Spendbrook Privacy Policy

The short version

You do not need an account to use Spendbrook, and it does not connect to your bank. We do not ask for your name, e-mail address or phone number. Your transactions, accounts, budgets, receipt photos and imported entries stay on your phone. We collect usage statistics and crash reports to improve the app; where the law requires it, we ask for your consent first. The free version shows ads served by Google AdMob; where the law requires it, Google's consent message asks for your choice before any ad request. Apple or Google handle your purchases. We do not sell the data we hold. Write to us at info@mobixify.com with any question about your data.

Who we are

The controller is MOBIXIFY LTD (Mobixify), company number 16138122. Contact: info@mobixify.com. Company information: mobixify.com/company/. Google is a separate controller of the data its advertising software receives (see Ads).

On your phone

Your transactions, the names of your accounts, categories, budgets, recurring transactions, reports, receipt photos, the entries you import from a file (such as a bank statement in CSV format) and your settings are saved on your phone and are not sent to us. The app reads an imported file and a receipt photo on your phone. Budget alerts, if you turn them on, and the reminder before a free trial ends are created by your phone. If you turn on the app lock, your phone checks your face, fingerprint or passcode and tells the app whether the check succeeded; the app does not receive your face or fingerprint data. When you export your entries or save a backup file, the app builds the file on your phone, and it goes where you choose to share or save it. A device backup made by Apple or Google may include this data.

Exchange rates

To convert amounts between currencies, the app downloads the day's table of exchange rates from an exchange-rate service when you open it, at most once a day. The request is the same for everyone: like any request over the internet it carries your IP address, and your currencies, transactions and amounts stay on your phone.

What we collect, why, and on what basis

What	Why	Basis
Usage statistics (Google Analytics for Firebase): events in the app (for example finishing the first set-up, adding a transaction, importing a file, opening the Pro screen, starting a purchase and its result), whether Pro is on, device model, operating system, app version, approximate location derived from your IP address and a random app ID. Amounts, account names, categories, notes and imported files are not part of these events.	To understand how the app is used and improve it	Your consent where the law requires it; otherwise legitimate interests
Crash reports: the technical record of a crash, device model, operating system, app version and random installation IDs	To find and fix bugs	Legitimate interests; your consent where the law requires it
Purchases: a random app user ID, your purchase history and subscription status in this app, app version, device type, operating system and IP address. We do not see your card details.	To unlock Pro, restore purchases, prevent fraud and keep tax and accounting records	Contract (our Terms); legitimate interests; legal obligation
Updates and technical data: IP address, operating system, app version and standard request details	To keep the app up to date, working and secure	Legitimate interests
What you write to us: your e-mail address and your message. If you write from the app, the message it prepares includes the app version, your system version and your device model; you can remove them before you send it.	To answer you	Legitimate interests; contract where your message is about a purchase

This information is collected automatically while the app is online; your messages reach us by e-mail.

Your choice. Where the law requires it, we ask for your consent before using analytics or crash reporting. Elsewhere both start switched on, and the app tells you so once. Each has its own switch in Settings, and you can change your choice at any time. The app works the same whatever you choose.

Technical logs. Our servers keep short-lived technical logs, including your IP address and the User-Agent header of each request, which names the app or its network software and its version and, on iPhone and iPad, can show the version of the system.

Store update check. When the app starts, it checks whether a newer version is available through the App Store or Google Play and through a request to our server. Apple and Google each handle their part as separate controllers. Our request does not carry a user or device ID.

Refunds. If you ask Apple or Google for a refund, we may share information about that purchase with them so that they can decide your request. We do this with your consent, given in the Terms; you can withdraw it at any time by writing to us.

Ads

The free version shows banner ads, a full-screen ad from time to time, and optional rewarded ads that open a Pro report for a while. Pro turns the ads off. Google AdMob serves the ads, and Google's User Messaging Platform (UMP) shows the consent message. Where the law requires it, Google's consent message asks for your choice before any ad request.

What Google receives. Through its advertising software in the app, Google receives from your phone your IP address (which it uses to estimate your general location), ad interactions, diagnostics and device identifiers: on Android the advertising ID (only if your device settings allow it and, where the law requires it, with your consent) and app set ID; on iPhone and iPad the advertising identifier (IDFA) only if you allow tracking. Google uses this data to serve and measure ads, limit repeats, prevent fraud and for ad analytics, as an independent controller under the Google Privacy Policy and How Google uses information from sites or apps that use our services (policies.google.com/technologies/partner-sites). Google and its advertising partners may use identifiers such as your device's advertising ID, cookies or similar technologies, and your IP address to serve and measure ads and to prevent fraud. Your transactions, amounts and budgets are not part of ad requests. Google AdMob gives us aggregated ad reports.

Legal basis. Where the law requires consent, we rely on your consent through Google's consent message. Elsewhere we rely on our legitimate interest in funding the free version through ads.

Your choices. Where the law requires it, you can change or withdraw your choice at any time under Settings > Ad preferences > Privacy choices, which appears where it applies; where US state law applies, it opens Google's "Don't sell or share my data" form. Without consent, Google serves only limited or non-personalised ads, or none, and the app works the same. On Android you can reset or delete the advertising ID in your device settings; on iPhone and iPad you can change your tracking answer under Settings > Privacy & Security > Tracking.

Who receives your information

• Service providers that process data for us on our instructions and must protect it as this policy describes: hosting, analytics, crash reporting, purchase processing and app update providers.
• Google and Apple, as separate controllers, for ads (Google and its advertising partners; see Ads), the app stores, payments and their part of the update check. Their own privacy policies apply to the data they hold.
• The exchange-rate service, which receives the rate requests described above.
• Authorities, advisers and others, where the law requires it, to protect safety or to defend legal claims. If we sell or reorganise the business, data may pass to the new owner under this policy.

We do not sell the data we hold, give it to advertisers or data brokers, or pass it to Google's advertising software.

Transfers outside the UK

Your information may be handled outside the UK, including in the United States. We rely on the UK-US data bridge for certified recipients, the UK Addendum to the standard contractual clauses where a provider's terms use it, and otherwise the UK's standard data transfer terms. Email info@mobixify.com for a copy of the safeguards. Google's advertising software and exchange-rate requests send data directly from your phone to Google and to the exchange-rate service, which handle it under their own safeguards.

How long we keep information

• Data on your phone: until you delete it or uninstall the app.
• Usage statistics: 2 months. Crash reports: 90 days.
• Purchase records: while the app is on sale and then 6 years, for tax and accounting.
• Technical logs: a short time.
• Messages to us: 24 months after the last message. Records of data requests: 3 years after we close the request.
• Google and the exchange-rate service decide how long they keep the data they receive.

Your rights

You can ask us for access to your personal data, to correct it, to delete it, to restrict its use, and to receive a copy in a portable format. Where we rely on legitimate interests, you can object at any time, and we will stop unless we have compelling grounds or need the data for legal claims. Where we rely on your consent, you can withdraw it at any time; this does not affect what happened before.

To use a right, write to info@mobixify.com. As there is no account, adding the order number from your Apple or Google receipt helps us find a purchase record. We will act on your request within one month (up to two more for a complex request, and we will tell you why). Ask Google and Apple about the data they hold.

If you are not happy with how we have handled your personal data, tell us first at info@mobixify.com. We will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome. You can also complain to the Information Commission (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint.

Children

Spendbrook is meant for adults and is not directed at children. We do not knowingly hold personal data from children under 13. Parents and guardians can write to info@mobixify.com with any concern.

Security

Connections are encrypted and access to data is limited. If a personal data breach puts your rights at risk, we will tell you and the Information Commission (ICO) as the law requires.

Changes to this policy

If we change how the app handles personal data in a material way, we will update this page and its effective date before the change takes effect, and say so in the release notes on the store.