1. Who we are
SpendRoast is made by GN Infotech, based in Noida, Uttar Pradesh, India. This policy explains what data the app handles, where it stays, and the choices you have. It applies to the SpendRoast Android app and this website.
SpendRoast is designed so that we never receive your financial data. There is no SpendRoast account and no SpendRoast server that stores your transactions.
2. Summary
| Data | Where it goes |
|---|---|
| Transactions, accounts (last 3–4 digits only), budgets, goals, challenges, roasts, settings | Stored only on your phone. Never sent to us. |
| Text of bank SMS or pasted messages | Read on your phone, then discarded. Never stored or uploaded. |
| Approximate location (optional "local roasts") | Turned into a city name on your phone. Coordinates are discarded; only the city name is saved. |
| Advertising ID, device and app information (free plan only) | Processed by Google AdMob to show ads, subject to your consent where required. No financial data is ever included. |
| Purchase records for Pro | Handled by Google Play. |
3. Data kept on your device
The app keeps the following in a private database on your phone, which other apps can't read:
- Transactions: amount, currency, type, date, merchant, category, your notes, how it was added (SMS, paste, CSV, manual) and, if the message included it, the last 3–4 digits of the account or card.
- Accounts: bank name, last 3–4 digits, and the latest balance or card limit a bank message reported. Full account numbers are never stored.
- Your setup: budgets, categories, merchant rules, savings goals and their entries, challenges, and choices about detected subscriptions.
- Roast history: roasts shown to you, kept for 180 days.
- Settings: for example tone, language, quiet hours, display name (shown only in the app), app lock and privacy switches.
- A de-duplication fingerprint: a one-way hash (SHA-256) of each processed message, so the same payment isn't recorded twice. The message text can't be recovered from it.
This data is excluded from Android cloud backups. If you use Export, the app creates a CSV file in a location you choose. That file is not encrypted, and keeping it safe is up to you.
4. SMS messages
If you allow it, SpendRoast uses the READ_SMS and RECEIVE_SMS permissions to record payments from bank, card and UPI alerts automatically. This is the app's core money-management feature, and you can use the app without it.
- Only messages from senders that look like banks or payment services are processed. Messages from personal phone numbers are skipped.
- Each message is analysed on your phone to extract the amount, merchant, date, transaction type and account suffix. The message text is then discarded. It is never stored, logged, uploaded or shared, and it is never used for advertising.
- An optional inbox scan (last 30 or 90 days) runs only when you start it.
- You can turn off automatic capture in Settings or withdraw the permission in Android settings at any time.
5. Other permissions
- Notifications: to deliver roasts and, for Pro, bill reminders. The lock-screen version of every notification is generic and never shows amounts or merchants.
- Approximate location (optional): only for "local roasts", only while the app is open, and only after you turn the feature on. The app matches your rough location to a built-in list of cities on your phone, saves the city name and discards the coordinates. No precise or background location is used.
- Biometrics / screen lock (optional): for app lock. Android handles the check; the app never receives your fingerprint or face data.
- Internet: used only by the ads SDK for free users, by Google Play Billing, and (if you choose to download it) to fetch the optional on-device AI model. No financial data is sent in any of these.
6. What leaves your device
Your financial data does not leave your phone. The only network activity is:
- Advertising (free plan only). See section 7.
- Google Play Billing, when you view or buy Pro. See section 8.
- The optional on-device AI model download, where available: a file is downloaded from a fixed address and checked. No data about you is sent, and the AI runs entirely on your phone.
- Things you choose to share, such as a share card or an exported CSV, which go wherever you send them.
The app contains no analytics or crash-reporting SDK.
7. Advertising
The free plan shows a small number of ads from Google AdMob: at most one full-screen ad a day, only on non-financial screens, plus optional rewarded ads you choose to watch. Pro has no ads.
- Ad requests contain no financial information: no transactions, amounts, merchants, categories, balances or message text. The app tells the ad SDK only that an ad slot is available.
- Google may collect and process your device's advertising ID, IP address, device and app information, and your interactions with ads, as described in How Google uses information from sites or apps that use its services.
- In the EEA, UK and Switzerland, and where else the law requires, you are asked for consent through Google's consent tool before ads are personalised. You can change your choice any time in Settings → Ad privacy choices.
- You can reset or delete your advertising ID, or opt out of personalised ads, in your Android settings (Settings → Google → Ads, or Settings → Privacy → Ads).
- We ask Google not to show ads for loans, credit, crypto or gambling in the app.
8. Payments
SpendRoast Pro is sold through Google Play. Google processes your payment details and keeps purchase records under the Google Payments Privacy Notice. The app only learns whether your Google account owns Pro, and saves that on your phone so Pro works offline. We never see your card or UPI details.
9. Sharing and the widget
- Share cards are created only when you tap Share. You see exactly what will be shared first; amounts are hidden unless you turn them on, and you can hide shop names. The image is drawn on your phone and goes only to the app you pick (for example Instagram or WhatsApp), where that app's own privacy policy applies. We don't receive a copy.
- The home-screen widget shows today's spend and your latest roast. The amount is hidden unless you turn it on, and nothing financial is shown while app lock or hidden amounts is on.
10. What we never do
- We don't sell or rent personal data.
- We don't share financial data with advertisers, data brokers, lenders or anyone else.
- We don't use your data to decide on credit, insurance or employment.
- We don't read personal messages.
11. Retention and deletion
- Data on your phone stays until you delete it. Roast history is trimmed automatically after 180 days.
- Delete everything: Settings → Privacy & data → Delete all data. Uninstalling the app also deletes its data from your phone.
- Because we hold no copy of your financial data, we can't recover it after deletion, and there is nothing for us to delete on our side. See Delete your data.
- Data held by Google for ads or purchases is managed through your Google account.
12. Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. These include rights under the EU and UK GDPR, India's Digital Personal Data Protection Act, 2023, and the California Consumer Privacy Act.
Your financial data stays on your phone, so you can use most of these rights directly in the app: view and edit everything, export it (CSV) and delete it. For ad data processed by Google, use Ad privacy choices and your Google account settings. For anything else, contact us (section 18). You can also complain to your local data protection authority.
Where the GDPR applies, the legal bases are: your consent (SMS capture, location, personalised ads); performing our contract with you (core app features, Pro); and legitimate interests (showing non-personalised ads to keep the free plan free).
13. Children
SpendRoast is a personal finance app intended for people aged 18 and over. It is not directed at children, and we don't knowingly process children's data. If you believe a child is using the app, the data can be removed with Delete all data.
14. Security
Your data is stored in the app's private storage, protected by Android's app sandbox and, on most phones, device encryption. You can add app lock and block screenshots. No method of storage is perfectly secure, so please protect your phone with a screen lock and keep exported files safe.
15. International users
SpendRoast can be used worldwide. Your financial data stays on your phone wherever you are. Google, as the ad and payment provider, may process data in other countries under its own safeguards.
16. This website
This website uses no cookies, no analytics and no third-party scripts or fonts. Our hosting provider may keep standard server logs (such as IP address, time and requested page) for security and reliability, for a limited time.
17. Changes to this policy
We'll update this page when the app changes how it handles data, and change the "Last updated" date. For significant changes, we'll also tell you in the app before they take effect.
18. Contact and grievances
Questions, requests or complaints about privacy:
- Email: s.kumarnahak2022@gmail.com
- Post: GN Infotech, Noida, Uttar Pradesh, India
- Grievance Officer (India): Suraj Nahak, s.kumarnahak2022@gmail.com. We aim to acknowledge complaints within 48 hours and resolve them within 30 days.