FamilySpend — Privacy Policy

Effective date: August 24, 2026 · Last updated: August 24, 2026

1. Who we are

FamilySpend is offered by Viacheslav Volosheniuk, an individual residing in Alberta, Canada, doing business as Hesti. FamilySpend is a mobile application for families to coordinate shared expenses, budgets, and shopping lists.

If we incorporate as a business entity in the future, this section will be updated and you'll be notified per Section 14 (Changes to this policy).

Contact for privacy questions: privacy@hesti.app

2. The short version (TL;DR)

Because finance-app privacy policies are usually unreadable, here's the truth in plain English:

The rest of this document is the details.

3. What information we collect

3.1 Account information

• Email address — used as your login identifier and to send important service notifications (e.g., password reset, account deletion confirmation). We do not send marketing emails.
• Password — never stored in plaintext; hashed by Supabase Auth using industry-standard algorithms (bcrypt).
• Authentication tokens — JSON Web Tokens (JWTs) issued by Supabase to keep you logged in. Stored on your device; never shared.

3.2 User-generated content

Everything you enter in the app, including:

• Transactions (amount, category, account, date, description, notes)
• Accounts you create (name, color, type — cash/card/savings)
• Categories you create (name, icon)
• Budgets you set (amounts per category, period)
• Goals you set (name, target amount, deadline)
• Recurring transaction templates (name, amount, schedule)
• Shopping lists (title, items, completion status)
• Household membership data (which spaces you belong to, your role — owner or member)
• Invitations you send (recipient identifier, status)

3.3 Device data (required-reason APIs)

Per Apple's privacy framework (declared in our privacy manifest):

• UserDefaults access — to remember your settings (theme mode, language)
• File timestamp access — for local caching and sync conflict resolution
• Disk space queries — for local storage management
• System boot time — used by the app runtime for performance metrics; never sent to us

These are technical necessities of running a modern iOS app, declared per Apple's required-reason API rules. No personally identifying information is associated with them.

3.4 What we explicitly do NOT collect

• ❌ Advertising IDs (IDFA / IDFV-for-advertising)
• ❌ Location data (precise or approximate)
• ❌ Photos, camera, microphone, contacts (we never request these permissions)
• ❌ Browsing history or web tracking data
• ❌ Health, biometric, or genetic data
• ❌ Sensitive personal information (race, ethnicity, religion, sexual orientation, political views)
• ❌ Bank account numbers, credit card numbers, or any payment instrument data. Paid subscriptions are billed through Apple In-App Purchase — Apple processes the payment and we receive only the fact that a subscription is active, its plan, and its renewal date.
• ❌ Analytics events from third-party SDKs (we have no Amplitude, Mixpanel, Segment, Firebase Analytics, PostHog, etc.)
• ❌ Crash reports from third-party services (Sentry, Bugsnag, etc.)
• ❌ Real names (unless you enter your name as user-generated content)

3.5 Subscription and purchase information

If you subscribe to FamilySpend Premium, we collect and store:

• Subscription status — whether your household has an active subscription, the date it renews or expires, and (temporarily) any plan change you have scheduled.
• Plan identifier — which subscription product you purchased (monthly or annual).
• A purchase identifier linked to your account — our payment infrastructure provider, RevenueCat, identifies you by the same anonymous account ID we use internally, so your subscription follows you across your devices and reinstalls.

We do not receive or store your credit card number, billing address, Apple ID, or any other payment credential. Apple processes the payment; we are told only whether the subscription is active and when it ends.

4. How we use your information

We use your data only to:

1. Provide the service — store your transactions, sync data across household members in real time, display your budgets and reports.
2. Authenticate you — verify it's really you signing in.
3. Respond to your support requests — when you email us with a question or issue.
4. Comply with legal obligations — if we receive a court order or regulatory request (rare; we'll notify you unless legally prohibited).
5. Maintain security — detect and prevent abuse, fraud, or unauthorized access.

We do not use your data to:

• Train AI models (ours or anyone else's)
• Target advertising (we don't show ads)
• Build a profile for marketing or third-party sale
• "Improve our product" via behavior analysis (we don't have analytics infrastructure)

5. Legal basis for processing (Canadian PIPEDA / EU GDPR)

For users in Canada under PIPEDA: we process your data based on your implied consent by using the app, and because processing is necessary to provide the service you requested.

For users in the EU/UK under GDPR, legal bases are:

• Contract performance (Art. 6(1)(b)) — processing is necessary to fulfill our agreement to provide the FamilySpend service.
• Legitimate interest (Art. 6(1)(f)) — for security monitoring and abuse prevention.
• Consent (Art. 6(1)(a)) — for any optional features that require it (none at v1; reserved for future).

You can withdraw consent at any time by deleting your account (Section 9).

6. Who we share your data with

6.1 Service providers (data processors)

• Supabase Inc. — our database and authentication provider. Stores your data in AWS us-east-1 (Northern Virginia, USA). Supabase is contractually bound to process data only on our behalf. See the Supabase Privacy Policy.
• Apple Inc. — processes all subscription payments through In-App Purchase and is the merchant of record, delivers the app via the App Store and TestFlight, and provides the Apple Push Notification service. Apple receives your payment data; we receive only subscription-status information. See Apple's Privacy Policy.
• RevenueCat, Inc. (United States) — verifies your App Store purchase with Apple and maintains your subscription entitlement. RevenueCat receives your anonymous FamilySpend account identifier, your device identifier, and your purchase and renewal events from Apple. It does not receive your email address, your name, or any of your financial tracking data. See RevenueCat's Privacy Policy.
• Expo (650 Industries, Inc.) — delivers push notifications to your device on our behalf. Notification content (for example, "your shared space is paused") passes through Expo's push service and Apple's Push Notification service.

6.2 Members of your household (other users)

When you join or invite someone to a "space" (household), all members of that space can see all data created in that space. This is the fundamental design of FamilySpend — shared visibility is the value. Specifically:

• Other members can see transactions, shopping list items, budgets, goals, and categories created within the shared space.
• Other members can see who created each item (via internal metadata, even if not displayed on every row in the UI).
• Members cannot see your personal account info (email, password) — only what you've contributed to the shared space.

When you leave or are removed from a space, your past contributions stay in that space (because other members may rely on them for their context), but you lose access to that space's data. If you want your contributions deleted from a space you've left, email privacy@hesti.app.

6.3 We do NOT share with

• Advertisers, ad networks, ad-tech companies
• Data brokers
• AI/ML training data providers
• Analytics vendors
• Social media platforms
• Other apps or services for any "personalization" or "enhancement"

6.4 Legal compliance and safety

We may disclose your data if compelled by valid legal process (subpoena, court order) or to protect rights, safety, or property. We will resist overly broad requests and notify you when legally possible.

7. International data transfers

Your data is stored on Supabase in AWS us-east-1 (Northern Virginia, USA).

For users outside the US:

• EU/UK users (GDPR): This is a transfer of personal data to a country (the US) that doesn't have a full adequacy decision. We rely on the EU-US Data Privacy Framework (which Supabase participates in) and on Standard Contractual Clauses (SCCs) as the transfer mechanism. You can request a copy of these clauses by emailing privacy@hesti.app.
• Canadian users (PIPEDA): Cross-border transfers to the US are permitted under PIPEDA with appropriate safeguards. Supabase's contractual commitments to data protection serve as those safeguards.
• Other jurisdictions: Local privacy laws may apply. By using FamilySpend, you acknowledge your data may be processed in the US.

Subscription and purchase data is also processed by RevenueCat, Inc. in the United States. The same safeguards described above apply to that transfer.

If you object to US data storage, FamilySpend may not be the right product for you at v1. We may add region selection in the future.

8. How long we keep your data

• Active account: indefinitely — as long as you actively use FamilySpend.
• Inactive account (no login in 24 months): we may notify you and, if no response, delete the account.
• Deleted account: all your personal data is removed from active systems within 30 days of your deletion request. Backups containing your data are rotated out within 90 days.
• Legal retention: we may retain limited records (e.g., deletion request logs) for up to 7 years to demonstrate compliance with privacy regulations.
• Subscription records: your subscription status is kept for as long as your account exists. RevenueCat retains purchase and renewal events per its own retention schedule. Apple independently retains billing records it needs for tax and financial reporting; we cannot delete those on your behalf.

9. Your rights — and how to use them

We will not retaliate, charge a fee, or worsen the service for exercising these rights. If we deny a request, we'll explain why and how you can appeal.

10. Data deletion — the actual process

Email privacy@hesti.app with subject "Delete my account." Include the email address associated with your account. We will:

1. Confirm the request within 72 hours.
2. Verify your identity (typically by asking you to reply from the account's email).
3. Delete all your personal data from active Supabase systems within 30 days.
4. Confirm completion via email.
5. Delete your subscriber record (subscription status and purchase history) from RevenueCat.

Note: deleting your account does not cancel an active App Store subscription. You must cancel it yourself in Settings → your Apple ID → Subscriptions, or Apple will keep billing you. We will tell you this when you request deletion.

If you are the sole owner of a household ("space") with other members, we will offer to either (a) transfer ownership to another member before deletion, or (b) delete the entire space if all members consent.

11. Privacy by jurisdiction

11.1 California residents (CCPA / CPRA)

You have the rights to know, delete, correct, and to opt out of "sale" or "sharing" of personal information. FamilySpend does not sell or share personal information as defined under CCPA/CPRA. To exercise your rights, email privacy@hesti.app.

11.2 EU/UK residents (GDPR / UK GDPR)

Your rights are described in Section 9. Our data controller is Viacheslav Volosheniuk. The lead supervisory authority for complaints is your local Data Protection Authority in your country of residence.

11.3 Canada residents (PIPEDA, Alberta PIPA)

The Office of the Privacy Commissioner of Canada (OPC) is the federal regulator. Alberta residents may also contact the Office of the Information and Privacy Commissioner of Alberta (OIPC). You may file a complaint with either.

11.4 Other jurisdictions

We will respect privacy rights granted by your local law to the extent applicable.

12. Children's privacy

FamilySpend is not directed at children under 13, and we do not knowingly collect personal information from children under 13.

A household ("space") in FamilySpend is intended to be created and managed by adults. While household members of any age may benefit from the family's shared budget, only users aged 13 or older should create their own FamilySpend account. Younger family members should be represented in the household's data (e.g., spending on their behalf) without having their own account.

If we discover we've collected data from a child under 13 without parental consent, we will delete it. Parents who believe their child under 13 has created an account can email privacy@hesti.app.

For users aged 13–17, parental involvement in account creation is encouraged. Purchases require an Apple ID; family purchase controls (including Apple's Ask to Buy) are managed in iOS Settings, not in FamilySpend.

13. Security

We protect your data through:

• Encryption in transit — all data exchanged with our servers uses TLS 1.2+ (HTTPS).
• Encryption at rest — Supabase encrypts data at rest using AWS-managed keys.
• Row-Level Security (RLS) — Supabase enforces that you can only access data from spaces you're an active member of, at the database layer (not just in app code).
• Authentication — passwords are hashed using bcrypt; sessions use rotating JWTs.
• No payment data stored — FamilySpend does not process payments and never stores credit card or banking credentials.
• Server-authoritative subscription status — subscription state is written only by our server after Apple and RevenueCat confirm the purchase. The app on your phone cannot grant itself premium access, and no other household can read or change your household's subscription state.

No security is perfect. If we discover a breach affecting your data, we will notify you within 72 hours of discovery, per applicable law.

14. Changes to this policy

We may update this policy over time. Material changes (changes that meaningfully expand what data we collect or how we use it) will be announced via:

• An in-app notification on your next login
• An email to your account email address
• A revised "Last updated" date at the top of this policy

For non-material changes (clarifications, typo fixes), we'll just update the date. Previous versions are available on request.

If you don't agree with a change, your remedy is to delete your account before the effective date of the change.

15. Contact

• Privacy questions, data subject requests: privacy@hesti.app
• General questions and support: support@hesti.app or the support page
• Mailing address (for formal legal correspondence): available on request via privacy@hesti.app

For Canadian residents, you may also contact:

• Office of the Privacy Commissioner of Canada
• Office of the Information and Privacy Commissioner of Alberta