Legal

Privacy policy

Last updated May 1, 2026. Plain English. No dark patterns.

The short version

We only see emails you explicitly forward to us. We never connect to your inbox or read anything else.

We never sell your data. We never serve ads. We collect the minimum we need to make Spendbox work.

You can export everything as CSV at any time, and delete your account in one click — your data is fully removed within 30 days.

What we collect

Account data: your name, email and hashed password. Used to identify you and let you sign in.

Forwarded emails: the content of emails you forward to your unique Spendbox address. We parse subject, sender, body and attachments to extract subscription, invoice and purchase information.

Usage data: anonymous, aggregated metrics about which features are used. Never tied to individuals or sold to third parties.

We never collect: location data, device fingerprints, browsing history, or anything from outside the Spendbox app.

How we use it

To provide the Spendbox service: parse forwarded emails, render dashboards, send renewal reminders and product emails.

To improve the product, in aggregate: we look at high-level usage patterns to decide what to build next.

To respond to support requests, when you write to us.

Sharing

We share data only with infrastructure providers strictly necessary to run Spendbox: AWS (hosting), Stripe (billing), Postmark (transactional email). All sub-processors are listed in our DPA.

We never sell, rent or trade your data — under any circumstance.

We disclose data only when legally required, and we'll always notify you unless prohibited.

Your rights

Access: request a full export of your data, anytime, from Settings.

Deletion: delete your account and all associated data, anytime, from Settings.

Correction: edit your data directly in the app at any time.

Portability: export to CSV or JSON, supported in every plan.

Contact

Questions? Email privacy@spendbox.co. We respond within 2 business days.

Our data protection officer can be reached at dpo@spendbox.co.