Privacy Policy

This Privacy Policy explains how Spendset collects, uses, and shares information when you use the Spendset website and app at Spendset.co.

Spendset is a zero-based budgeting product. You use it to plan monthly budgets, income, spending categories, transactions, accounts, goals, sinking funds, bills, and related summaries such as Available to Spend, Safe Today, Until Payday, and SpendCheck.

This policy describes current practices. It is a product document, not a claim of any particular certification or regulatory status.

You choose what to enter. Spendset stores the information you submit so the product can show your budget and related tools. That may include:

• Name
• Email address
• Authentication information, such as a password you create with Spendset
• Budgeting data, including monthly plans, category amounts, and rollovers
• Account names and balances you type in yourself
• Income information
• Transactions
• Categories and category groups
• Goals
• Merchant names, notes, and other labels you enter
• Bills and other information you add voluntarily
• Optional reminder preferences, if you turn reminders on

Spendset currently does not require you to connect a bank account. It does not ask for online banking usernames, passwords, or other bank-login credentials. Account names and balances in Spendset are values you enter, not a live feed from your bank.

You can create an account with an email address and password. Authentication is handled through Supabase. Spendset does not receive your password in a form it can read; password handling is performed by the authentication service.

You may also sign in with Google. That is optional. If you use Google Sign-In, Google may provide basic profile information such as your name, email address, and profile image, according to the permissions you grant Google. Spendset does not receive your Google password.

Spendset also uses authentication for account security steps, such as confirming it is you before you delete your account, and for password recovery emails.

When you use Spendset, hosting and authentication systems may process technical information that is typical of running a website or app. That can include:

• Basic request and log information, such as the pages or endpoints you access and when
• Device and browser information, such as user-agent data
• IP address, where a service provider processes it as part of delivering the service
• Authentication and security logs
• Technical diagnostics, such as error details used to troubleshoot problems

Spendset uses Cloudflare Turnstile to detect and prevent automated abuse on public forms, including signup, password reset requests, and the contact form. Cloudflare may process technical information such as IP address and browser data to run that check.

Spendset uses Vercel Web Analytics to understand how people use the public site and product (for example, which pages are visited and coarse product milestones such as starting signup or completing onboarding). Vercel Web Analytics is designed to avoid cookies and does not use advertising trackers or session replay.

Spendset does not intentionally send budgeting amounts, transaction details, merchant names, notes, category names, balances, or other sensitive financial content to analytics. Analytics events are limited to behavioral milestones used to improve Spendset.

Spendset does not include an advertising SDK or marketing tracking pixel in the application.

If you enable reminders, Spendset stores a Web Push subscription for your browser or installed app so it can send the alerts you chose. That subscription includes a push endpoint from your browser vendor. Reminder text is kept short. It may name a bill or category, and it does not include account balances.

Spendset stores small pieces of information in your browser so the product can function. That includes staying signed in, remembering display preferences such as theme, supporting installable-app (PWA) behavior, and keeping short-lived session flags for flows like password recovery or returning from Google Sign-In.

These are functional stores. Spendset does not use them to run advertising or cross-site tracking.

Spendset uses the information described above to:

• Provide and operate Spendset, including syncing your budget across your devices
• Authenticate you and protect your account
• Calculate budgets and financial summaries from the data you enter
• Send account and security emails, such as signup confirmation and password recovery
• Send optional reminders you enable, such as bill, payday, spending caution, and weekly check-in alerts
• Troubleshoot problems and keep the service working
• Protect the service against abuse and security threats
• Improve the product based on how it is used and where it fails

Spendset relies on other companies to run the product. They process information on Spendset's behalf, or as part of providing authentication, hosting, or email:

• Supabase, for authentication, database storage, and access controls
• Vercel, for deployment and hosting
• Google, if you choose Google Sign-In
• Email providers used to send account messages. Signup confirmation and password recovery currently go through Supabase Auth. Spendset also has an integration with Resend for transactional email when that path is used.
• Cloudflare Turnstile, to detect and prevent automated abuse on public forms such as signup, password reset, and contact
• Browser push services (for example Apple, Google, or Mozilla) if you enable reminders, to deliver those notifications

Those providers have their own practices. Spendset uses them to operate the service, not to sell your information.

Spendset does not sell personal information.

Spendset stores budgeting information you type in so it can calculate your plan. It is not a bank aggregation service and does not currently import transactions from a bank connection.

Figures such as balances, income, and spending are only as accurate as the information you enter. They are not a statement from your bank.

Spendset uses reasonable technical and organizational safeguards, including authentication and database access controls that are designed to keep your data scoped to your account.

No online service can be guaranteed completely secure. You should use a strong unique password and keep your devices and email account protected.

Account and budgeting data is generally kept while your account is active. If you delete your account, Spendset deletes associated budgeting data along with your login, subject to copies that may remain for a limited time in backups, logs, or other operational stores, and subject to retention that may be required for legal, security, or fraud-prevention reasons.

Exact backup retention periods are not published here.

You can delete your Spendset account from Settings in the app. Deletion is meant to remove your login and the budgeting data tied to it, including budgets, transactions, accounts, and goals you own.

Spendset may ask you to confirm it is you before deletion completes. Deleted information cannot be recovered from the live product.

Spendset is not intended for children under 13, and Spendset does not knowingly collect personal information from children under 13.

Spendset may update this Privacy Policy. When that happens, the last-updated date at the top of this page will change. Continued use of Spendset after an update means you should review the revised policy.

This Privacy Policy is for the Spendset service at Spendset.co. Related terms are in the Terms of Service.

A support email is not published on this page yet. Spendset will add a contact address here when one is available.