How SpendScout handles your data

SpendScout is an independent personal finance web application built and operated by an individual developer, Rishabh Panchal (panchalrishabh04@gmail.com), and is not operated by a corporation or financial institution.

This Privacy Policy explains what data SpendScout collects when you sign in and use the app, how that data is stored, and how you can export or delete your information at any time.

SpendScout only stores information required to run your workspace:

• Google Sign-In Profile: Authentication is handled exclusively via Google OAuth. When you sign in with Google, SpendScout receives your email address, first and last name, and Google account identifier. SpendScout does not collect or store passwords.
• User-Entered Financial Records: Accounts (bank, credit card, cash, savings), expense transactions (titles, merchants, categories, payment modes, dates, amounts, and notes), monthly category budgets, savings goals, and recurring subscriptions that you create in the app. SpendScout does not connect to your bank login credentials.
• Personal API Keys: If you generate a personal API key in Settings to log expenses from scripts or shortcuts, SpendScout stores the key record associated with your account so requests sent with your X-API-Key header can be authenticated.
• Preferences: Display preferences such as your chosen currency symbol, number formatting locale, and light/dark theme.

Your data is used solely to provide the features of SpendScout:

• Reconciling your account balances when you log, edit, or delete expenses and subscription payments.
• Calculating your monthly category budget usage, savings goal progress, recurring bill calendar, and spending insights.
• Authenticating requests made through your web session or personal developer API key.

No selling or advertising: Your personal details and financial records are never sold, rented, or shared with advertisers, data brokers, or third-party marketing services.

• Transport Encryption: All traffic between your browser or API client and SpendScout is transmitted over HTTPS/TLS.
• Session Tokens: After Google OAuth verification, your session is maintained using signed JSON Web Tokens (JWT).
• Account Isolation: All database queries for accounts, expenses, budgets, goals, and subscriptions are scoped strictly to your authenticated user ID.