Effective Date: September 1, 2026

Privacy Policy for Xpense

This policy applies to the Xpense mobile application ("Xpense," "Xpense Manager," "the App," package name com.xpense.manager) and the XpenseDigital web platform (xpensedigital.com), together operated by XpenseDigital ("we," "us," "our").

1. Introduction

Xpense is a personal expense and financial tracking application. This Privacy Policy explains what information we collect when you use the App or our website, how we use and protect that information, and the choices you have, including how to request deletion of your account and data.

By creating an account or otherwise using Xpense, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the App.

2. Data We Collect

We collect the minimum data necessary to operate your account and provide expense-tracking functionality.

Category	Examples	Purpose
Account information	Name, email address	Account creation, login, OTP verification, in-app notifications, and customer support
Financial / expense information	Transactions, income and expense entries, categories, amounts, notes you add in the App	Core app functionality — recording, categorizing, and displaying your personal expense history
Authentication data	Google account identifier and basic profile info (name, email) when you use Google Sign-In	Secure login without a separate password
Advertising identifiers	Google Advertising ID, device/app interaction data used by Google Ads	Displaying ads within the App (see Section 5)

What we do not collect:

We do not collect or store your bank account numbers, card numbers, or other payment credentials — expense entries are figures you enter yourself, not linked payment methods.
We do not collect precise location data.
We do not access your device contacts, photos, or SMS messages.

3. How We Use Your Data

To create and maintain your Xpense account
To let you record, view, edit, and analyze your personal financial data within the App
To send One-Time Passwords (OTP) and account-related emails (e.g., verification, deletion confirmation) via our mailer service
To authenticate you securely using JWT-based access and refresh tokens
To notify you of app updates (optional or required, depending on the release)
To display ads through Google Ads and support the free operation of the App
To detect, prevent, and address technical issues or misuse

If you choose to log in using Google Sign-In, we receive your basic Google profile information (name and email address) to create or authenticate your Xpense account. We do not receive or store your Google password. Use of Google Sign-In is also governed by Google's Privacy Policy.

5. Advertising (Google Ads)

Xpense displays advertisements served through Google Ads (including Google AdMob or related Google advertising products). Google may collect and use device identifiers, such as your Google Advertising ID, and app usage data to serve and measure ads, in accordance with Google's advertising and privacy policies.

You can reset or limit ad personalization through your device's advertising settings (e.g., Android Settings → Google → Ads).
We do not directly sell your personal or financial data to advertisers. Advertising partners operate independently under their own privacy policies.

We do not sell your personal or financial data. We share data only in these limited circumstances:

Service providers: Our email delivery provider (for OTP and account emails) and Google (for Sign-In and Ads), each acting under their own privacy terms.
Legal requirements: If required by law, regulation, legal process, or governmental request.
Business transfers: If XpenseDigital is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction, subject to this policy or a comparably protective one.

7. Data Storage & Security

Your data is stored on servers operated by our hosting provider and secured using industry-standard practices, including:

Encrypted password storage and OTP-based verification for sensitive actions
Short-lived JWT access tokens paired with refresh tokens, rather than indefinitely valid credentials
Access controls restricting who can view or modify stored data

While we take reasonable steps to protect your information, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Data Retention

We retain your account and financial data for as long as your account remains active. This data is stored persistently in our database (not processed ephemerally) so that it remains available to you across sessions and devices.

9. Account & Data Deletion

You may request deletion of your account and associated data at any time, in either of the following ways:

In-app: Go to Account Settings → Delete Account within the Xpense app. You'll be asked to verify your identity via OTP sent to your registered email.
Web (without the app): Visit xpensedigital.com/account-deletion and submit your registered email and password to request deletion.

What happens after you request deletion

Your account is immediately deactivated and hidden from active use.
We retain your data for a 30-day grace period, during which you may contact us to cancel the deletion request and restore your account.
After 30 days, your account data is permanently deleted or anonymized from our production systems, except where retention is required by law (e.g., financial or tax record-keeping obligations) or necessary to resolve disputes and enforce our agreements.
Backups containing your data are purged on our routine backup rotation schedule following permanent deletion.

Data deleted: account profile, financial/expense entries, authentication tokens.
Data retained (if legally required) during/after the grace period: minimal transaction records required for legal or accounting compliance, retained only as long as legally necessary and not used for any other purpose.

10. Your Rights & Choices

Access & correction: You can view and edit your account and expense data directly within the App.
Deletion: As described in Section 9.
Ad personalization: Manage via your device's Google Ads settings.
Withdrawal of consent: You may stop using the App and request deletion at any time.

Depending on your jurisdiction (e.g., GDPR in the EU/EEA, or applicable state privacy laws in the US), you may have additional rights, including the right to request a copy of your data or object to certain processing. Contact us using the details in Section 14 to exercise these rights.

11. Children's Privacy

Xpense is not directed to children under 13 (or the minimum age required by your local law). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

12. International Data Transfers

Your data may be processed and stored on servers located in a different country than where you reside. By using Xpense, you consent to this transfer, storage, and processing in accordance with this policy.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. We will update the "Effective Date" at the top of this page when changes are made. Continued use of the App after changes take effect constitutes acceptance of the revised policy.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

Email: support@xpensedigital.com
Website: xpensedigital.com