Privacy Policy
Updated October 4, 2026
1. About this policy
This policy describes how SpendAtlas handles information in the app and on this website. For questions about your information or a privacy request, contact privacy@spendatlas.com.
2. Your private account
SpendAtlas uses a private account based on a 24-word recovery phrase. Creating this account does not require an email address and password. The app stores the recovery phrase and session information in secure device storage. On supported Apple devices, the recovery phrase can also be saved to iCloud Keychain for recovery. The service uses a public account identifier and signed authentication requests to recognize your account.
Keep your recovery phrase private. Anyone who has it may be able to access your account. Do not include it in support messages.
3. Information used by the app
- Information you enter, including your profile, Spaces, categories, budgets, currencies, transactions, notes, and recurring transaction settings.
- Location information attached to transactions when you choose to add it. Device location access is controlled through your device permissions.
- Account identifiers, synchronization records, and device registration information used to provide account access, synchronize data, and deliver enabled notifications.
- App interactions, technical information, and subscription events used for analytics and subscription features.
- Information you choose to send when contacting support.
4. Storage and service providers
SpendAtlas stores app data locally and synchronizes account data through a backend hosted on Cloudflare, using Cloudflare D1 for database storage. Secure device storage and Apple iCloud Keychain support account access and recovery.
PostHog provides app and website analytics. Superwall supports in-app paywalls and subscription features, with purchases handled through Apple’s App Store. These services may process account or device identifiers, usage events, and subscription information needed for their functions.
If you use shared Spaces, other members can access information made available within those Spaces.
Automatic categorization is optional and off by default. If you enable it on the Automations page, expenses added without a selected category through Shortcuts or API tokens you create may be sent to Cloudflare Workers AI (Clef-flash). The AI request contains the transaction name (merchant text), currency, and active expense category names from the token’s Space, including shared Spaces, to choose a category. It does not include transaction amounts, notes, locations, account identifiers, or recovery phrases. Transaction and category names can themselves contain personal information, so avoid including private details in those names.
We store your automatic categorization preference, disclosure version, and time of the change with your account. Turning it off on the Automations page stops future AI requests for your automations across devices. Requests already sent cannot be recalled. Selected categories and existing transactions are not changed. If the service is unavailable, its quota is exhausted, or the result is uncertain, the expense is saved without a category. Cloudflare’s processing is subject to its applicable terms and Workers AI data usage information.
5. Website analytics
This website integrates PostHog and Google Analytics to understand visits and interactions, including download link usage. Analytics services may use cookies or browser storage and collect browser, device, and usage information. You can manage cookies and site storage through your browser settings.
6. Your choices and requests
You can initiate account deletion in Settings → Data & Sync → Delete account. Deletion removes private account data from SpendAtlas, preserves shared transactions for other members with the deleted account identity removed, and requires shared Space owners to transfer ownership or delete their Space first. The app explains local and iCloud cleanup before confirmation. Account deletion does not cancel App Store subscriptions.
You can edit your records in the app, manage device permissions in your device settings, and manage App Store subscriptions through Apple. Contact privacy@spendatlas.com to ask about access, deletion, or other privacy requests. Available rights and the information needed to fulfill a request depend on your location and the request.
Deleting local app storage or removing the app does not itself establish that synchronized server records or service-provider records have been deleted. Contact us if you need help with account data removal.
7. Security and retention
The app uses secure device storage for account secrets and authenticated requests for account access. These measures do not mean that transaction data is encrypted end to end. Contact us for details about retention of account data, backups, and analytics records, or to request removal.
8. Changes and contact
We may revise this policy as SpendAtlas changes. The date above identifies the latest revision. Privacy questions can be sent to privacy@spendatlas.com.