What we collect

When you register, we collect your name, email, phone number, and password (stored hashed). Expenses you log via WhatsApp or the dashboard are stored to provide the service. We also store message metadata needed to process WhatsApp webhooks.

How we use data

Your data powers expense tracking, dashboard summaries, and AI-assisted replies. We use third-party providers (hosting, SMS verification, WhatsApp, AI) only as needed to operate Expensebit. We do not sell your personal information.

Google account data (Gmail)

Connecting your Google account is optional. Expensebit works without it, and you can disconnect at any time from Settings or at myaccount.google.com/permissions.

Signing in with Google.If you use “Continue with Google”, Google shares only your name, email address, and profile picture so we can create or sign you into your account. This grants Expensebit no access whatsoever to your email.

Connecting your mailbox. Reading your inbox is a separate, explicit step. You create a Google app password — a credential limited to mail, which you can revoke at any time — and we use it to open an encrypted IMAP connection to find receipts, invoices, and transaction alerts. We never ask for your Google account password.

Why we access it. Solely to detect expense-related emails and extract the merchant, amount, date, and category so your expenses are logged automatically. We do not use Gmail data for advertising, and we do not use it to train machine learning models.

What we store. We store the extracted expense fields and a message identifier so the same email is not counted twice. We do not retain the full contents of your emails after extraction. Your app password is encrypted at rest and is never displayed back to you or visible to our staff.

Who we share it with. Expense details from an email may be sent to our AI processing provider strictly to perform that extraction, under contractual terms that prohibit using the data to train their models. We do not sell Gmail data or transfer it to anyone else, except where required by law or to investigate abuse.

Deletion. Disconnecting a mailbox deletes the stored app password immediately, and revoking it in your Google account cuts off access straight away regardless. Deleting your Expensebit account removes the associated expense records.

Expensebit's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Security

We use industry-standard practices including encrypted connections, secure authentication, and access controls. No system is perfectly secure; please use a strong password and keep your phone secure.

Your rights

You may request access, correction, or deletion of your data by contacting us. You can stop using the service at any time.

Contact

Questions about privacy? Reach us at contact@expensebit.com.