Privacy Policy

1. Introduction

TalkSpense ("we", "us", or "our") operates the TalkSpense mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.

This Privacy Policy complies with the General Data Protection Regulation (GDPR) and Polish Personal Data Protection Act (RODO).

2. What Data We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Display name
• Profile preferences (language, currency settings)
• Authentication credentials (via Google/Apple OAuth)

2.2 Expense Data

When you track expenses, we collect:

• Expense amounts and currencies
• Categories and subcategories
• Store/merchant names
• Purchase dates and times
• Payment methods
• Notes and descriptions
• Family member assignments (if Family mode enabled)

2.3 Receipt & Image Processing

When you scan receipts or screenshots:

• Photos/screenshots are sent to our AI service for OCR
• Only text data extracted from images is saved
• Original images are deleted within 24 hours

2.4 Voice Input

When you use voice commands:

• Audio recordings are transcribed via Groq Whisper AI
• Only text transcriptions are saved
• Audio is processed in-memory and deleted within 24 hours
• Language preference is saved for improved accuracy

2.5 Device Data

• Firebase Cloud Messaging (FCM) token for push notifications
• Device type (Android/iOS)
• App version and OS version
• Device language and timezone settings

2.6 Error Tracking

3. How We Use Your Data

We use your information to:

• Expense Tracking: Record and categorize your financial transactions
• AI-Powered Features: Process receipts via OCR and voice-to-text transcription
• Family Budget Sharing: Enable collaboration with family members (if opted in)
• Push Notifications: Send budget alerts and receipt processing status
• Product Support: Respond to inquiries and provide technical assistance
• Service Improvement: Analyze usage patterns to enhance app functionality
• Security: Detect and prevent fraud, abuse, and security incidents

3A. Legal Basis for Processing (GDPR Article 6)

We process your data based on the following legal grounds:

3B. International Data Transfers

Some of our service providers are located outside the EU:

• OpenRouter AI (Google Gemini): USA - Protected by EU Standard Contractual Clauses (SCCs)
• Groq (Whisper AI): USA - GDPR-compliant data processing agreements
• Supabase: EU/USA (customer choice) - GDPR-compliant infrastructure

All international transfers comply with GDPR Chapter V requirements.

3C. Age Requirement