Last updated: October 3, 2026 Effective date: October 3, 2026
This Privacy Policy explains how the Spendy: Auto Expense Tracker mobile application (com.dakys.spendy, "Spendy" or the "App") handles your information, and what rights you have over it.
The App is developed and published by Matic Dakskofler, based in Slovenia ("we", "us", "our", the "developer"). For the purposes of the EU General Data Protection Regulation ("GDPR") and the UK GDPR we are the controller of any personal data we actually receive from you, which — as explained below — is very little.
Contact: dakysapps@gmail.com
Spendy keeps everything on your device. There is no account, no sign-up, no cloud sync and no server of ours that ever receives your financial data.
We cannot see your transactions, balances, categories, budgets, notes, merchants, notification text or settings. We do not have them.
The App contains no advertising, no analytics, no tracking and no crash-reporting SDKs. It does not use cookies.
If you grant notification access, notification text is read only on your device, only from the apps you pick, and only to spot a charge. It is never transmitted anywhere.
The only third party involved is Google Play, when you buy the one-time unlock or a subscription, or when the App checks whether you already have one. We never see your card details.
If a charge is in another currency, the App asks a public exchange-rate service for that day's rate. It sends only two currency codes and a date — never an amount, a merchant or anything else about you. You can turn this off (section 5a).
We do not sell, share, rent or trade personal information, and we never have.
You can delete everything at any time by deleting records in the App, using Android's Clear data, or uninstalling the App.
The rest of this document says the same thing in the detail that the law requires.
This Policy covers the Spendy Android app distributed through Google Play and any email conversations you have with us. It does not cover Google Play, Google Payments, your bank or payment apps, or any other app or website that Spendy links to or reads notifications from — each of those has its own privacy policy.
Everything below is written to a private, sandboxed database and settings store that only Spendy can read. It never leaves your device unless you export it yourself. We have no access to any of it and no copy of it.
Transactions you add or approve (amount, date, category, tag, account, note, merchant/store name) — Core expense tracking — Local database
Categories, tags and accounts you create — Organizing transactions — Local database
Monthly budgets — Budget tracking — Local database
Recurring-charge (subscription) definitions — Adding due charges automatically — Local database
Learned store rules (which merchant maps to which tag/category) — Pre-filling future detected charges — Local database
Detected-charge queue and log (each detected charge, with the notification text it was parsed from, while it awaits your review; confirmed or dismissed entries are deleted automatically after 30 days) — The review queue; avoiding duplicate detections — Local database
Skipped notifications (notifications from the apps you chose that show an amount but were not recorded, with the reason; kept 7 days, at most 50; can be turned off) — Showing you why a payment wasn't detected, so you can record it or adjust the detection — Local database
App settings (currency, language, reminder time, theme, feature toggles, which apps to watch) — Configuring the App — Local settings store
App-lock credential (PIN or pattern) — Locking the App — Stored only as a salted hash; never recoverable, never transmitted
First-install timestamp — Working out how much of the free trial remains — Local settings store
Premium entitlement flags (unlocked / subscription active) — Unlocking paid features — Local settings store, set only after Google Play confirms a purchase
Uninstalling the App or using Android's "Clear data" permanently deletes all of the above. Because we never receive it, we keep no copy and cannot restore it.
Some of this — your transactions and merchant names — is financial information, which several laws treat as sensitive. It is processed only on your device, by software under your control, for the purpose you installed the App for. We do not collect it, so we cannot use, disclose or sell it.
We designed Spendy so that we receive as little as possible. The complete list:
Purchase information from Google Play — when you buy the one-time unlock or the subscription, Google Play gives the App limited data (product ID, order ID, purchase token, purchase state and, for subscriptions, whether it is active). The App stores this on your device to decide whether paid features are unlocked. It is not sent to us. Google separately shows us, as the seller, aggregated sales figures and order records in the Play Console (order number, date, amount, country, and — for refund handling — the order ID); Google does not give us your name, email address or payment details unless you contact us through Google Play support channels.
Anything you send us yourself — if you email dakysapps@gmail.com, we receive your email address and whatever you write. We use it only to reply and to fix the problem you reported.
Nothing else. The App has no telemetry, no crash reporter, no analytics and no advertising identifiers. It does not read your contacts, location, files (other than an export file you explicitly save), photos, camera or microphone. Its only internet traffic is Google Play Billing's own communication with Google and, if you use other currencies, the exchange-rate requests described in section 5a — which go to a public rate service, not to us.
Spendy can detect purchases automatically by reading the text of notifications posted by the banking and payment apps you choose.
The feature is off until you turn it on and grant Android's Notification access permission. You see a plain-language disclosure in the App before the permission is requested.
You pick exactly which apps Spendy may read. Notifications from every other app are ignored and never processed.
Parsing happens on your device, in memory. The text is used only to extract an amount and, where possible, a merchant name. It is matched against a list of "charge keywords" you can edit.
Detected charges go into a review queue. Nothing is added to your records until you confirm it.
Notification content is never sent off the device and never shared with us or anyone else. The text a detected charge was parsed from stays with that item on your device while it waits for your review and for up to 30 days after you confirm or dismiss it (to avoid duplicates); then it is deleted automatically. Deleting the item, clearing the App's data or uninstalling removes it immediately.
A notification from one of your chosen apps that shows an amount but is not recorded — for example a declined payment, or one without a word like "paid" — is kept on your device for 7 days (at most 50 of them) in the Skipped notifications list, so you can see why it was skipped and record it yourself. Notifications without an amount are never kept. You can clear the list, or turn it off, in Settings → Automatic detection → Skipped notifications; turning it off deletes what is there.
You can revoke notification access at any time in Android Settings, or turn the feature off inside Spendy.
This use of Android's NotificationListenerService is limited to the core, user-facing purpose described above, consistent with Google Play's Notification Access and User Data policies.
All amounts in Spendy are kept in the one currency you choose, so that totals, charts and budgets add up correctly. When a detected charge — or data you import from a backup — is in a different currency, the App converts it with the European Central Bank's daily reference rate for that date, which it fetches from Frankfurter (https://frankfurter.dev), a free, open-source service that republishes the ECB rates.
What is sent: the two currency codes and a date (for example "USD to EUR on 2026-09-18"). Never the amount, the merchant, the notification, or any other information about you or your transactions.
What the service can see: like any website you connect to, your device's IP address and the fact that a request was made. We do not receive this, and Frankfurter's handling of it is governed by its own terms.
Stored on your device: the rates, so each day's rate is only fetched once. They are ordinary public figures, not personal data.
Turning it off: Settings → Convert other currencies. With it off, the App makes no such requests; a foreign-currency charge then waits in the review queue for you to enter the amount yourself.
Notification access (BIND_NOTIFICATION_LISTENER_SERVICE) — Optional automatic detection, section 5. Off by default.
Post notifications (POST_NOTIFICATIONS) — The optional daily reminder and "new charge detected" notifications you enable.
Run at boot (RECEIVE_BOOT_COMPLETED) — Re-arming the daily reminder and reconnecting the notification listener after a restart.
Ignore battery optimizations (REQUEST_IGNORE_BATTERY_OPTIMIZATIONS) — Optionally asking Android not to suspend background detection. You can decline.
Biometrics (USE_BIOMETRIC) — Optional biometric unlock, section 8.
Billing (com.android.vending.BILLING) — Selling the one-time unlock and the subscription through Google Play.
Internet / network state — Used by the Google Play Billing library to process and verify purchases, and by the App only to fetch exchange rates (section 5a).
Spendy is free to try for 30 days with full functionality. After the trial you can keep using it by buying one of the following through Google Play:
a one-time unlock (a single payment, no recurring charge), or
a monthly subscription (renews automatically until you cancel).
Who processes your payment. All purchases are made through Google Play Billing and are subject to the Google Play Terms of Service and the Google Payments Privacy Notice. Google (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and Google Ireland Limited for users in the EEA/UK) collects and processes the payment details — your card or other payment method, billing address and tax information — as an independent controller. We never receive, see or store your payment card number, billing address or bank details.
What we receive. To recognise your purchase, Google Play gives the App the purchase details listed in section 4. The App keeps them on your device only to decide whether paid features are unlocked; they are not combined with any other information and are not sent anywhere by us. As the seller, we can see order records (order number, date, amount, country) in the Google Play Console for accounting, tax and refund purposes; we keep those for as long as tax and accounting law requires (typically up to 10 years in Slovenia).
Subscriptions, cancellation and refunds are managed in Google Play (Play Store → Payments & subscriptions). Refund requests go through Google Play; see our Terms of Service for details.
Legal basis (GDPR). Processing purchase information is necessary to perform our contract with you (Art. 6(1)(b) GDPR) and to comply with legal obligations such as tax record-keeping (Art. 6(1)(c) GDPR).
Google's handling of your payment is described in the Google Payments Privacy Notice and the Google Privacy Policy.
If you enable biometric unlock, authentication is performed by Android's BiometricPrompt. The App never accesses, receives or stores your fingerprint, face data or any other biometric information; Android only tells the App whether authentication succeeded.
Settings → Data → Export data saves a backup of the App's records — your transactions, categories, tags, accounts, budgets, recurring charges, store rules and settings — as a .zip file (JSON inside) in the location you choose, for safekeeping or for moving to another phone. It is created only when you ask for it. Once the file leaves the App it is under your control and this Policy no longer governs it; we receive nothing. Import data reads such a backup back into the App's local database on your device.
Because the App does not send us your data, the only processing we carry out is:
Google Play order records — Fulfilling your purchase, accounting, tax, handling refunds and disputes — Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) in running the business and defending claims
Emails you send us — Answering you and fixing problems — Legitimate interests (Art. 6(1)(f)) in supporting users; contract where the email concerns a purchase
Processing that happens on your device (recording transactions, reading notifications you allowed, computing budgets) is carried out by the App under your control; it does not involve us. Where consent is relevant — for notification access and the optional reminders — Android asks you for it and you can withdraw it at any time in Android Settings.
We do not use your information for advertising, profiling, automated decision-making with legal or similarly significant effects, or any purpose other than those listed here.
We do not sell, rent, trade or otherwise disclose personal information to anyone, and we have not done so in the preceding 12 months. The only parties that come into contact with information connected to your use of Spendy are:
Google LLC / Google Ireland Limited (Google Play) — app distribution, Google Play Billing, subscriptions and refunds. Google acts as an independent controller for the data it collects when you use Google Play.
Our email provider — if you email us, the message sits in our mailbox (currently Gmail, operated by Google), which processes it on our behalf.
Frankfurter (exchange rates) — only if you use other currencies, and only the currency codes and date described in section 5a; like any website, it sees the IP address the request comes from. It receives nothing about your transactions.
Authorities, courts or advisers — only if the law requires it or it is necessary to establish, exercise or defend legal claims, and only the little we hold (an email or an order record).
A successor — if the App is sold or transferred, the order records and correspondence we hold may move to the new owner under this Policy. Your on-device data is unaffected because we never had it.
There are no analytics, advertising, attribution or crash-reporting partners.
We are in Slovenia (EEA). Google Play purchases are processed by Google, which may transfer data to the United States and elsewhere. Google LLC is certified under the EU–U.S. Data Privacy Framework (and its UK and Swiss extensions) and additionally relies on the European Commission's Standard Contractual Clauses; details are in Google's privacy policy. If you email us from outside the EEA, your message is stored on servers of our email provider, which may be located outside your country, under the same safeguards. Exchange-rate requests (section 5a) may be answered by servers outside your country; they carry no personal data beyond the IP address any web request has.
Everything in the App — On your device until you delete it, clear the App's data or uninstall. We keep no copy.
Confirmed or dismissed entries in the detected-charge log — Deleted automatically 30 days after you act on them
Skipped notifications — Deleted automatically after 7 days (at most 50 are kept); turning the list off deletes them at once
Google Play order records visible to us — As long as tax and accounting law requires (up to 10 years)
Emails you send us — Until the issue is resolved and for up to 24 months afterwards, unless needed longer for a legal claim
Your data is protected by the Android application sandbox, which prevents other apps from reading it. You can add a PIN or pattern lock inside Spendy and enable biometric unlock; the lock credential is stored only as a salted hash. Data you export is only as secure as the place you save it. Because your data never travels over a network to us, the main risks are those affecting your device itself — keep it updated and protected with a screen lock. No method of storage is perfectly secure, and we cannot guarantee absolute security. If we ever learn of a breach affecting information we hold (an order record or an email), we will notify you and the relevant authority where the law requires.
Spendy is a general-audience personal-finance tool. It is not directed to anyone under 16, and you must be at least 16 (or the higher minimum age that applies where you live) to use it. We do not knowingly collect personal information from children under 13 (as defined by the U.S. Children's Online Privacy Protection Act) or under the age of digital consent in the EEA/UK. If you believe a child has given us personal information — which, given how the App works, could only happen by email — write to us and we will delete it.
The App does not collect your data, so there is no copy of it anywhere for us to hand over, correct or delete — you already hold the only one. That means you exercise most rights yourself, directly on your device:
See and keep a copy of your records: everything is visible in the App, and Settings → Data → Export data saves the App's records (transactions, budgets and so on) as a backup file.
Correct it: edit any record directly in the App.
Delete it: delete records in the App, use Android Clear data, or uninstall the App. Everything is gone immediately and permanently.
Withdraw permissions: revoke notification access, notifications or the battery exemption at any time in Android Settings.
The only personal information we ourselves might hold is an email you sent us or a Google Play order record (section 4). If you want to see, correct or delete either of those, email dakysapps@gmail.com; we will answer within 30 days (one month under the GDPR) and can usually act immediately.
We will never discriminate against you — deny the App, charge a different price or provide a different level of service — for exercising any privacy right.
If you are in the EEA, the UK or Switzerland, you have the following rights. They apply to personal data that we hold — which, as section 4 explains, is never your App data (that stays on your device) and at most an email you sent us or a Google Play order record. Google is separately responsible for the data it holds about your Google Play purchases.
Access (Art. 15) — confirmation of whether we hold any personal data about you and, if so, a copy of it, plus the information in this Policy;
Rectification (Art. 16) — correction of inaccurate data;
Erasure (Art. 17) — deletion, subject to our tax record-keeping duties;
Restriction (Art. 18) and objection (Art. 21) — in particular to processing based on legitimate interests;
Portability (Art. 20) — personal data you gave us, in a structured, machine-readable format. We hold nothing to port; the records in the App itself are already yours, and Settings → Data → Export data saves them as a JSON backup you can keep or move to another phone;
Withdraw consent at any time where processing is based on consent, without affecting processing before withdrawal;
Not to be subject to automated decision-making with legal or similarly significant effects — we do none.
To exercise them, email dakysapps@gmail.com. We may ask you to confirm you are the person the data relates to (for example, by writing from the same address). We do not require a fee. We have not appointed a Data Protection Officer or an EU/UK representative because our processing is occasional and low-risk; nothing in this Policy prevents you from contacting us directly.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your residence, workplace or the place of the alleged infringement. Our lead authority is the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), www.ip-rs.si. In the UK it is the Information Commissioner's Office (ico.org.uk); in Switzerland the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
This section supplements the rest of the Policy for California residents. It is provided to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together "CCPA"), and the California Online Privacy Protection Act ("CalOPPA") apply to us.
Identifiers (name, email, account name, IP address, device ID); Do we collect it?: Only an email address if you write to us. No IP addresses, device IDs or account names.; Source: You; Purpose: Support; Sold or shared?: No; Retention: Up to 24 months after resolution
Commercial information (records of products purchased); Do we collect it?: Google Play order records (order number, date, amount, country); Source: Google Play; Purpose: Fulfilment, accounting, tax, refunds; Sold or shared?: No; Retention: Up to 10 years (tax law)
Financial information (bank account, card numbers, transaction history); Do we collect it?: No. Your transaction history exists only on your device; card details are handled solely by Google.; Source: —; Purpose: —; Sold or shared?: No; Retention: —
Internet or network activity (browsing, app interaction data); Do we collect it?: No — no analytics or tracking; Source: —; Purpose: —; Sold or shared?: No; Retention: —
Geolocation data; Do we collect it?: No; Source: —; Purpose: —; Sold or shared?: No; Retention: —
Biometric information; Do we collect it?: No — Android performs biometric checks; the App never receives biometric data; Source: —; Purpose: —; Sold or shared?: No; Retention: —
Inferences / profiles; Do we collect it?: No; Source: —; Purpose: —; Sold or shared?: No; Retention: —
Sensitive personal information (financial account data, precise location, biometrics, etc.); Do we collect it?: No — we do not collect any; your financial data stays on your device; Source: —; Purpose: —; Sold or shared?: No; Retention: —
We collect only the two rows marked above, for the purposes stated, and we do not sell or share (as defined by the CCPA, including for cross-context behavioural advertising) any personal information, and have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for any purpose that would trigger a right to limit under Cal. Civ. Code § 1798.121. We do not knowingly sell or share the personal information of consumers under 16 years of age. We offer no financial incentives in exchange for personal information.
Subject to applicable exceptions, you have the right to:
Know what personal information we collect, use and disclose, and the categories of sources and recipients (this section is that disclosure), and to request the specific pieces we hold about you — which can only ever be an email you sent us or a Google Play order record, never your App data;
Delete personal information we hold about you (your App data you delete yourself, in the App or by uninstalling);
Correct inaccurate personal information;
Opt out of sale or sharing — not applicable, because we do neither; we nonetheless treat a Global Privacy Control signal as a valid opt-out request;
Limit the use of sensitive personal information — not applicable, because we collect none;
Non-discrimination for exercising your rights.
How to exercise them: email dakysapps@gmail.com with "California privacy request" in the subject line. We do not operate a toll-free number because we deal with consumers exclusively online. We will confirm receipt within 10 business days and respond within 45 days (extendable once by a further 45 days with notice). To verify your identity we will match the email address you write from against the one associated with your request or purchase, and may ask for the Google Play order number. You may use an authorized agent; we will ask the agent for written permission signed by you and may still verify your identity directly.
CalOPPA "Do Not Track" disclosure: the App does not track users over time or across third-party apps or websites and does not allow third parties to do so, so there is nothing for a "Do Not Track" or Global Privacy Control signal to switch off. We do not respond to DNT signals differently because we already do not track.
California "Shine the Light" (Civ. Code § 1798.83): we do not disclose personal information to third parties for their direct-marketing purposes.
Minors (Bus. & Prof. Code § 22581): the App does not allow minors to post content publicly, so there is nothing to remove; a minor who has emailed us may ask for that email to be deleted.
Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Jersey, New Hampshire, Nebraska, Tennessee, Minnesota, Maryland, Kentucky, Rhode Island, Indiana and other states with comprehensive privacy laws have similar rights to access, correct, delete and obtain a copy of the personal data a business holds about them, and to opt out of targeted advertising, the sale of personal data and profiling with legal or similarly significant effects. We do none of those three things, and the only data we could hold is an email you sent us or a Google Play order record — your App data never leaves your device. To exercise a right, email dakysapps@gmail.com; if we deny a request you may appeal by replying to our decision, and if the appeal is denied we will tell you how to contact your state attorney general. Nevada residents: we do not sell covered information as defined in NRS 603A.
Brazil (LGPD): the rights and legal bases in section 17 apply in substance; the national authority is the ANPD. Canada (PIPEDA): you may request access to and correction of personal information we hold and complain to the Office of the Privacy Commissioner. Australia: you may complain to the OAIC. In every case, contact us first at dakysapps@gmail.com and we will do our best to resolve it quickly.
The App links to Google Play, to Android system settings and to this Policy and our Terms. Those destinations are operated by others; we have no control over, and accept no responsibility for, their content or privacy practices.
We may update this Policy as the App evolves or the law changes. When we do we will revise the "Last updated" date at the top and post the new version at https://sites.google.com/view/spendy-legal/privacy-policy; material changes will also be noted in the App's release notes on Google Play and, where the law requires, flagged in the App before they take effect. Continued use of the App after an update means you accept the revised Policy. Earlier versions are available on request.
Matic Dakskofler Slovenia Email: dakysapps@gmail.com
For privacy requests, please include the country or state you live in and, for purchase-related questions, your Google Play order number (GPA.xxxx-xxxx-xxxx).