Privacy policy

What we collect

From your uploaded statement we extract only the merchant or app name, the transaction date, the amount, and the recurrence pattern, and only for recurring app and subscription payments. Balances, salary, transfers and general spending are ignored.

Delete before you upload

You are welcome to remove sensitive lines before uploading. Because we only scan for recurring app payments, a statement with those lines deleted produces the same results.

Delete them rather than blacking them out. A black box drawn over a PDF in Preview or Acrobat covers the words on screen but leaves the text in the file, so we would still read what is underneath. Deleting the rows, or exporting a CSV and deleting the columns, is the only version of this that works.

What we delete

Your raw bank statement is deleted immediately after extraction, automatically, every time. The interface confirms it with a statement-deleted notice, and that notice reflects the actual deletion rather than being decorative.

Your email

App Spender does not email you your results. Your report downloads directly from your browser, and your cancellation steps are shown in the chat. There are three reasons we ask for your address. To unlock your finished results: the review is free, but the full summary, the report download and the share card ask for your email first. To come back to you about a replacement you asked us to build. To tell you about cheaper alternatives, only if you tick that box. It is never ticked for you and never required.

When you unlock your results, we store your email address with your report's totals, the currency those figures are in, the apps in your report that are on our app list (their names, what each costs you a month, and what you decided), and the exact notice you were shown. Apps not on our list, including any health, dating or religious app, are counted but never named, and we never store your statement or any line from it. We use this to count how many people pay for each app and want a cheaper option. We may share those counts with app makers; we never share your email or anything that identifies you. An email address is required for the full summary, the report download and the share card; without one you keep everything already shown in the chat. We keep it for 24 months, then delete it automatically. Unlocking is not agreeing to marketing: we only email you about alternatives if you tick that separate box.

Why we are allowed to do that. We rely on our legitimate interest under section 11(1)(f) of POPIA, not on your consent, because a consent given to get something is not a free choice. The interest is this: knowing which apps people want a cheaper option for is how App Spender decides what to build, and it is what keeps the clean-up free. You can object to it at any time at privacy@appspender.com, without giving a reason, and we will delete what we hold. Marketing is different: that is your consent, given by ticking the box, and never assumed.

Where you ask for a replacement or tick the marketing box, we store your address with the exact wording you agreed to and the date. We keep it so a real person can get back to you, and for no other purpose. We do not sell any of it and we do not pass it on.

Who else sees your data

Six companies process data on our instruction, and no one else does. Each is named below with exactly what it handles. They are operators under POPIA, they act only on our instruction, and none of them may use anything for their own purposes. Three run the product. Three measure how it is used, and you can refuse those without losing anything. See the cookie policy.

No part of the scan uses an outside service. Your statement is read on our server, and every recurring payment in it is identified there, against our own list of apps and debit orders. No AI model and no other company is sent your statement or anything taken from it: not a merchant name, not an amount.

Vercel runs the application itself. Every request you make passes through their servers, including the one carrying your statement for the seconds it takes to read it. They store none of it: the file is never written to disk, never queued and never logged, so there is nothing left on their side once the request ends.

Neon hosts our database. What it holds of yours is what you chose to give us: an email with the wording you agreed to and, if you unlocked your results, the catalogue apps in your report with their costs and your decisions. Your statement is not in it, and no table in this product records a transaction or a line from a statement.

Musket Goose builds App Spender and keeps it running, and its monitoring platform receives this app's error reports: what broke, on which page, and in which version. It is how a fault here gets noticed and fixed rather than being met by the next person it happens to. An error report carries no part of your statement, no email address and nothing you typed: the error, where it happened, and the technical detail around it.

Vercel and Neon both process outside South Africa, as does the monitoring Musket Goose runs. Section 72 of the Act permits this where the receiving party is bound by comparable protections, which our data processing agreements with Vercel and Neon provide for.

Links to providers. Links from the assistant go straight to the provider's own site. If you follow one, that provider can see you arrived from App Spender, as with any link on the web. Where a link is an affiliate link it is labelled as one beside it, and the affiliate network also records that the visit came from us. We never add anything from your review to a link: not your statement, not the other apps you pay for, not what you spend.

Measurement, and how to say no

Three services measure how the site is used, so we know which pages bring people here and whether the product is worth advertising: PostHog, which counts page views and completed scans; Google Analytics; and the Meta pixel. They are on every page of the public site. They are not on the staff dashboard, and they are not on your results.

What they receive is which page you were on, and that a scan finished. Nothing from your statement reaches any of them: not the merchant names, not the apps we found, not what you spend, not your savings figure. That is enforced in the code by a test that fails the build if a payment name, a product name or a label you typed ever appears in something addressed to them.

Google and Meta are advertising companies, and this is the part to be plain about: they set cookies, they may recognise you across other sites, and Meta may match your visit to a Meta account. That is what these tools are. It is why they are the only part of this product you are asked to agree to, rather than being switched on for you.

Decline in the banner and none of the three loads at all: no script, no cookie, no request. Nothing about the scan changes: the product works identically either way, because none of this is involved in reading a statement. You can change your mind from the cookie policy page at any time.

Anonymous counts

We keep counts that describe the service rather than any person: how many statements were scanned, how many recurring payments a scan typically finds, and how often a given app appears across all scans. A scan is recorded as its totals (how many payments, what they came to) and the currency those totals are in, with no name, no address, no identifier, and no list of which apps were in it. Nothing in these counts can be tied to you, to your statement, or to an email address you may have given us, so they are not personal information. They tell us which apps are worth building cheaper alternatives for.

Your IP address

Like any website we can see the IP address a request comes from, and we use it for one thing: counting requests, so that nobody can hammer the scanner. That count is held in memory for sixty seconds and then gone. It is never written to our database, never stored alongside anything else, and never used to recognise you. An error report is the same story one step further out: like any request to any server it carries the address it was sent from, and Musket Goose turns that into a one-way hash, so a fault can be counted as having affected one person or fifty without anyone being able to work back to who.

Your controls

"Delete all my data" in the chat clears your extracted results and everything held in the page. Because those results only ever existed in your browser, that removes them completely.

It does not remove a replacement request, a marketing consent or the email you gave to unlock your results, because those are records you deliberately created and they are stored on our side. To stop the marketing emails, use the unsubscribe page. You need nothing but your address. To have a replacement request deleted, or to have us erase everything we hold about you, email privacy@appspender.com and we will remove it and confirm. We will not ask you to justify the request.

Sharing

App Spender is for adults. POPIA treats anyone under 18 as a child and their information may only be processed with a parent or guardian's consent, which we have no way to obtain. Do not use App Spender if you are under 18, and do not upload a statement belonging to a child. If you tell us we hold a child's information, we delete it.

If something goes wrong. If personal information we hold is ever accessed by someone who should not have it, we will tell the Information Regulator and everyone affected as soon as we reasonably can, as section 22 requires, and say what happened and what to do about it.

We do not sell your data and we do not rent it, and we share nothing with anyone beyond the six operators named above. If we share anything with app makers, it is counts: how many people pay for an app and want a cheaper one. Never who.