Privacy Policy
Effective as of 2026-06-25
This Privacy Policy applies to the Spender mobile application, together with any related services operated by Noam Shalev (collectively, the "Application"). Noam Shalev is referred to as the "Service Provider". The Service Provider is the data controller responsible for your personal data.
This policy explains what data the Application collects, how it is used and shared, how long it is kept, and the rights you have. By using the Application you acknowledge the practices described here.
Information You Provide
To create an account and use the Application, you provide certain personal information, which may include:
• Account details: email address, password, and full name
• Profile details: age, general region within the country, and gender (used to personalize the experience and Hebrew grammatical forms)
• Financial details you enter: your monthly salary, estimated monthly expenses, savings goal, and the spending entries, savings, and planned-purchase "tokens" you log in the app
You choose what to enter. Some information (such as email, password, and budget figures) is required for the Application to function.
Information Collected Automatically
When you use the Application, certain information may be collected automatically to operate, secure, analyze, and improve the service. This may include: technical and device information (such as device type and model, operating system and version, app version, language and region settings, network information, and unique or device identifiers); log and diagnostic data (such as crashes, errors, and performance metrics); and usage and analytics data (such as the features and screens you use, in-app actions and events, the time, frequency, and duration of your use, and how you interact with the Application).
To collect, measure, and understand this information, the Service Provider may use its own tools together with third-party analytics, attribution, performance-monitoring, and crash-reporting services and software development kits (SDKs), now or in the future. These providers may process such data on the Service Provider's behalf and may set or read identifiers on your device. The specific tools used may change over time as the Application evolves. Where required by applicable law, the Service Provider will provide notice and obtain your consent before using non-essential analytics or tracking technologies, and you will be able to manage your choices. Because the Application runs natively on your device, it does not rely on browser cookies, but similar technologies (such as SDKs and device identifiers) may be used for the purposes described here. The Service Provider does not sell your personal information.
How We Use Your Information
The Service Provider uses your information to:
• Provide and operate the budgeting features, including calculating budgets, savings, and illustrative compound-interest projections
• Generate optional AI coaching messages and reflections (see "Artificial Intelligence" below)
• Authenticate you, secure your account, and sync your data across your devices
• Send important service and legal notices
• Maintain, troubleshoot, and improve the Application
• Comply with legal obligations and enforce our Terms
Artificial Intelligence
The Application offers optional AI-powered coaching and reflection features. When you choose to use them, a summary of your in-app financial activity (such as streaks, totals, spending and saving categories, and budget figures) is sent to our AI provider, Anthropic, and processed by the Claude API to generate a personalized message.
This processing takes place on servers located in the United States. Under the Service Provider's agreement with Anthropic, data sent through the API is not used to train Anthropic's models. AI output is generated automatically, may be inaccurate or incomplete, and does not constitute financial advice (see the Terms & Conditions). If you do not use the AI features, no financial data is sent to the AI provider for this purpose.
Service Providers (Sub-processors)
The Service Provider relies on a small number of trusted providers that process data on its behalf, under contract, and that have no independent right to use your information:
• Supabase — database, authentication, and secure hosting of your account and ledger data
• Anthropic — the Claude AI model that powers the optional coaching and reflection features
The Service Provider may also engage analytics, attribution, infrastructure, and similar service providers from time to time to operate and improve the Application. This list may be updated as those providers change; in all cases such providers process data on the Service Provider's behalf, for the purposes described in this policy.
Legal Bases for Processing (GDPR)
Where the EU/UK General Data Protection Regulation applies, the Service Provider processes personal data on the following bases: performance of the contract (to provide the Application you signed up for); your consent (for example, optional AI features or any future marketing); the Service Provider's legitimate interests (to secure, maintain, and improve the Application); and compliance with legal obligations.
How We Share Information
The Service Provider does not sell your personal information. It may share information only as follows:
• With the service providers listed above, solely to operate the Application
• In aggregated or anonymized form that no longer identifies you, to understand and improve the service
• As required by law, such as to comply with a subpoena or similar legal process
• When necessary, in good faith, to protect the rights, property, or safety of the Service Provider, users, or the public, or to investigate fraud
International Data Transfers
The Service Provider and its providers (including Supabase and Anthropic) may process and store personal data in countries outside your country of residence, including outside the European Economic Area (EEA) — notably the United States. Where required by applicable law, appropriate safeguards are used for such transfers, which may include:
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions or other legally recognized transfer mechanisms
• Your consent, where required and legally permitted
Your Rights
Subject to applicable law, you may request access to, correction of, deletion of, or a copy of your personal data, and you may object to or restrict certain processing or withdraw consent (without affecting processing carried out before withdrawal). You can exercise most of these directly: you may edit your profile and budget in the app at any time, and you can permanently delete your account and all associated data from Settings, then Delete Account. To make any other request, contact the Service Provider at spender.save@gmail.com.
Your Israeli Privacy Rights
If you are in Israel, your personal data is handled in accordance with the Protection of Privacy Law, 5741-1981 (including its amendments, such as Amendment 13). You have the right to review the personal data held about you and to request its correction or deletion. If you believe your rights have been infringed, you may also contact the Israeli Privacy Protection Authority (PPA). To exercise these rights, contact the Service Provider at spender.save@gmail.com.
Your California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information is collected, the right to delete personal information, the right to correct inaccurate information, the right to opt out of the sale or sharing of personal information (the Service Provider does not sell or share personal information for cross-context behavioral advertising), and the right to non-discrimination for exercising these rights. To exercise your CCPA/CPRA rights, contact the Service Provider at spender.save@gmail.com.
Marketing Communications
The Service Provider will send you service-related and legally required messages as part of operating your account. It will send promotional or marketing messages only where you have opted in, consistent with applicable law (including Israel's anti-spam rules under the Communications Law (Telecommunications and Broadcasting), 5742-1982). You can withdraw consent and opt out of marketing at any time by contacting the Service Provider.
Data Retention
The Service Provider retains personal data only as long as necessary for the purposes described here:
• Account and ledger data you provide: retained while your account is active. When you delete your account, this data is deleted
• Technical and diagnostic data: retained for a limited period needed for security and troubleshooting
• Aggregated and anonymized data: may be retained indefinitely as it no longer identifies you
• Data required for legal compliance: retained as long as required by applicable law
Account Deletion
You can permanently delete your account at any time from within the Application: open Settings, choose Delete Account, and confirm. This removes your account and the personal data associated with it (profile, budget, entries, and tokens). Deletion is immediate and cannot be undone. You may also request deletion by contacting the Service Provider at spender.save@gmail.com. Uninstalling the Application alone does not delete data already stored on the server.
Security
The Service Provider takes reasonable measures to protect your information, including encryption of data in transit (TLS), encryption at rest provided by its hosting infrastructure, access controls, and authentication. No method of transmission or storage is completely secure, so absolute security cannot be guaranteed. You are responsible for keeping your password confidential and your device secure.
Data Breach Notification
If a data breach occurs that affects your personal data, the Service Provider will notify affected users and the relevant authorities in accordance with applicable legal requirements, including, where required, information about the nature of the breach and the steps being taken to address it.
Children
The Application is not intended for children under 16 years of age, or such higher age as required by applicable law. The Service Provider does not knowingly collect personal data from children or market the Application to them. If you believe a child has provided personal data, please contact the Service Provider at spender.save@gmail.com so it can be deleted. If you are under 16, a parent or legal guardian must consent on your behalf where permitted by law.
Changes to This Policy
The Service Provider may update this Privacy Policy from time to time. Material changes will be notified by posting the updated policy with a new effective date and, where required by law, by seeking your consent before the changes take effect. Previous versions are available on request.
Your Consent
Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature or action. You may withdraw consent at any time, without affecting processing carried out before withdrawal. Processing based on other lawful bases continues as described above.
Contact Us
If you have any questions about this Privacy Policy or how your data is handled, contact the Service Provider by email at spender.save@gmail.com.