A private expense tracker: what "private" means here

The data path

Spendwise has no backend. Every transaction, budget, category, note, person, group and receipt attachment is written to a SQLite database in the app's private storage, and every screen reads from that database. There is nothing to sign into, so there is no profile of you to build, sell, lose or hand over.

Two features talk to the internet, and both are small enough to state precisely:

• A single ad on the transaction confirmation screen, requested as non-personalised, with the advertising-identifier permission stripped from the app.
• Anonymous screen analytics — a route name per screen view, no user id, no transaction content, no advertising identifier, no tracking ID.

There is no crash reporter, no session recording, no heat map, and no third-party SDK beyond the ad and analytics libraries. The privacy policy enumerates them, and it is short because the list is short.

The permissions, and the ones that are absent

Android permissions are a good proxy for what an app can actually do. Spendwise asks for notifications, so the daily reminder and recurring-bill reminders can fire. That is the list.

• No contacts permission. People you track are entries you create, not your address book.
• No location. Nothing in the app needs to know where you are.
• No camera permission. Attaching a receipt uses Android's system photo picker and document picker, which grant the app access to the file you choose and nothing else.
• No advertising-identifier permission. The manifest entry is stripped in the build, so there is no ID for an ad network to read.

App Lock, meanwhile, adds no storage of its own: it hands the check to Android's own authentication prompt, so your PIN, pattern or biometric never touch Spendwise.

The ad, without euphemism

Spendwise is not ad-free. One native ad sits on the confirmation screen, and it is how the app stays free without a subscription. The privacy-relevant facts:

• Every request is non-personalised, including for a user who accepted the consent form. Consent authorises a request; it never buys personalisation.
• No advertising identifier is available to the SDK, because the permission is removed at build time.
• In the EEA and UK a consent gate comes first and fails closed: no network, no consent, or no configured message means no ad. Settings → Privacy can reopen the form where the framework requires it.

The ad network still sees the request itself — an IP address, a device model and an approximate region are unavoidable in any network request. The difference is that nothing on this side builds a profile of your spending to attach to it.

Analytics you can actually switch off

Usage analytics exist, and the app says so instead of writing "no analytics". Spendwise records an anonymous screen view per route — which screens are reached, not what is on them — with no user id, no email and no transaction content.

The switch is in Settings and its effect is absolute: with analytics off, the events stop being sent. It does not reduce them, hash them, or keep a local copy for later. If the sentence "analytics can be switched off" is going to mean anything, it has to mean that.

Where the promise stops

Honesty is worth more than a slogan, so here are the limits:

• The backup file is not encrypted. It is a .spendwise archive that anyone holding the file can read. Keep it where you would keep a bank statement, or skip the file and accept that the data dies with the phone.
• Your phone's lock screen is the real perimeter. Spendwise adds App Lock as a second check, but a device that is unlocked and rooted is a device whose app data can be read.
• Google Play is still involved in the install, and the Play services on your phone are Google's, not Spendwise's. The claim here is about what this app does with your data, not about the operating system it runs on.
• Attachments are files. A receipt photo leaves the app when you share it elsewhere, and its metadata is whatever the file already had.

The controls, in one place

• Analytics on/off — Settings → Privacy.
• Ad consent — Settings → Privacy, where the consent framework requires a way back into the form.
• App Lock — Settings → Security.
• Delete everything — uninstall the app or clear its data in Android settings.

Frequently asked questions