Xpenstack
Sign in
Xpenstack Privacy Policy
Last updated
This Privacy Policy explains how Xpenstack handles personal information when you use the Xpenstack web app at https://app.xpenstack.com (the “Service”). Please read it before creating an account or entering information.
1. Who is responsible for your information
Xpenstack is operated by Shubham, a private individual in Poland (the “operator” or “we”). The operator determines how personal information is used for the Service and is the data controller for that processing.
For privacy questions or requests, email contact@xpenstack.com.
2. Information we handle
Information you provide
Depending on the features you use, the Service handles:
- your email address and account details;
- expense and receipt records, including item descriptions, amounts, dates, shops, categories, payment account labels, currencies, trips, and notes;
- money-in records, budgets, recurring expense details, and preferences; and
- messages or information you send to us for support.
Expense descriptions and notes may reveal personal information about you. Please enter only information you need for your own tracking. Do not enter bank passwords, full payment-card numbers, or account credentials.
Google sign-in information
If you choose Continue with Google, Google provides the basic account information needed to identify you and sign you in, such as your name, email address, and profile image if available. Xpenstack uses this information to create or access your account and maintain your sign-in session.
Xpenstack does not request access to Gmail, Google Drive, contacts, calendars, or other Google services. Google account information is not sold, used for advertising, or used to build advertising profiles.
Technical and security information
The Service and its providers may process technical information such as IP address, browser and device details, sign-in events, and security logs. This information helps deliver the Service, prevent abuse, protect accounts, and troubleshoot failures.
3. How we use information
We use information to:
- create, authenticate, and secure your account;
- store and display the expenses, budgets, and other records you enter;
- calculate totals, budget progress, summaries, and currency conversions;
- provide features you choose to use, including service emails if enabled;
- answer support requests and maintain the Service; and
- comply with legal obligations and protect the Service and its users.
We do not sell personal information, serve advertising in the app, or use your financial records to target advertisements.
4. Legal bases under European data-protection law
Where the GDPR applies, we generally process information because it is necessary to provide the Service you request, to meet legal obligations, or for our legitimate interests in keeping the Service secure and reliable. Where consent is required, we will ask for it and you may withdraw it.
5. Where information is stored and who processes it
The app uses Supabase for account authentication and database storage. Supabase processes information on our behalf; the project is configured for hosting in Frankfurt, Germany. Cloudflare provides the app’s web hosting and security services. If you use Google sign-in, Google processes the sign-in request. If you enable app emails, Resend processes your email address and the message needed to deliver them; the project is configured to use its Ireland region.
These providers may process limited information as needed to provide their services, secure their systems, and meet legal obligations. Where information is transferred outside the European Economic Area, the relevant provider’s approved transfer safeguards apply where required by law.
6. Who can access your records
Your account is intended for your own private use. Database policies are designed to restrict access to each account’s records. The operator may have technical access to the service database and may access information when needed to operate the Service, respond to a support request, investigate a security issue, or comply with law. We do not routinely review users’ financial entries.
7. How long we keep information
We keep account and financial information while your account remains active and as needed to provide and protect the Service. You may ask us to delete your account and associated information by emailing contact@xpenstack.com. We may retain limited information where needed to meet legal obligations, resolve disputes, or protect the Service. Backups and provider security logs may persist for a limited period under the providers’ normal retention practices.
8. Your rights and choices
Depending on where you live, you may have the right to request access to, correction of, deletion of, or restriction of your personal information; object to certain processing; and receive information in a portable format. You can make a request at contact@xpenstack.com. We may need to verify your identity before acting on it.
You can stop using Google sign-in by choosing another available sign-in method, if one is available for your account. You can also ask us to delete your account. Deleting an account may prevent you from using the Service.
If you believe your information has been handled unlawfully, you may complain to your local data-protection authority. In Poland, this is the President of the Personal Data Protection Office (https://uodo.gov.pl).
9. Security
We use technical and organizational safeguards intended to protect information, including authenticated access and database rules that restrict users to their own records. No internet service can guarantee absolute security. Please use a secure sign-in method and contact us promptly if you suspect unauthorized access.
10. Children
Xpenstack is an invite-only service intended for adults. It is not directed to children under 16, and we do not knowingly invite children under 16 to create accounts. If you believe a child has provided personal information, contact us so we can review the request.
11. Changes to this policy
We may update this policy as the Service changes or as required by law. We will update the date at the top and provide notice of material changes through an appropriate channel.