We do not have your financial data.

Spenlyx is published from Australia and is the entity responsible for this statement. Questions and requests go to support@spenlyx.app. We handle personal information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles.

This statement covers both halves of Spenlyx: the app you install on your phone, and spenlyx.app, the site you are reading. Where something is true of only one of them, it says so.

This is the important part, so it goes first. We do not collect, receive, store or have any way to access:

There is no sign-up and no account, so there is no profile of you anywhere in our systems.

Everything Spenlyx knows about your money is held in the app's own storage on your phone, protected by your device's encryption and passcode: every transaction extracted from your statements, the categories and corrections you make, and the totals and charts built from them. The statement file itself is not kept — it is deleted as soon as the import finishes, is cancelled, or fails.

The reader that interprets your statements also runs on the device. When Spenlyx reads a PDF, no part of that file is sent anywhere. This is why there is a download on first run and why reading takes a minute or two — the work happens on your phone rather than on a server.

One thing, listed in full.

Your phone's own backup is the one ordinary feature that can copy Spenlyx data off the device, and it is Apple's or Google's mechanism rather than ours. On Android, Spenlyx is deliberately excluded from Google's backup, so it does not leave that way. On iPhone, a device backup includes the app like any other, under Apple's terms. This version has no export, so there is no file for you to send anywhere either. Nothing here passes through us.

spenlyx.app is a handful of pages: what the app does, this statement, and the terms. It sets no cookies, runs no analytics, and loads no third-party scripts or fonts from anywhere else — which is why you were never asked to accept anything. There is nothing to accept.

The one thing the site does beyond serving pages is answer your phone’s request for the reader, described above. Our hosting provider keeps ordinary web server logs either way — an IP address, a timestamp, the page requested — which we use to keep the site up and nothing else.

The site and the reader download are served from a content delivery network with machines in many countries, so the request your phone or browser makes may be answered from outside Australia, and the log line it leaves may be written there. That is the whole of it. Your statements and transactions never leave your device, so there is nothing else of yours that could be transferred anywhere.

Apple and Google give every developer aggregate figures about downloads, countries, crashes and ratings. We see counts and trends, never individual users, and we cannot connect any of it to a person. That reporting is theirs; their privacy policies govern it.

We do not sell, rent or trade personal information. We do not run advertising or advertising SDKs, and there are no third-party trackers in the app. We do not use your financial data to train the reader or any other model, because we do not have it. If we ever needed to change any of this, it would require a new version of the app, a new version of this page, and a clear notice in the app before it took effect.

Three clocks, and only the last one is ours to run:

Deleting the app deletes everything it held. You can also delete all saved data from Settings. There is no request to send us and no waiting period, because the data was never anywhere but your phone. If your phone's backup includes Spenlyx, remove it there as well.

Spenlyx is made for adults managing their own money, and is not directed at anyone under 18. We do not knowingly collect personal information from anyone, of any age — there is no mechanism in the app that could.

Australian privacy law gives you the right to ask what personal information an organisation holds about you, to have it corrected, and to complain about how it was handled. Write to support@spenlyx.app and we will answer within 30 days. In most cases the answer will be that we hold nothing about you, since the app collects no identifiers.

If our response does not satisfy you, you can take the complaint to the Office of the Australian Information Commissioner at oaic.gov.au. If you are in the EEA or the UK, you may also contact your local data protection authority.

The GDPR asks for a lawful basis for every kind of processing. Ours is brief, because the processing is: we rely on our legitimate interest in delivering the app, serving the reader file, and keeping both running and secure — which is the only reason a request log exists at all. We ask for no consent because we need none, we do no profiling or automated decision-making, and we process nothing for advertising.

The rights set out above are yours under the GDPR as well, and you can take a complaint to your local data protection authority instead of, or as well as, writing to us.

Your data sits inside the app's private storage, covered by the encryption your phone applies to it while the device is locked. Downloads travel over TLS. The strongest protection here is structural rather than technical: there is no central store of statements to breach.

If this statement changes we will update the date at the top and, when the change matters, tell you in the app before it takes effect. Earlier versions are available on request.

Anything at all about privacy: support@spenlyx.app.