Privacy Policy

Last updated: 2026-09-08

This page says exactly what spendx stores about you, who else sees it, where it lives, how long it survives, and how to exercise your rights. It describes the app as it is today; when a feature that touches your data ships, this page changes on the same day and the date above moves.

Who is responsible

spendx is operated by Nguyen An Nguyen, an individual based in Vietnam. For anything about your personal data, write to support@spendxapp.com and a person will reply.

Personal data is handled under Vietnam's Decree 13/2023/ND-CP on personal data protection. spendx is built for people in Vietnam and does not run a GDPR or CCPA compliance program; the rights listed below are available to every User wherever they are.

What spendx stores about you

Everything below is created by you using the app. spendx has no analytics, no advertising identifiers, no crash reporting, and never reads your contacts, location, photos, or files.

Your account

• your email address, and whether you have proved control of it (Email Verification);
• your Username and Display Name;
• a password hash if you set a password. The password itself is never stored and cannot be recovered from the hash;
• if you use Sign in with Google, a Linked Identity: the stable Google account identifier (the "subject") that lets Google vouch for you next time. No Google access token or refresh token is stored;
• your Locale (English or Vietnamese) and your Preferred Currency;
• when the account was created, when it last changed, and when its credentials last changed.

What you log

• every Expense: its description, its Original Amount (the amount and currency exactly as entered), Category, Expense Date, when it was logged, and its Visibility (Private, Friend-only, or Public);
• each Expense's Conversion Snapshot: the amount expressed in every Supported Currency at the exchange rate of the day it was logged, frozen at that moment;
• every Like you give.

Who you are connected to

• your Friendships, pending Friend Requests sent and received, and Blocks you have made.

Short-lived security data

• One-Time Codes, the 6-digit codes emailed to you for Email Verification and Password Reset, stored only as a hash. Each is deleted when used, replaced by any newer code for the same purpose, and expires on its own (15 minutes for a Password Reset, 24 hours for Email Verification).
• your IP address, seen by the server on every request. It is held in memory for up to one minute to limit how many requests one address may make, and it may appear in server logs. Logs are capped at 30 MB per service (three files of 10 MB) and overwrite themselves from the oldest entry; nothing is exported from them.

Only on your device

• your sign-in token, your Appearance setting, and the Daily Reminder. The Daily Reminder is a notification the app schedules and shows on the device itself. It sends nothing to spendx or to anyone else, and whether it is on and at what time is stored only on that device.

Who else sees it

Visibility is your control. Every Expense carries a Visibility you choose when you log it and can change at any time:

• Private: only you.
• Friend-only: you and your Friends.
• Public: every signed-in User, on the Feed, except anyone you have blocked or who has blocked you.

Whoever can see an Expense can also see its Likes, and can Like it. Friends see your Shareable Spend on the Leaderboard, the sum of your Friend-only and Public Expenses; your Private Expenses are never counted into anything anyone else sees.

Your Username and Display Name are shown wherever you appear to other Users: on your Expenses, your Likes, Friend Requests, and the Leaderboard. Anyone who knows your exact Username can find you. Your email address is never shown to other Users. Blocking someone is not announced to them.

spendx does not sell personal data, does not share it with advertisers, and does not use it for anything other than running the service.

Where it lives

Your data is stored in Vietnam, on a server rented from Nhân Hòa. Three providers outside Vietnam handle a narrow slice of it, each for one purpose only:

• Cloudflare R2 (Cloudflare, Inc., United States) holds nightly backups of the database, encrypted at rest, for up to 30 days. Backups exist for disaster recovery of the whole service only. They are never used to restore an individual account, nor to bring back anything a User deleted. Cloudflare also serves this website, described below.
• Resend (Resend, Inc., United States) delivers email on spendx's behalf. It receives your email address and the content of the message, which is always one of the two emails listed in the next section.
• Google (Google LLC, United States) is involved only if you use Sign in with Google. Google tells spendx your Google account identifier, your email address, whether Google has verified that address, and your name, which the app offers as your Display Name when you first sign up. spendx keeps the identifier and the account fields you confirm, and no Google token. What Google does with your sign-in is governed by Google's own privacy policy.

Daily exchange rates come from a public dataset and involve no personal data. Nothing else about your account leaves Vietnam.

Emails spendx sends

spendx sends exactly two kinds of email, both only when you ask for them in the app:

• an Email Verification code, when you sign up (unless Google has already vouched for your address) or when you ask to verify your address from the Profile tab;
• a Password Reset code, when you tap "Forgot password?".

There is no newsletter, no marketing email, and no notification email. If you ever receive anything else claiming to be from spendx, it is not from us.

How long it survives

• Your account and everything in it: for as long as the account exists.
• One-Time Codes: until used, replaced, or expired, whichever comes first.
• IP addresses: in memory for up to one minute; in server logs until the cap described above rolls them off.
• Backups: up to 30 days after the night they were taken.

Deleting your account

Account Deletion is immediate and irreversible. It removes your account, every Expense you logged whatever its Visibility, every Like you gave and received, your Friendships, Friend Requests, Blocks, Linked Identities, and One-Time Codes. There is no grace period, and a later sign-up with the same email or Google account is a new account with no link to the old one. The one caveat is backups: a backup, encrypted at rest, may hold a copy for up to 30 days after deletion, after which no copy remains.

You can delete your account yourself with Delete account in the Profile tab, or by email if you no longer have the app. The Account Deletion page has both procedures.

Your rights

Under Decree 13/2023/ND-CP you have the right to know what spendx holds about you and to control it. In practice:

• Access. Everything spendx stores about you is visible in the app: the Profile tab shows your account fields and your blocked accounts, the Expenses tab shows every Expense with its Visibility, and the Leaderboard shows your Friends. Email us for a copy of your data in a readable format.
• Correction. Change your Locale and Preferred Currency in the Profile tab. Edit an Expense's description, Category, Expense Date, and Visibility from the Expense itself. The Original Amount is fixed by design; to correct it, delete the Expense and log it again. Username and Display Name cannot yet be changed in the app; email us and we will correct them by hand.
• Deletion. Delete any Expense at any time, or the whole account as described above.
• Withdrawal of consent. Using spendx is the only consent it relies on. Withdraw it by deleting your account; there is nothing to opt out of separately, because there is no marketing and no optional data collection.
• Complaint. Write to support@spendxapp.com first; we answer every request. You also have the right to complain to the competent Vietnamese authority for personal data protection.

To act on a request we need to know it comes from you. Requests sent from the email address on your account, naming your Username, are enough. We cannot act on a request about an account from an address that is not the account's own.

Children

spendx is not for anyone under 16. We do not knowingly hold an account for a child; if you believe one exists, email us and it will be deleted.

This website

spendxapp.com is a static site served by Cloudflare Pages (Cloudflare, Inc., United States), separately from the app's server in Vietnam. It sets no cookies, runs no scripts, and loads nothing from any other origin. Like any web host, Cloudflare sees the requests it serves and keeps its own operational logs under its own privacy policy; spendx adds no tracking of its own and receives nothing about your visit.

Changes

When this policy changes, the date at the top changes with it. Nothing new is collected, and nobody new gets to see your data, before this page says so.