Privacy Policy

Effective September 29, 2026.

This policy explains, in plain words, what data the MySpent app uses, why, who it is shared with, how long it is kept and what you can do about it. If anything is unclear, email pedroferrucci2006@gmail.com.

In short: we only keep what the app needs to work (your account, the expenses you log and your settings). We don't sell data, we don't show ads, we don't use analytics or session recording tools and we don't track you across other apps. You can delete everything from the app at any time.

Who is responsible
What data we use
Why, and on what basis
What we don't do
Who we share it with
Where it is stored
How long we keep it
How we protect it
Your rights
How to delete your account
Children
Changes to this policy
Contact

1. Who is responsible

The data controller is Pedro Ferrucci, developer of MySpent, based in Argentina. Contact: pedroferrucci2006@gmail.com. In this policy, "we" means the controller and "you" means the person using the app.

2. What data we use

Data you give us

Account: you sign in with Sign in with Apple. We receive a user identifier that Apple creates for MySpent and, only if you choose to share them, your name and email. The email may be an Apple private relay address.
Expenses: amount, currency, category, date and any note you add. If you track business expenses, also whether each expense is personal or business. You enter them yourself: MySpent does not connect to banks, wallets or cards.
Recurring expenses: name, amount, category and day of the month of expenses you want logged automatically.
Settings: currency, monthly budget, and the name and budget of your business (if you track one).

Please don't write sensitive information (for example, health data) or other people's data in notes. You don't need it to use the app.

Data created as you use the app

Time zone and language of your phone: they decide when your free daily expenses reset and which language the shortcut messages use.
Free plan usage: how many free expenses you used today.
Shortcut key: if you connect the iOS shortcut, a personal key is created. We only store its hash, plus when it was last used and how many times. It lets you log expenses without opening the app and shows you whether the shortcut works.
Subscription: if you subscribe to MySpent Unlimited, we receive (through RevenueCat) whether the subscription is active, the plan, until when, and the price and currency of each charge, which is logged as an expense in your account. We never see or store your card details: Apple processes the payment.
Technical data: like any internet service, our providers briefly log technical data about each request to the server (for example IP address, date and time, and request type) for security and troubleshooting.

3. Why, and on what basis

Provide the service: store your expenses, show your circle, stats, budgets and recurring expenses.	Necessary to perform our agreement with you (the Terms), which you accept when creating an account.
Free plan and subscription: count free expenses, know whether you have Unlimited and log each charge.	Necessary to perform the Terms.
iOS shortcut: log expenses in your account with your key.	Your request: only if you connect it.
Security: prevent abuse, fraud and unauthorized access.	Our legitimate interest in protecting the service and its users.
Reply to you when you contact us.	Your request.
Comply with the law when a competent authority requires it.	Legal obligation.

We don't use your data for anything else without telling you first and, where required, asking for your permission.

4. What we don't do

We don't sell or rent your data, and we don't "share" it for cross-context behavioral advertising (as defined by California and other U.S. state privacy laws).
We don't show ads in the app.
We don't use analytics, heatmaps or session recording tools.
We don't track you across other apps or websites (we don't ask for Apple's tracking permission because we don't track).
We don't access your contacts, photos, location, microphone or camera.
You don't upload photos or files: MySpent only stores the data in section 2.
We don't make automated decisions with legal effects about you or build profiles.
To convert your subscription charge to your currency we look up a public daily exchange rate (DolarApi and ExchangeRate-API). No personal data is sent in that request.

Only with providers we need for the app to work. They act on our behalf, with their own security measures, and may not use your data for their own purposes:

Supabase (database, server and sign-in), United States. Stores your account, expenses and settings.
RevenueCat (subscription verification), United States. Receives your MySpent user ID and the status of your purchases.
Apple (Sign in with Apple, subscription billing and the Shortcuts app). Apple handles that data under its own privacy policy.
Vercel (hosts these legal pages and the guide video). Logs technical data about visits, like any website.

We may also have to disclose data if ordered by a competent court or authority, or to defend rights in a claim. If MySpent ever changes owners, your data would remain protected by this policy and we would tell you first.

6. Where it is stored

Your data is stored on Supabase and RevenueCat servers in the United States. If you live outside the U.S., this means your data is transferred there; by creating an account you consent to that transfer (including, for people in Argentina, under section 12 of Law No. 25,326). Our providers encrypt data in transit and at rest and are contractually bound to protect it.

7. How long we keep it

While you have an account: your expenses, settings and account data.
When you delete your account: removed immediately from the database. It may remain in the provider's automatic backups until they expire (30 days at most); it isn't used for anything and then disappears.
Technical request data: the short period each provider keeps it (usually days).
Emails you send us: as long as needed to reply and up to 1 year after.
Apple keeps its own records of purchases and sign-in under its policies.

8. How we protect it

All communication is encrypted (HTTPS).
The database is configured so each account can only see and change its own data: nobody else can read your expenses.
The shortcut key is stored as a hash: not even we can read it.
Service keys are kept in an encrypted vault and never reach the app.

No system is 100% secure. If an incident affects your data, we will notify you and the authorities when the law requires it.

9. Your rights

Wherever you live, you can ask us to:

Access the data we hold about you and get a copy.
Correct inaccurate data (you can edit most of it yourself in the app).
Delete your data (you can do it yourself in Settings › Delete my account).
Object or withdraw consent for uses based on it (for example, disconnecting the shortcut).
Portability: receive your expenses in a common format.

Email pedroferrucci2006@gmail.com from your account's email, or tell us how to verify the account is yours. We reply within 30 days at most (10 business days for access and 5 for correction or deletion if you are in Argentina). Exercising your rights is free and will never get you worse treatment.

United States

If you live in California or another state with a consumer privacy law, you have the right to know what personal information we collect, to request deletion or correction, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of. You may act yourself or through an authorized agent.

Canada

We handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA). You can access and correct your information and withdraw consent as described above. If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

Argentina

El titular de los datos personales tiene la facultad de ejercer el derecho de acceso a los mismos en forma gratuita a intervalos no inferiores a seis meses, salvo que se acredite un interés legítimo al efecto conforme lo establecido en el artículo 14, inciso 3 de la Ley N° 25.326. La AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, en su carácter de Órgano de Control de la Ley N° 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales.

Uruguay

You have the rights of access, rectification, update, inclusion and deletion under Law No. 18,331. The supervisory authority is the Unidad Reguladora y de Control de Datos Personales (URCDP).

10. How to delete your account

In the app: Settings › Delete my account. When you confirm:

Your account, expenses, recurring expenses, categories, settings, business and shortcut key are deleted.
MySpent's Sign in with Apple access is revoked.
Your RevenueCat record is deleted.

Important: deleting your account does not cancel your subscription, because Apple bills it. Cancel it in iPhone Settings › your name › Subscriptions. If you can't open the app, email us and we will delete it for you.

11. Children

MySpent is not directed to children under 13 and we do not knowingly collect data from children under 13. If you are a parent or guardian and believe a child under 13 gave us data, contact us and we will delete it. Anyone between 13 and the age of majority in their country needs permission from a parent or guardian.

12. Changes to this policy

If we change this policy, we update the date above. If the change is significant (for example, a new use of your data), we tell you in the app before it applies.

13. Contact

pedroferrucci2006@gmail.com