1. Introduction

Welcome to Expenso ("we," "our," or "us"). We are committed to protecting your privacy and ensuring transparency about how we collect, use, and share your information. This Privacy Policy applies to the Expenso mobile application and web service (collectively, the "Service").

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use our Service.

2. Information We Collect

2.1 Information You Provide to Us

We collect information that you voluntarily provide when using our Service:

• Account Information: Email address, name, and password when you create an account
• Expense Data: Information about expenses you create, including amounts, descriptions, categories, dates, and associated group members
• Group Information: Group names, member details, and settlement information
• Profile Information: Any additional information you choose to add to your profile

2.2 Information Automatically Collected

When you use our Service, we automatically collect certain information:

• Device Information: Device type, operating system version, unique device identifiers, and mobile network information
• Usage Data: Features you use, pages you visit, time spent on the Service, and interactions with the Service
• Log Data: IP address, browser type, access times, and pages viewed
• App Version: Version of the app you are using for update and compatibility purposes

3. How We Use Your Information

We use the collected information for the following purposes:

• To provide, maintain, and improve our Service
• To create and manage your account
• To track and split expenses among group members
• To calculate balances and settlements
• To send you notifications about your account and groups
• To respond to your comments, questions, and customer service requests
• To detect, prevent, and address technical issues and security vulnerabilities
• To enforce our Terms of Service and protect our legal rights
• To comply with legal obligations
• To send you updates about app versions and required updates
• To generate PDF exports of your expense data when requested

4. How We Share Your Information

4.1 With Group Members

When you join a group or add expenses, certain information (such as your name, expenses you create, and amounts owed) is shared with other members of that group. This is essential for the core functionality of the Service.

4.2 Service Providers

We use third-party service providers to help us operate and improve our Service:

• Supabase: We use Supabase for authentication, database storage, and backend infrastructure. Supabase processes your account information and expense data on our behalf.
• Cloud Hosting: Your data is stored on secure cloud servers to ensure availability and reliability.

4.3 Legal Compliance

We may disclose your information if required by law or in response to valid requests by public authorities (e.g., a court order or subpoena).

4.4 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

4.5 With Your Consent

We may share your information for any other purpose with your explicit consent.

5. Data Security

We take the security of your data seriously and implement appropriate technical and organizational measures to protect your information:

• All data transmission is encrypted using SSL/TLS protocols
• Passwords are encrypted using industry-standard hashing algorithms
• Access to personal information is restricted to authorized personnel only
• We regularly review our security practices and update them as needed

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security.

6. Data Retention

We retain your personal information for as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy. Specifically:

• Account information is retained until you delete your account
• Expense data is retained as long as the associated group exists or until you delete it
• We may retain certain information for longer periods if required by law or for legitimate business purposes

7. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

7.1 Access and Portability

You have the right to access and export your personal data. You can export your expense data to PDF format directly from the app.

7.2 Correction

You can update or correct your account information and expense data at any time through the app settings.

7.3 Deletion

You have the right to request deletion of your personal information. You can delete your account through the app settings, which will remove your personal data from our systems. Note that some information may be retained in backup systems for a limited period.

7.4 Opt-Out of Communications

You can opt out of receiving promotional emails by following the unsubscribe instructions in those emails. Note that you cannot opt out of service-related communications (e.g., account verification, changes to the Service).

7.5 Additional Rights (GDPR/CCPA)

If you are located in the European Economic Area (EEA), United Kingdom, or California, you may have additional rights:

• Right to object to processing of your personal data
• Right to restrict processing of your personal data
• Right to lodge a complaint with a supervisory authority
• Right to withdraw consent at any time
• Right to know what personal information we have collected (California residents)
• Right to non-discrimination for exercising your privacy rights

To exercise any of these rights, please use the Contact Us section below.

8. Children's Privacy

Our Service is not intended for children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children under these ages. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete such information.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country.

We take appropriate safeguards to ensure that your personal information remains protected in accordance with this Privacy Policy, including using standard contractual clauses approved by the European Commission for transfers from the EEA.

10. Third-Party Links and Services

Our Service may contain links to third-party websites or services that are not owned or controlled by us. We are not responsible for the privacy practices of these third-party sites. We encourage you to review the privacy policies of any third-party sites you visit.

11. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date at the top of this policy
• Sending you a notification through the app or email for significant changes

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

12. Data Controller and Data Protection Officer

For the purposes of applicable data protection law, Expenso is the data controller of your personal information. If you have any questions about our privacy practices or this Privacy Policy, you can contact our Data Protection Officer using the contact information below.

13. App Store Compliance

13.1 Google Play Store

In compliance with Google Play's data safety requirements:

• We collect and use data as described in this Privacy Policy
• User data is encrypted in transit using SSL/TLS
• User data is encrypted at rest
• You can request that your data be deleted
• We do not sell your personal information to third parties

13.2 Apple App Store

In compliance with Apple's App Store privacy requirements:

• Data collection is limited to what is necessary for app functionality
• We do not use data for tracking purposes across apps and websites owned by other companies
• We do not link user data to their identity for advertising purposes
• Users have control over their data through in-app settings

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

15. Legal Basis for Processing (GDPR)

If you are located in the EEA or UK, our legal basis for collecting and using your personal information depends on the data and the context:

• Contract Performance: Processing is necessary to provide the Service you requested (e.g., account creation, expense tracking)
• Legitimate Interests: We have a legitimate interest in improving our Service, ensuring security, and communicating with you
• Consent: You have given us permission to process your information for specific purposes
• Legal Obligation: We need to comply with legal requirements

16. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track activity on our Service:

• Essential Cookies: Required for authentication and basic functionality
• Preference Cookies: Remember your settings and preferences
• Analytics: Help us understand how users interact with the Service

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service.

17. Your California Privacy Rights (CCPA)

If you are a California resident, you have specific rights regarding your personal information under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect, use, disclose, and sell
• Right to request deletion of your personal information
• Right to opt-out of the sale of your personal information (we do not sell your data)
• Right to non-discrimination for exercising your CCPA rights

To exercise these rights, please contact us at privacy@rubanix.com. We will verify your identity before processing your request.

18. Your Consent

By using our Service, you consent to the collection and use of information as described in this Privacy Policy. If we make significant changes to how we handle your personal information, we will notify you and may request your consent again.