Privacy policy
Effective 3 November 2026
In short
- Your entries are stored on your iPhone. You don’t need an account.
- OpenAI reads what you say, type or photograph to make a draft, only after you allow it. You can withdraw that in Settings › Privacy. We never keep your recordings or photos.
- Unless you turn it off, we keep the text of a note, its draft and your corrections for 30 days, not linked to you, to improve recognition. It’s never used to train AI models.
- No ads, no third-party analytics, no tracking, and we never sell your data.
Who we are
Tellspend is an expense tracker for iPhone, with this website at tellspend.app. “We” means the publisher of Tellspend, who is responsible for your data. You can reach us at support@tellspend.app.
What we collect, and why
Your entries
Your entries, accounts, budgets, subscriptions, places and settings are saved on your iPhone. We can’t see them unless you back them up with Tellspend Pro. Places never reach us, even then: Apple Maps names them on your iPhone.
Notes, voice and photos
When you say, type, share or photograph an expense, the app sends it to our server, which has OpenAI turn it into a draft. With it go the language, the account’s currency, the date and the names of categories you’ve made. Nothing is sent until you allow it, and you can withdraw your permission at any time.
From a CSV import, OpenAI gets only what you choose to have sorted. Sort automatically sends the descriptions of payments Tellspend couldn’t place, each with an amount and its currency. Suggest matches sends the file’s category names that Tellspend didn’t recognise, at most 25 at a time, each with up to 2 of its descriptions and one amount with its currency. Before those are sent, runs of 3 or more digits and email addresses are removed, and names are cut to 60 characters and descriptions to 40. Neither sends the file’s dates or account names.
We never keep recordings or photos, and photos are sent without their location. Under OpenAI’s terms for API customers, OpenAI doesn’t train its models on this data and may keep it for up to 30 days to monitor for abuse.
Improving recognition
Unless you turn off Help improve recognition in Settings › Privacy, we keep a sample of each note:
- the text you typed or said, never the recording;
- the draft, and for a photo never the picture;
- what you changed before saving;
- the language, currency, date and version of our instructions.
A sample has no account, device or purchase id, no IP address and no time of day, so it isn’t linked to you, and card numbers and email addresses are blanked out. We use them only to test and improve how Tellspend reads notes, never to train AI models, and we never give them to OpenAI or anyone else. Each is deleted after 30 days. Turning it off stops new samples; earlier ones can’t be traced to you and expire on schedule. Sorting a CSV import never makes a sample.
Account, backup and sync
Signing in is free and optional, with Apple, Google or your email. We then keep your email address, how you sign in, and the model of each signed-in device and when it was last used. A password is kept only as a one-way hash. After you change your email, the old address is kept for up to 14 days so a change you didn’t make can be undone. We email you only sign-in codes and security notices.
With Tellspend Pro, your entries, accounts, budgets, subscriptions, categories and settings are kept encrypted on our server, to back them up and sync them on up to 5 devices. We hold the keys, so this isn’t end-to-end encryption: we open your copy only if you ask us to or the law requires it. If Pro ends, syncing pauses and the copy stays until you delete your account.
Purchases
Apple takes the payment for Pro, and we never see your card or Apple ID. RevenueCat keeps track of who has Pro, under an anonymous id or your account id if you sign in, with your purchase history, app version, App Store country and IP address.
Keeping the service safe
Each request carries an anonymous device id and your purchase id, and Apple’s App Attest confirms it comes from a genuine copy of Tellspend. Our server keeps a record of each device, with nothing you’ve entered, and counts its voice, text and photo entries each month for the free plan’s limit. To stop floods of requests, it counts recent requests per IP address for a few minutes, in memory. Its technical logs include IP addresses but never what you said, typed or photographed, and older entries are overwritten as new ones arrive.
Why we may use your data
We use your data to provide what you ask for: reading notes, signing in, Pro and sync. Notes go to OpenAI only with your permission, which you can withdraw at any time. Device checks, logs and samples rely on our legitimate interest in keeping the service secure and reading notes correctly; you can object to samples by turning the switch off. We also keep or share data when the law requires it.
Who helps us
We share data only with companies that help us run Tellspend, only for the purposes above, and each must protect it at least as well as this policy does:
- OpenAI reads notes, voice recordings and photos into drafts, and sorts the parts of a CSV import you choose.
- Apple provides the App Store and its payments, Sign in with Apple, App Attest and Apple Maps.
- Google provides Sign in with Google, if you choose it.
- RevenueCat keeps track of Pro subscriptions.
- An email service sends our sign-in codes and security notices.
- Hosting and network providers run our server, carry the connection and store encrypted backups, and an update service delivers app updates.
Where your data is processed
Our server is in the EU. OpenAI processes notes in the United States, and our other providers may process data outside the EU, under the safeguards their terms provide for international transfers.
How long we keep it
| What | Where | How long |
|---|---|---|
| Your entries and settings | Your iPhone | Until you delete them or the app |
| Recordings and photos | Not kept by us | OpenAI may keep them up to 30 days to monitor for abuse |
| Samples to improve recognition | Our server | 30 days |
| Your account and, with Pro, its encrypted copy | Our server | Until you delete the account, then up to 30 days in backups |
| Sign-in codes, attempts and unfinished sign-ups | Our server | 24 hours at most |
| A signed-in device | Our server | Until you sign out on it, or it goes 180 days unused |
| Device record and monthly entry counts | Our server | Until you use Delete all data |
| Purchase records | Apple and RevenueCat | Under their policies; when you delete your account, we ask RevenueCat to delete its record |
Your choices and rights
Allow or stop OpenAI
Tellspend asks for your permission before anything goes to OpenAI. The setup screen offers Allow and start or Ask me later, and until you allow it, each voice, text or photo entry, and sorting a CSV import, asks first.
To withdraw it, open Settings › Privacy, tap Reading notes with OpenAI, then Withdraw permission. From then on, nothing is sent to OpenAI until you allow it again, and you can still add expenses by hand with +. To allow it again, tap the same row, or tap Allow when an entry asks. Your choice is kept only on your iPhone, so another device, or this one after Delete all data, asks again. Withdrawing doesn’t undo what was sent before.
Get a copy
Export entries, in Settings › Your data, gives you a CSV file on any plan. If you’ve signed in, write to us for a full copy of your account’s data, and we’ll send it within 30 days.
Delete all data
In Settings › Your data, Delete all data erases Tellspend’s data on your iPhone and your device’s record on our server and, if you’re signed in, your account and its copy. It doesn’t cancel Pro: open your iPhone’s Settings, tap your name, then Subscriptions. It can’t reach samples, which aren’t tied to you and expire after 30 days.
Delete your account
In Settings, tap Tellspend account, then Delete account. This removes your account and its copy from our server, and this iPhone keeps its entries. Deleting the app alone removes nothing from our server.
Your rights
Depending on where you live, you can ask for a copy of your data, to correct or delete it, to limit or object to how we use it, and to receive it in a portable format, and you can complain to your data protection authority. Write to support@tellspend.app, from your account’s address if you have one.
Children
Tellspend isn’t made for children under 13, and we don’t knowingly collect their data.
Changes to this policy
If we change how Tellspend handles data, we’ll update this page and its date before the change takes effect.