox Privacy Policy

SpendFox is a budgeting app made by TruWiz, Inc. ("we"). This policy explains what SpendFox collects, why, who it is shared with, how long it is kept, and how you can see or delete it. This is the same policy shown inside the app.

What we collect

• Account details: your email address, the name you enter, and your sign-in method (password or Google). Passwords are handled by our sign-in provider; we never see them.
• Bank data, only after you choose to link a bank through Plaid: account names, types, the last 4 digits of account numbers, balances, and transactions (date, amount, merchant, Plaid's category). We do not receive your bank username or password.
• What you add: categories you choose, notes, reviews, budgets, refunds you track, and your settings.
• Basic technical data needed to run the service, such as server logs of requests (time, function called, errors).

How we use it

• To show your spending, categorize transactions, find bills and subscriptions, track budgets and refunds, and send reminders you turn on.
• To keep your account secure, including two-step verification before a bank can be linked.
• We do not sell your data, use it for advertising, or share it with data brokers.

Who we share it with

• Plaid Inc. connects SpendFox to your bank. When you link a bank, Plaid collects data under its End User Privacy Policy (plaid.com/legal). You can review or revoke Plaid's access at my.plaid.com.
• Supabase hosts our database and sign-in. Expo builds and delivers the app. They process data only to provide those services to us.
• We may disclose data if the law requires it. If SpendFox is ever sold or merged, this policy continues to apply to your data.

Your consent and choices

• You agree to this policy when you create an account. Bank data is only collected after you choose a bank and approve the connection in Plaid's screen, and you can disconnect a bank at any time.
• Reminders are off until you turn them on, and you can turn them off in Settings.

Security

• Data is encrypted in transit (TLS 1.2 or newer) and at rest (AES-256) by our hosting provider. Bank access tokens are kept on our servers only and are never sent to the app. Each user can only read their own data.
• On your phone, your sign-in session is stored encrypted using the phone's secure key storage.

How long we keep it

To delete your account and data, use Settings → Security → Delete account in the app, or follow the steps on Delete your SpendFox account.

• We keep your data while your account is open so the app can show your history.
• When you delete your account (Settings → Security → Delete account), we disconnect your banks at Plaid right away and permanently delete your data and sign-in. Copies kept for recovery are deleted within 30 days.
• If you can't use the app, you can ask us to delete your account at truwiz.com/spendfox/delete-account or by email to support@truwiz.com.
• Server logs are kept for a limited time by our hosting provider for security and troubleshooting.

Your rights

• You can view and edit your data in the app, delete it in the app, or email support@truwiz.com to ask for a copy, a correction, or deletion. We answer within 30 days. Depending on where you live (for example California), you may have additional rights, and we will honor them.

Children

• SpendFox is not meant for anyone under 18, and we do not knowingly collect data from children.

Changes and contact

• If we change this policy, we update the date above and tell you in the app before the change affects your data.
• Questions or requests: support@truwiz.com (TruWiz, Inc.).