The smallest amount of data, on purpose.

The short version

SpendPace exists to answer one question: what's safe to spend before payday? To answer it we need to know what you take home, what you've already committed to (bills, savings), and what you've spent. That's it.

We don't connect to your bank. We don't run analytics or behavioural tracking. We don't sell or share your data with advertisers. We don't build a profile of you.

What we collect

Sign-in identity

• Your email address — used for the 6-digit sign-in code we email you. We never see or store your password because there isn't one.
• If you sign in with Apple, Apple tells us either your real email or — if you chose "Hide My Email" — an Apple-relay address that forwards to you. We treat the relay address the same as a real email and never try to resolve it back.
• If you sign in with Google, that provider tells us your email and a stable per-app user ID. We do not receive your Google profile, contacts, calendar, or any other Google data.
• An internal user ID our authentication system (Supabase) assigns when you create the account.

Money information you enter into the app

• Your pay amount, pay frequency, and next payday.
• Bills, savings, investments, and other recurring items you choose to track (name, amount, due date, frequency, optional colour).
• Expenses you manually log (amount, category, optional note, date).
• Your spending categories and any per-category limits you set.

Settings

• Currency, notification preferences, and whether you have the Face ID app lock enabled.

Server access logs

• Like any service on the internet, our infrastructure provider records standard access logs — IP address, timestamp, and the kind of request — to detect abuse and keep the service running. We don't combine these logs with your money information to build a profile.

What we don't collect

• We don't connect to your bank — we have no access to your real transactions.
• We don't run analytics, behavioural tracking, or session replay tools.
• We don't run a crash reporter that sends your data off-device.
• We don't track your location.
• We don't access your contacts, photos, microphone, camera, or any other app on your phone.
• We don't sell or share your financial information with anyone.
• We don't build an advertising profile of you.
• We don't set cookies, use tracking pixels, or run analytics on spendpace.ca. No consent banner is needed because there's nothing to consent to.

Artificial intelligence

SpendPace does not send your data to any AI service, on-device or in the cloud. We do not use generative AI, machine learning categorization, or large language models to process your money information. The math behind your safe-to-spend number is plain arithmetic that runs locally on your device.

If we ever add AI-powered features, we will update this policy first, surface a notice in the app, and the feature will be opt-in.

How your data is stored

Your account and the data you enter are stored in Supabase, our authentication and database provider. The connection is encrypted in transit (HTTPS) and at rest. We use Row Level Security so that even at the database level no other account could read your rows. The app also caches your data locally on your device so it's available offline; that cache is cleared when you sign out.

Where your data is hosted: Supabase hosts our project in the West US region (Northern California, United States). Your data is processed and stored on servers located in this region. If you are accessing SpendPace from outside North America, your data will be transferred to and processed there.

How long we keep your data: We keep your data for as long as your account exists. When you delete your account from Settings → Delete account, your account record and all associated data (pay schedule, reserved items, expenses, categories, settings) are permanently deleted from our live database immediately. Supabase retains encrypted disaster-recovery backups for up to 7 days, after which the backups are also permanently deleted. We do not keep copies of deleted accounts beyond this window.

Third-party data protection: Supabase is our only data sub-processor. Supabase is SOC 2 Type II certified and contractually commits to data protection practices that meet or exceed what is described in this policy. We do not authorise Supabase to use your data for any purpose other than hosting it on our behalf.

Who we share data with

The minimum required to make the app function:

• Supabase — our authentication and database provider. They host your account and data on our behalf.
• Apple or Google — only if you chose Sign in with Apple or Sign in with Google. Those providers see that you signed in to SpendPace. They do not see your financial data.
• Apple App Store — handles subscription billing. We never see your payment details; Apple does.

We do not share data with advertisers, data brokers, or analytics companies.

Your rights

You have the right to:

• Access your data — every piece of money information you've entered is visible in the app at all times.
• Export your data (data portability) — Settings → Export all data (JSON) for a complete backup, or Settings → Export expenses (CSV) for a spreadsheet-friendly version of your spending history.
• Delete your account and all associated data — Settings → Delete account. The deletion is permanent, takes effect immediately, and we have no way to recover it after. This also serves as the mechanism to withdraw consent for all data processing.
• Revoke push notification consent — Settings → Notifications inside the app, or iOS Settings → SpendPace → Notifications. Disabling notifications cancels any scheduled reminders immediately.
• Sign out — Settings → Sign out. Signing out clears the cached copy of your data from this device. Your data remains on our servers and is available the next time you sign in on this or any other device.
• Contact us with any privacy question, complaint, or request at [email protected]. We will respond within 30 days.

If you are a Quebec resident, you also have the rights granted by An Act respecting the protection of personal information in the private sector (Law 25 / PL 64), including the right to know what personal information we hold about you, the right to correct inaccurate information, and the right to file a complaint with the Commission d'accès à l'information du Québec. If you are a resident of the European Economic Area, the United Kingdom, or another jurisdiction with similar laws, equivalent rights apply.

Children

SpendPace is intended for users 13 and older and is not directed to children. We do not knowingly collect personal information from anyone under the age of 13. We comply with the Children's Online Privacy Protection Act (COPPA) in the United States and equivalent statutes in other jurisdictions, including the consent rules under Quebec Law 25 for minors under 14. If you believe a child under 13 has created an account, contact us at [email protected] and we will delete the account immediately.

Privacy officer

In accordance with Quebec Law 25, Have Faith Inc. has designated a privacy officer responsible for the protection of personal information. You can reach our privacy officer at [email protected] with any question, request, or complaint about how your information is handled.

Changes to this policy

If we change this policy in a way that affects how your data is collected or shared, we'll email registered users and surface a notice in the app. The latest version always lives at spendpace.ca/privacy.html.

Contact

Have Faith Inc.
Quebec, Canada
Privacy officer and support: [email protected]