Reading happens on your phone
Spenlio reads bank and card SMS on this device and builds your budget here. Reading never uploads your messages.
Personal conversations are off-limits
Messages from people — any sender that is a phone number — are never shared, never sent for learning, and never included in lookups. Only institutional senders like banks count.
Sharing is a separate choice
If you turn on sharing, messages from your banks and services that Spenlio hasn't learned to read yet — which can include security codes or promotions — are sent to train Spenlio, including its AI models, to read them. It's off until you turn it on, and you can stop any time.
Crash reports are opt-in too
Technical crash reports (device model, where the code failed) are sent only if you turn them on — and they never contain message content or money data.
Usage stats are anonymous
Spenlio counts which screens are used — never what's on them — to improve the app. Google's advertising identifier is disabled for this, and you can turn it off in Settings at any time.
What Spenlio does on your device
Spenlio reads the SMS inbox on this phone to find messages from banks and financial services, and turns them into a private ledger: transactions, accounts, budgets, and insights. All of this parsing happens on your device. Your ledger, category choices, notes, renames, budgets, and any account numbers you enter are stored only on this phone.
Deleting the app deletes this local data. You can also export your ledger as a CSV at any time from Settings → Backup & export.
What never leaves your phone
Personal conversations — any sender that is a phone number is treated as a person, and nothing from that conversation is ever uploaded, included in lookups, or used for learning, no matter how many messages there are.
Once Spenlio has learned to read a bank's format, those messages are handled on your device and are not shared.
Your merchants, amounts, balances, notes, corrections, category rules, and entered account or card numbers are never uploaded.
What Spenlio's servers see during normal use
To recognize bank message formats, the app asks Spenlio's servers for reading patterns for the institutional senders found in your inbox (for example "ComBank" or a 4-digit short code). Only those institutional sender names are sent — never phone-number contacts, and never message content.
To show estimated currency conversions, the app requests exchange rates by currency pair and date. No transaction details are sent.
Sharing unread messages (optional)
If some of your banks can't be read yet, you can turn on sharing so Spenlio can learn their formats. When sharing is on, Spenlio sends messages it hasn't learned to read yet from institutional senders — banks and services, never phone-number contacts. Because these are simply the messages it couldn't parse — including ones it set aside on your device — they can include a bank's one-time passwords, security codes, or promotional messages, not only transaction alerts. Only messages older than the waiting period you chose are sent (1 hour unless you change it; up to 1 year). Each includes its text, the sender name, and when it was received, plus technical references (a message id, ordering, content fingerprints, and per-sender message counts) that prevent duplicates and let Spenlio's servers decide what to accept before anything is sent.
Shared messages are used to train and improve Spenlio — including the AI models it relies on. They teach it to read bank messages, to tell real transactions apart from security codes and promotions (so those are set aside rather than counted as spending), and to make Spenlio better overall. This processing is automated, is run by Spenlio and by AI providers under contract with Spenlio — who may use your messages only to do this work for Spenlio, not for their own products or purposes — and may happen outside your country. Your messages are used only to improve Spenlio: never sold, never shared with advertisers or data brokers, and never used to advertise to you or profile you. Spenlio keeps only what this training and its review need.
You can stop sharing at any time in Settings → Message sharing; stopping cancels anything queued and prevents future uploads. Sharing that has already happened is permanent: Spenlio keeps the copies it received for training and review, and what they taught Spenlio cannot be pulled back out.
Crash reports (optional)
If you turn on crash reports, technical reports are sent to Firebase Crashlytics (a Google service) when the app crashes or hits an internal error: the error and where it happened in the code, your device model, Android version, and app version. Google processes these reports on its own infrastructure, which may be outside your country.
Crash reports never include message content, sender names, merchants, amounts, or anything else from your money data. Turning them off stops collection immediately and deletes any unsent reports.
Usage analytics (on by default)
So Spenlio can see which features are used and where people get stuck, the app sends anonymous usage statistics to Firebase Analytics (a Google service): which screens are opened, how often and how long the app is used, and your device model, Android version, and app version. Google processes these statistics on its own infrastructure, which may be outside your country.
Usage statistics never include message content, sender names, merchants, amounts, balances, or anything else from your money data — they record which screens are used, never what those screens show. Spenlio disables Google's advertising identifier and Android's device identifier for these statistics: they are tied to a random install id, not to your identity, and are never used to advertise to you.
Unlike sharing and crash reports, usage analytics is on by default. You can turn it off at any time in Settings → Usage analytics, which stops collection immediately.
Your choices
SMS access, sharing, crash reports, and usage analytics are each independent and each your choice. Revoking SMS access in Android settings stops all reading; your existing ledger stays. Sharing and crash reports are off until you turn them on; usage analytics is on by default. All of them can be turned off in Settings at any time.
This website
spenlio.com itself uses Google Analytics to count visits and see which pages are read — standard, anonymous web statistics, separate from the app and never connected to anything the app does on your phone.
Sharing is permanent
Please treat sharing as permanent before you turn it on. Spenlio is a small service and does not offer individual access, correction, or deletion of shared messages — once a message is sent, its copy stays with Spenlio for training and review, and what Spenlio has learned stays part of Spenlio. Shared messages are not used to identify you. Rights that your local law grants you are not limited by this policy; questions go to Spenlio's contact address.
Questions?
Anything about this policy or your data: contact Spenlio.