Privacy Policy

Who we are

XPNSE is operated by BRANDSWOT Consultancy, a sole proprietorship based in India, at 1-133, Ground Floor, 1st Road, 1st Cross, Anantapur - 515001, Andhra Pradesh, India. We are the "Data Fiduciary" for the data described here under India's Digital Personal Data Protection Act, 2023 (DPDP Act).

Grievance Officer: write to privacy@xpnse.app or to the postal address above, marked "Grievance Officer".

Part A: this website

What we collect

• Waitlist: your email address; the phone you use (Android or iPhone); where you came from (the utm_source in the link, or "direct"); your browser's language setting; the time you signed up; and which version of the sign-up wording you saw (our record of your consent).
• Contact form: your name, email address, the topic you pick, your message and the time you sent it. If you email us directly, we receive your email and whatever you write.
• Server logs: our host, Google Firebase Hosting, and Google Cloud Firestore (which receives form submissions) process technical data such as your IP address, browser type and the page requested, to deliver the site and keep it secure.

No cookies, no analytics, no ads. This website sets no cookies, runs no analytics or tracking scripts, and loads nothing from third parties. If you switch between light and dark mode, your browser remembers that choice in its own local storage; it is never sent to us.

Why we use it, and on what basis

• Waitlist: to email you a link to test XPNSE early (Google Play testing on Android, TestFlight on iPhone) and news about its launch, and to understand which phones people use. We rely on your consent, which you give by joining the waitlist under the wording "We'll email you a testing link when it's ready. No spam. Unsubscribe anytime.". Every email has an unsubscribe link. To send you a testing link we add your email address to the tester list in Google Play Console, Apple TestFlight or Firebase App Distribution; Google or Apple then also process it under their own terms to deliver the test app to you.
• Contact messages: to read and reply to you. You give us this data voluntarily for that purpose (a "legitimate use" under section 7(a) of the DPDP Act).

How long we keep it

• Waitlist entries: until 12 months after the app launches, or until you ask us to delete yours, whichever is sooner.
• Contact messages: up to 24 months after our last reply, then deleted.
• Hosting and database logs: as set by Google, usually a few weeks.

Part B: the XPNSE app

What the app stores

• Account: your email address and display name (or what Google or Apple share when you sign in with them).
• Your records: transactions, budgets, categories, savings goals, debts, recurring items, bill reminders and alerts you create.
• Cards and accounts: the names you give them, their purpose (for example Household), limits, statement and due dates, balances you enter and EMIs. We never ask for or store full card numbers, CVVs, PINs or bank logins; you may add the last 4 digits of a card to tell cards apart.
• Circles: circles you create or join, shared expenses, payments you record, and join requests (which show the circle's admins your verified sign-in email). Your display name and, only if you add one, your UPI ID are visible to people you share a circle with so they can pay you back.
• Usage data (optional): while "Share usage data" is on in Settings, the app records which features and screens you use, including the type, amount and category of transactions you add, linked to your account, so we can improve the app. Turn it off any time in Settings.
• Feedback you send from the app.

The app does not read your SMS, contacts, photos or location, and does not connect to your bank. It uses the camera only to scan a circle's invite QR code, notifications only for the reminders you turn on, and your phone's fingerprint or face unlock for the optional app lock (we never receive biometric data).

Who can see what

Your personal records are readable only by your account; our database security rules enforce this. Members of a circle see only what is added to that circle. People join a circle only when its admin approves them.

Guest mode

If you use XPNSE without an account, your data stays on your phone and is not sent to us.

Deleting your account

Settings → Delete account erases your account, your personal records, your public profile and your join requests, and removes you from your circles. Shared expenses and payments inside a circle stay with that circle so everyone else's balances remain correct. Usage events and feedback are not removed by this button; email privacy@xpnse.app and we will erase them. You can also export your data as CSV or JSON from Settings at any time.

How long we keep it

We keep your app data while your account exists and erase it from our live database when you delete your account. Usage events are kept for at most 24 months.

Age

XPNSE is for people aged 18 and over; the app asks you to confirm this. The waitlist is also for adults. We do not knowingly collect data from children. If you believe a child has given us data, write to privacy@xpnse.app and we will delete it.

Who processes your data

We use Google Firebase (Google Cloud), provided by Google, as our processor to host this website, store waitlist entries and contact messages, and store and sync app data. Data is stored in the Google Cloud region set for our Firebase project, which may be outside India. If you are on the waitlist and we invite you to test, your email address is also shared with Google (Play Console / Firebase App Distribution) or Apple (TestFlight) for that purpose. We do not sell or rent your data, do not share it with advertisers and do not show ads. We may disclose data if Indian law requires it.

How we protect it

• All traffic to this website, the app and our database uses TLS (HTTPS).
• Google encrypts stored data at rest.
• Strict database rules: the website can only add a waitlist entry or contact message, never read one; app records are readable only by their owner, and circle data only by that circle's members.
• Only we can read waitlist entries and contact messages, through the Firebase console.

Your rights

Under the DPDP Act you can:

• ask what personal data we hold about you and how we use it (access);
• ask us to correct, complete or update it (correction);
• ask us to erase it (erasure), for example to leave the waitlist;
• withdraw your consent at any time, as easily as you gave it (this doesn't affect what we did before);
• have your grievances addressed by our Grievance Officer, and if you are not satisfied, complain to the Data Protection Board of India;
• nominate someone to exercise these rights for you if you die or become unable to.

To use any of these rights, email privacy@xpnse.app from the address you signed up with. We respond within 30 days. Every launch email will also include a way to unsubscribe.

Changes to this policy

If we change this policy we will update the date at the top. If a change is significant, we will tell waitlist members by email and app users in the app before it takes effect.

Contact

BRANDSWOT Consultancy, 1-133, Ground Floor, 1st Road, 1st Cross, Anantapur - 515001, Andhra Pradesh, India.
Privacy and Grievance Officer: privacy@xpnse.app. General: hello@xpnse.app.