1. Overview
This policy explains what Snapspend ("the Service") collects, why it is collected, how long it is kept and what control you have over it. It applies to the Service only. The Adarsh Yadav website has its own privacy policy.
The Service is operated by Adarsh Yadav, an independent software developer working as a sole trader rather than an incorporated company. The guiding principle is simple: collect the minimum needed to make the product work, be explicit about it, and delete it when it is no longer needed.
Your spending can reveal a lot about your life. Expenses and receipt photos are stored on your iPhone, are never sold or used for advertising, and are only sent to the AI provider when you have allowed Snapspend AI and use a feature that needs it.
2. What is collected and why
Every category of data handled by the Service is listed below, together with its purpose and retention period.
| Category | Examples | Purpose | Retention |
|---|---|---|---|
| Account | Email address, sign-in method (Apple or email) and an account ID | To sign you in, protect the AI service from abuse and link your subscription | Until you delete your account |
| Expenses and budget | Shops, dates, amounts, items, categories, notes, your monthly budget, currency and first name | To keep your expenses, reports, budget pace and Coach tips | On your iPhone only, until you delete them, erase your expenses or delete the app |
| Receipt photos | Photos of receipts you take or choose | To read the receipt and show it with the expense | On your iPhone only, until you delete the expense or erase your expenses |
| AI requests | A receipt photo, Coach questions, and a short summary of your spending sent with Coach and report-summary requests | To read the receipt or answer the question, only if you have allowed Snapspend AI | Not stored by the developer; the AI provider keeps them only as described below |
| AI usage | A daily count of AI requests for your account | To apply the fair-use limit | Until you delete your account |
| Subscription | Whether Pro is active, the plan, renewal date and store transaction IDs, with your account ID | To unlock Pro and keep subscription records | For as long as the store and tax law require |
| Subscription screen | When the Pro screen opens and closes, the plan you pick and whether you subscribe, with your account ID, device model, iOS and app version, language and an approximate region worked out from your IP address | To show the Pro subscription screen and measure how well it works | Kept by Superwall for the developer's reports; never sold or used for advertising |
| Settings | Appearance, reminder choice, whether Snapspend AI is allowed | To remember how you set the app up | On your iPhone until changed or the app is deleted |
3. Permissions the app requests
Each permission is requested in context, with an explanation, at the moment it is first needed — never in a burst at first launch. Optional permissions can be declined and the app keeps working without them.
| Permission | Platform identifier | Why | Required |
|---|---|---|---|
| Camera | NSCameraUsageDescription | Optional — photograph receipts. | Optional |
| Photo library | NSPhotoLibraryUsageDescription | Optional — pick a photo of a receipt you already took. | Optional |
| Notifications | UNUserNotificationCenter | Optional — a Sunday evening reminder to read your weekly report, scheduled on your phone. | Optional |
Any permission can be revoked at any time in your device settings. Revoking a required permission stops the features that depend on it, but does not delete your account or your data.
4. Snapspend AI
Snapspend AI is optional. The app asks during setup whether it may send what the AI features need to OpenAI, and you can change your mind any time in Profile → AI & privacy. With it off, receipts are read and the Coach answers on your iPhone.
- What is sent: the receipt photo you scan, your Coach questions, and for the Coach and report summaries a short summary of your spending. Your name and email are not sent.
- OpenAI processes requests through its API, which does not use them to train its models. The app asks OpenAI not to store them; OpenAI may keep them for up to 30 days to detect abuse, then deletes them.
- The developer's server checks your account and counts your requests for the daily fair-use limit, but does not keep the photo, text or answer.
- If the AI provider ever changes, this policy will be updated and the app will ask for your permission again.
5. Deleting your data
- Profile → Erase all expenses deletes every expense, receipt photo and Coach conversation on your iPhone.
- Profile → Delete account deletes your account and its AI usage records from the server, and erases your data on the phone.
- Deleting the app removes everything stored on the phone. A Pro subscription is managed by Apple: cancel it in Settings → your name → Subscriptions.
6. What is never done
- Your data is never sold, rented or traded.
- Your content is never used to train machine learning models.
- There is no advertising in the Service and no advertising trackers are embedded.
- No data is shared with data brokers.
- No profile is built about you for any purpose beyond operating the Service.
7. Legal basis for processing
Personal information is handled in line with applicable privacy law wherever you are. Where GDPR-style law applies, processing rests on one of the following bases:
- Contract — processing needed to provide the Service you signed up for.
- Legitimate interests — keeping the Service secure, reliable and free from abuse, balanced against your rights.
- Consent — optional features such as marketing email, which you can withdraw at any time.
- Legal obligation — retaining billing records where tax or accounting law requires it.
8. Service providers
The Service relies on the providers listed below, and only for the purposes described. Each receives only what it needs for that purpose and processes it on the developer's behalf, under its own security and data-protection commitments.
| Provider | Purpose | Region |
|---|---|---|
| Supabase | Accounts and sign-in, and the server that checks your account and counts AI requests before passing them to the AI provider. | India (AWS Mumbai) |
| OpenAI | Reads receipt photos and writes Coach replies and report summaries — only if you allow Snapspend AI. Sent without your name or email. | United States |
| RevenueCat | Records subscription purchases and renewals for your account. | United States |
| Superwall | Shows the Pro subscription screen and measures how it performs — whether it was seen, the plan picked and whether you subscribed — with your account ID and basic device details. Not used for advertising. | United States |
| Apple | App Store payments, Sign in with Apple, and on-device text recognition. | Global |
9. Security
- All traffic is encrypted in transit with TLS 1.2 or higher.
- Data at rest is encrypted using provider-managed encryption.
- Access to production systems is restricted, individually credentialed and requires multi-factor authentication.
- Secrets are stored in a managed secret store, never in source control.
- Dependencies are monitored for known vulnerabilities and patched on a regular cadence.
No system is perfectly secure. If a breach affecting your personal data occurs, you will be notified without undue delay, and the relevant supervisory authority within 72 hours where the law requires it.
10. Your rights
Regardless of where you live, you can exercise all of the following:
- Access — request a copy of the data held about you.
- Correction — fix anything inaccurate.
- Deletion — remove your account and associated data.
- Portability — export your data in a machine-readable format.
- Objection and restriction — object to or limit certain processing.
- Withdraw consent — for anything based on consent, at any time.
Most of these are self-service inside the Service. For anything else, email support@adarshyadav.com and it will be actioned within 30 days.
11. Regional privacy rights
The rights above are offered to everyone, everywhere. Some regions add specific rights or wording, set out below. Exercising any of them is free, and you will never be treated differently for doing so.
| Region | Framework | What it adds |
|---|---|---|
| European Economic Area | GDPR | Legal bases as listed above, data portability, objection to processing, and the right to lodge a complaint with your supervisory authority. |
| United Kingdom | UK GDPR & Data Protection Act 2018 | The same rights as the EEA, with complaints directed to the Information Commissioner's Office (ico.org.uk). |
| California | CCPA / CPRA | Rights to know, delete, correct and opt out of sale or sharing. No personal information is sold or shared for cross-context behavioural advertising, so there is nothing to opt out of. Sensitive information is used only to provide the Service. |
| Canada | PIPEDA | Access and correction rights, meaningful consent, and the right to complain to the Office of the Privacy Commissioner of Canada. |
| Brazil | LGPD | Confirmation of processing, access, correction, anonymisation, portability, deletion, and information about data sharing. |
If your region is not listed, the rights in the previous section still apply — email support@adarshyadav.com and your request will be handled the same way.
No authorised agent, verification fee or account requirement stands between you and these rights. Requests are verified only to the extent needed to confirm you are the person the data relates to.
12. Retention and deletion
Data is kept only as long as the purpose in the table above requires. When you delete your account, associated data is removed from production systems within 30 days and purged from encrypted backups within 90 days, except where a legal obligation requires longer retention.
13. International transfers
The providers listed above may process data outside your country. Where personal data leaves the UK or EEA, transfers are covered by Standard Contractual Clauses or an equivalent approved safeguard.
14. Children
The Service is not directed at children under 13. Accounts are not knowingly created for anyone under that age. If you believe a child has provided personal data, email support@adarshyadav.com and it will be deleted promptly.
15. Changes to this policy
If this policy changes materially, the effective date is updated and account holders are notified by email before the change takes effect. Past versions are available on request.
16. Contact
Questions, requests or complaints about privacy: support@adarshyadav.com. If you are not satisfied with the response, you can complain to the data protection authority in your country.