Smart Expense Tracker
Legal

Privacy Policy

Last updated: 24 September 2026

Introduction

Smart Expense Tracker ("the Service", "we", "us") is a personal finance tracking web app. This Privacy Policy explains what information the Service collects, how it is used and stored, and the choices you have. By signing in and using the Service, you agree to the practices described here.

Information We Collect

Account information

You sign in using Google Sign-In (via Supabase Auth). We never see or store your Google password. When you sign in, we receive your name, email address, and profile photo from Google to identify your account and personalize the dashboard.

Financial data you provide

Any transaction you add — amount, category, type (income or expense), description, and date — is stored against your account so your dashboard, reports, and charts can be generated.

Imported bank statements

CSV and text-based PDF statements you upload are parsed entirely in your browser. The file itself is never uploaded to our servers — only the transaction rows you review and confirm are saved to your account.

Local preferences

Settings like accent color, font size, and workspace notes are saved only in your browser's local storage. They are never transmitted to our servers or visible to anyone else.

How We Use Your Information

  • To authenticate you and keep your session active across visits.
  • To store and display your transactions, summaries, reports, and charts.
  • To detect duplicate rows and suggest categories when you import a bank statement.
  • To communicate with you if you contact us for support.

We do not sell your data, and we do not run advertising or third-party tracking/analytics scripts on this site.

How Your Data Is Stored & Protected

Your account and transaction data are stored in Supabase (a hosted Postgres database and authentication provider). Data is encrypted in transit over HTTPS. Row Level Security (RLS) policies are configured so that, by default, every request for transaction data is scoped to your authenticated user ID — one signed-in user cannot query another user's transactions through the app.

Who Can Access Your Data

You can access your own data at any time by signing in. A single designated administrator account, used to operate and support the Service, can view aggregated transaction data across all users through a restricted admin panel — for example, to monitor platform-wide totals or investigate a support request. This access is limited to that one account and is not shared with any other party.

Third-Party Services

The Service relies on the following third parties to operate:

  • Google Sign-In — for authenticating your account. See Google's Privacy Policy for how Google handles your data.
  • Supabase — for authentication, database storage, and hosting your transaction data.
  • Cloudflare Pages — for hosting the static website you are viewing.
  • CDN-delivered libraries — Google Fonts, Chart.js, Lucide icons, and pdf.js are loaded from public content delivery networks (jsdelivr, fonts.googleapis.com) to render fonts, charts, icons, and parse PDF statements. These providers may log basic request data (such as IP address) according to their own policies.

Cookies & Local Storage

The Service does not use advertising or tracking cookies. Supabase Auth stores your session token in your browser's local storage so you stay signed in between visits. A few UI preferences (accent color, font size, notes) are also kept in local storage and stay on your device.

Data Retention

Your transactions and account details are retained for as long as your account exists. If you'd like your account and associated data deleted, contact us using the details below and we will remove it.

Your Rights & Choices

  • You can review, edit, or delete any transaction directly from your dashboard at any time.
  • You can export your data through the Reports section.
  • You can request a full copy or deletion of your account data by emailing us.
  • You can sign out at any time to end your session; this does not delete your stored data.

Children's Privacy

The Service is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will remove it.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the Service. The "Last updated" date at the top of this page will always reflect the most recent revision.