Privacy Policy

1. Our Commitment to Your Privacy

At XpenseMate, we believe your personal financial data is private. As a local-first, progressive web app, XpenseMate is built to give you maximum control over your data.

2. What we collect

• Account Info: When registering, we collect your name, email address, and an encrypted hash of your password.
• Verification Details: For registration and security password resets, we trigger secure, temporary One-Time Passwords (OTPs) sent to your registered email address.
• Authentication cookies: We use NextAuth to handle user sessions. This creates encrypted security cookies on your device to keep you signed in securely.

3. What we do not collect

We do not sell your personal or financial data, nor do we run third-party tracking scripts, ads, or profiling analytics. We only process information required to run the XpenseMate service.

4. Third-party services

We only use essential functional cookies required to establish secure authentication sessions. We do not use advertising tracking cookies, behavioral pixel trackers, or third-party web beacon networks.

5. Data storage

A. Local Storage (IndexedDB)

If you use XpenseMate without an account (in offline mode), all transaction entries, budgets, bank details, and configuration settings are saved strictly on your local device using standard browser storage (IndexedDB and LocalStorage). This data is completely private, remains under your control, and never leaves your device.

B. Server Storage & Database Sync (Cloud Mode)

When you create an account, register, or sync your data, your transactional records, accounts structure, and budget configurations are securely uploaded and stored on our servers inside a secure, encrypted database protected with TLS encryption in transit and infrastructure-level encryption at rest. This sync serves as an encrypted cloud backup and allows you to log in and manage your records across multiple devices.

6. Your rights

We believe you own your financial story. You have the right to view, modify, and permanently remove any data stored on our servers. At any time, you can navigate to the in-app Settings and select Delete Account. This confirms and triggers a permanent purge that immediately clears your user profile, configurations, and entire transaction history from our active server databases. Local device data can be cleared by purging your browser cache or site storage.

7. Contact

If you have any questions or feedback regarding our privacy practices, please contact us at support@xpensemate.com.