Privacy

Spent So Far for iPhone

The iPhone app uses the same account as the web app. You can try it with sample data without an account. To use your own numbers, by connecting a bank or importing a copy, you sign in first. This section covers what's different on iPhone. The rest of the page, from Your account on, applies to both, apart from what it says about your browser and the waitlist.

• What it stores, and where. Your transactions, balances, account names and the changes you make are saved in a database inside the app, on your iPhone, filed under your account. The sample data is kept there too, apart from your own numbers; it needs no account and never syncs. Your SimpleFIN connection, the access address SimpleFIN gives the app, is saved in your iPhone's Keychain for this device only, so it doesn't sync to iCloud Keychain or move to another iPhone. Your sign-in, and your sync key if you turn on sync, are kept in the Keychain the same way.
• Signing in. You can sign in with an email and password, with Google or with Apple. Firebase Authentication, a Google service, then keeps your email address, an account ID, how you sign in, and when you created the account and last signed in. We ask Google and Apple only for your email address, never your name or photo. With Sign in with Apple you can hide your email: Apple gives us a private relay address that forwards to you, Firebase keeps that address instead, and we never see your real one.
• Sync with the web. Sync is off until you turn it on in Settings. When it's on, the app encrypts your transactions, balances, account names and changes on your iPhone, with a key only your sync passphrase or recovery code can unlock, and sends only that encrypted copy to Google Cloud Firestore in Montréal, the same copy the web app uses. Neither Google nor Spent So Far can read it. See Sync between devices.
• Nothing else. The app contains no analytics, advertising or crash-reporting code. Your SimpleFIN connection is never synced or sent to us.
• Your bank connection. Connecting a bank is optional. If you do, the app talks straight from your iPhone to SimpleFIN, under your own SimpleFIN account, to fetch your accounts and transactions. You sign in to your bank on SimpleFIN's site, never in the app, so the app never sees your bank password, and the connection can read data but can't move money. SimpleFIN's own privacy policy covers what it keeps. Sample data and imported files need no connection at all.
• Files you export and import. The app makes an export file only when you choose Export a copy, and you decide where it goes from the share sheet. The file isn't encrypted, so anyone who opens it can read your transactions, account names and balances, and it doesn't include your SimpleFIN connection. Importing reads only the file you pick.
• Backups. Like most app data, the app's database can be included in your iPhone's own backups to iCloud or to a computer, which you and Apple hold, not us. Your sign-in, sync key and SimpleFIN connection are kept for this device only, so they don't move to another iPhone with a backup: there you sign in, enter your sync passphrase and connect your bank again.
• Apple. Apple delivers the app through the App Store. If you've turned on sharing with app developers in your iPhone's settings, Apple may send us crash reports and usage statistics that don't identify you. If you use Sign in with Apple, Apple keeps its own record of that. Apple's privacy policy covers both.
• Links. The links to this page, the terms and support open in Safari, outside the app. Signing in with Google opens Google's own sign-in page in a system sign-in sheet, which closes once you've signed in.

Deleting your data on iPhone

• To delete your account, open Settings, choose Account, then Delete my account. That deletes your encrypted cloud copy, your account with Firebase, and that account's data on this iPhone, including its SimpleFIN connection. If you signed in with Apple, it also tells Apple to stop Sign in with Apple for Spent So Far; if the app says it couldn't, open the Settings app, tap your name, tap Sign in with Apple, choose Spent So Far and tap Delete.
• To sign out, open Settings, choose Account, then Sign out. Turn on Also delete my data from this iPhone to delete that account's data here too; otherwise it stays on this iPhone for when you sign in again. Your account and its cloud copy stay either way.
• To clear only this iPhone and keep your account, choose Delete everything from this iPhone in Settings. That removes every account's data on this iPhone, the sample, and your sign-in, sync key and SimpleFIN connection from the Keychain, and signs you out. Your account and its cloud copy stay; use Delete my account for those.
• Deleting the app removes its database too, but not your account or its cloud copy. iOS can keep Keychain items after an app is deleted, so if you install Spent So Far again, the app clears any leftover sign-in, sync key and SimpleFIN connection the first time it opens, and you start signed out.
• Export files you saved, and your iPhone's backups, are yours to delete wherever you keep them.
• To stop SimpleFIN's access for good, turn off Spent So Far in your SimpleFIN account, under Apps.
• Questions about the iPhone app go to [email protected], or see Support.

Your account

You need an account to use your own numbers, on the web or on iPhone. The same account works on both. Sign-in runs on Firebase Authentication, a Google service, in Google's US data centers. Google processes this data for us as a service provider, under Firebase's data processing terms, which require it to protect the data at least as well as this policy does. Firebase stores:

• your email address (with Sign in with Apple, the address Apple shares, which can be a private relay address);
• an account ID that Firebase assigns;
• how you sign in: with a password, of which Firebase keeps only a scrambled hash, or with your Google account or your Apple Account;
• when the account was created and when you last signed in.

We ask Google and Apple only for your email address, never your name or photo. That's all that goes to Firebase Authentication. It never receives your transactions, balances, account names or anything from SimpleFIN. Sync, described below, uses a different Google service and only ever sends it encrypted data. Google may keep technical logs, such as your IP address, when your browser or iPhone talks to Firebase, and Firebase's code in the app sends Google its own version details. Google's privacy policy covers those. When you delete your account, Google removes it from Firebase's live systems, and from its backups within 180 days.

When you sign in with Apple on the web, Apple sends its answer to a small function on our site that passes it straight back to the app. It keeps nothing, logs nothing, and drops the name Apple may include.

What stays in your browser

Your bank data lives in your browser's storage on your device, filed under your account: the SimpleFIN connection, locked with a key the browser won't hand out, the transactions and balances it syncs, and the changes you make. Unless you turn on sync, none of it leaves your browser, for our servers or for Firebase. When two people share a browser, the app shows each account only its own data. That keeps accounts apart in the app, but on its own it isn't a lock: someone who can use your browser could still read what's stored there with the browser's developer tools. The Face ID lock in Settings protects that data while it's stored and the app is locked. With it on, your transactions, balances, bank connection and sync key are stored encrypted in your browser, under a key that only your passkey can open. The app locks each time you open it and after it has been hidden for a minute; a window you can still see on a computer doesn't lock. While the app is unlocked, including that minute, anyone at your screen or with the browser's developer tools can read it. The lock doesn't cover your Firebase sign-in or the sample data. On a shared computer, sign out with Also delete my data from this browser ticked.

The passkey stays with your device's password manager, such as iCloud Keychain, which may sync it to your other devices. We never receive it. If it's deleted or stops working, nobody can open the locked data in that browser, us included. That's why Settings asks you to turn on sync or download a copy before the lock goes on.

Turning the lock on copies your data into a new, encrypted store and deletes the old one. It can't reach copies made before: backups of your device from before the lock still hold your data unencrypted, and Chrome can keep deleted pieces in its own files until it tidies them up. Your sync key also stays the same, so anyone who had it before can still open your cloud copy.

With sync off we hold no copy, so we can't restore it. Clearing your browser's data for this site deletes it, and every other browser or device starts empty. With sync on, your encrypted cloud copy can bring it back on another device, but only with your sync passphrase or recovery code.

Sync between devices

Sync is off until you turn it on in Settings. When it's on, the app encrypts your transactions, balances, account names and changes on your device, in your browser or the iPhone app, with a key that only your sync passphrase can unlock, and sends nothing but that encrypted data to Google Cloud Firestore in Google's Montréal region. Neither Google nor Spent So Far can read it. We never receive your passphrase or the key.

To run sync, Firestore also keeps a few things unencrypted: your account's ID, and when each encrypted piece was uploaded and how big it is. Your SimpleFIN connection never syncs, and neither does the sample data.

When you turn sync on, you get a recovery code, shown once. If you lose both the passphrase and the recovery code, nobody can unlock the cloud copy, and we can't recover it for you. What's saved on your devices isn't affected.

Turning sync off on a device stops it there, and you can delete the cloud copy at the same time. Signing out leaves the cloud copy where it is. Deleting your account deletes the cloud copy first.

Your bank connection

Spent So Far gets transactions through SimpleFIN Bridge, a separate service you sign up for and pay. You connect your banks on SimpleFIN's site, so we never see your bank password, and your browser or iPhone talks to SimpleFIN directly. SimpleFIN's own privacy policy covers what it keeps.

The waitlist and page visits

If you join the waitlist, we store your email, your answers to the two optional questions, the page you signed up on, your country as Cloudflare reports it, and your browser's user agent. If another site linked you here, we also keep that site and page (never its query string) and any utm tags in the link.

The site also records a few events, such as a page view or someone opening the sample. Each one holds the event name, the page, the referring site, utm tags and a country. There's no email, no IP address and nothing that ties one event to another person. Cloudflare Web Analytics counts visits as well, without cookies.

We use this to decide whether Spent So Far is worth building and to run it. We don't sell it, rent it or share it for advertising, and we keep it only as long as we need it for those purposes.

Who else handles data

• Google runs sign-in, including Sign in with Google, through Firebase Authentication. If you turn on sync, it also stores your encrypted cloud copy, in Cloud Firestore.
• Apple runs Sign in with Apple, if you use it, and delivers the iPhone app.
• Cloudflare hosts the site and our small database, and handles every request, so it sees your IP address.
• SimpleFIN holds your bank connection, in an account that belongs to you.

Where data is stored

Your encrypted cloud copy, if you turn on sync, is stored in Google's Montréal region, in Canada. Your account is kept by Firebase Authentication in the United States. Google and Cloudflare may store and process the rest of the data described on this page outside Canada, including in the United States. While it's there, it's subject to the laws of that country, which may let its authorities access it.

Security

We keep what we hold to a minimum and protect the rest: the site only runs over HTTPS, the app loads no third-party scripts, your SimpleFIN connection is encrypted in your browser or kept in your iPhone's Keychain, and the cloud copy is encrypted with AES-256 on your device before it leaves. With the Face ID lock on, so are your transactions, balances and changes in your browser. No system is perfectly secure. If a breach of our systems creates a real risk of significant harm to you, we'll tell you and report it to the Office of the Privacy Commissioner of Canada, as the law requires.

Age

Spent So Far, on the web and on iPhone, is for people 18 and over. Trying the sample data in the iPhone app needs no account. We don't knowingly collect data from anyone younger; if you think we have, write to us and we'll delete it.

Deleting your data

• To delete your account, open Settings in the app and choose Delete my account. That removes your encrypted cloud copy if there is one, your Firebase account, and this account's data in the browser or iPhone you're using. If you signed in with Apple, it also stops Sign in with Apple for Spent So Far.
• To delete only the cloud copy, open Settings, choose Turn off sync and choose Also delete the cloud copy. Every device stops syncing, and each keeps what it saved.
• To clear an iPhone, see Deleting your data on iPhone. To clear one browser, sign out with Also delete my data from this browser ticked, or use Delete everything from this browser in Settings. Repeat it on each browser or device you used. If the Face ID lock is on and you can't unlock, tap Can't unlock? on the lock screen to find Delete everything from this browser.
• To stop SimpleFIN's access, turn off the connection in SimpleFIN, under Apps.
• To remove your waitlist entry, email [email protected].

Contact

Spent So Far's privacy lead is responsible for how personal information is handled here. Write to [email protected] to ask what we hold about you, to have it corrected or deleted, or to withdraw your consent. Spent So Far is based in Toronto, Ontario, Canada.

If you're not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

If this page changes, so does the date at the top. If a change affects your account, the app will say so.