1. What Spendly does
Spendly is a personal finance app. It scans the SMS inbox on your phone for transaction alerts sent by banks, card issuers, UPI apps and billers, and turns them into account balances, a transaction history, spending analytics and bill reminders. It does not move money and is not connected to any bank.
2. Data we process on your device
| Data | Why | Where it lives |
|---|---|---|
SMS messages (read via the READ_SMS permission) | To detect and parse financial alerts. Messages that are not financial, including OTPs, passwords, promotions and personal conversations, are discarded immediately and never stored. | Read in memory on your phone only |
| Your sign-in one-time password (OTP) | To fill in the code for you while you sign in. The code is read from the OTP SMS on your phone, used once and not stored. | Read in memory on your phone only |
| Parsed transactions, balances, bills and subscriptions | To show your ledger, analytics and reminders | Private app storage on your phone (a local database only Spendly can read) |
| App preferences (theme, onboarding state, reminder settings) | To remember your choices | Private app storage on your phone |
None of the data in this table is transmitted to Vidyant or to any third party. Spendly has no server that receives it.
3. Data that leaves your device
Spendly uses three Google Firebase services: one to sign you in, and two to keep the app stable and understand which features are used. None of them receives SMS content, merchant names, amounts, account numbers or any other financial detail.
| Service | What it receives | Purpose |
|---|---|---|
| Firebase Authentication (phone number sign-in) | Your mobile phone number and a Firebase user ID. To send the one-time password and protect against abuse, Google may also process information about your device and app as part of its verification checks. | Sending your sign-in code and identifying your account |
| Firebase Crashlytics | Crash stack traces, the app version, device model, operating system version, free memory and disk at the time of a crash, and a random installation identifier | Diagnosing and fixing crashes |
| Firebase Analytics | Which screens are opened and which features are used, app version, device model, operating system version, approximate country, and a random installation identifier | Understanding which features matter so we can improve them |
The installation identifier is generated by Firebase and is not linked to your phone number or your account. Analytics and crash reporting are disabled in development builds. Google processes this data under the Firebase privacy terms. By default, Google retains Analytics user-level data for two months and Crashlytics data for ninety days.
3a. Signing in with your phone number
Spendly asks you to sign in with your mobile number. Firebase Authentication sends a one-time password (OTP) to that number by SMS, and you enter it to confirm the number is yours. We receive only your phone number and a Firebase user ID. This identifies your account and nothing else. Your SMS, transactions, balances and bills are never associated with it and are never uploaded, with or without an account.
To make sign-in quicker, Spendly may fill in the code for you. If you have allowed SMS access, the app reads the code from the OTP message on your phone. Otherwise Android asks your permission to share that single message with Spendly (Google's SMS User Consent prompt). Spendly may also offer your phone number as a suggestion using Google's Phone Number Hint; you choose whether to use it. The code is used once and is not stored.
You can delete your account at any time from Settings, then "Delete account", or by following the steps at spendly-core.web.app/delete-account. Deletion removes your phone number and user ID from Firebase Authentication immediately.
4. Permissions we ask for
- Read SMS. Required to see bank and billing alerts, and used to fill in your sign-in code. Spendly cannot send SMS. You can use the app in demo mode without granting this permission.
- Notifications and run at boot. Used only to deliver bill, EMI and subscription reminders, and to keep them scheduled after your phone restarts. Reminders are scheduled locally on the phone.
Spendly does not use the Android advertising ID.
5. What we do not do
- We do not upload, back up or sync your SMS or financial data.
- We do not sell or share personal data with advertisers. Spendly contains no ads.
- We do not use third-party trackers other than the Firebase services above.
- We do not link your financial data to your phone number, your account or any other identity.
6. Your choices and rights
- Delete everything. Open Settings in the app and choose "Clear all stored data", or uninstall the app. Either removes all parsed financial data from your phone. There is no copy elsewhere to delete.
- Delete your account. Open Settings in the app and choose "Delete account". This removes your phone number and user ID from our systems. See the account deletion page for details.
- Revoke SMS access. Turn off the SMS permission for Spendly in your phone's settings at any time. The app stops reading new messages immediately.
- Crash and usage data. Because this data is anonymous and not tied to you, we cannot look up or delete an individual's records. Uninstalling the app stops all further collection.
- Ask us. You can ask what data we hold or raise a concern using the contact below. We respond within 30 days.
7. Children
Spendly is intended for adults aged 18 and over. We do not knowingly collect data from children.
8. Security
Financial data is stored in app-private storage on your phone, which other apps cannot read. Because it is never transmitted to us, there is no financial data in transit or on our servers to protect. Your phone number is held by Firebase Authentication under Google's security controls. Keep your device passcode enabled to protect the local data.
9. Changes to this policy
If we start collecting new kinds of data, we will update this page and change the effective date at the top before the change takes effect.
10. Contact
Vidyant Technologies Private Ltd.
Email: SUPPORT_EMAIL_TBD