Back to home
    EXPENSE ROASTER

    Privacy Policy

    Last updated: May 9, 2026

    1

    Introduction

    Expense Roaster ("we," "our," or "us") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and protect information when you use our website and services (the "Service"). By using Expense Roaster, you agree to the practices described in this policy.

    2

    Information We Collect

    A. Account Information

    We collect the following information about your account:

    • Name (if provided)
    • Email address
    • Subscription status (free or premium, renewal date, plan type)
    • Billing metadata (Stripe customer ID, payment success or failure status, last payment date — we do not store your card number, CVV, or full payment details)

    Payment processing is handled by:

    Web and iOS

    Stripe handles all payment card processing for web subscriptions, one-time purchases, and iOS in-app purchases. We do not store your full credit card details, CVV, or raw payment information. Stripe is PCI-DSS Level 1 certified. For more information visit stripe.com/privacy

    Android

    Google Play Billing handles all Android in-app purchases and subscriptions. We do not access or store your Google payment information. For more information visit policies.google.com/privacy

    Subscription Management

    RevenueCat is used to manage and sync subscription status across iOS and Android platforms. RevenueCat receives subscription state information but does not process payment card data. For more information visit revenuecat.com/privacy

    B. Financial Data You Upload

    When you use Expense Roaster you may upload:

    • Receipt images
    • Bank statement files
    • Transaction data
    • Spending records

    This data is used solely to generate AI-based financial insights and behavioural analysis.

    Financial documents you upload (receipts and bank statements) are processed by our AI system and then permanently deleted from our servers. We do not retain your original financial documents after processing is complete.

    We retain only the AI-generated analysis and roast content produced from your uploads, not the source documents themselves.

    C. Usage Data

    We may collect:

    • Log data
    • IP address
    • Device type
    • Browser type
    • Pages visited
    • Feature usage

    This helps improve performance and security.

    D. Cookies

    We may use cookies or similar technologies for:

    • Authentication
    • Session management
    • Analytics

    You may disable cookies via your browser settings, though some features may not function correctly without them.

    3

    How We Use Your Information

    We use collected data to:

    • Provide financial analysis and AI-generated insights
    • Process subscriptions and payments
    • Improve our services
    • Monitor usage and prevent abuse
    • Communicate with you about your account

    We do not sell your personal or financial data to any third party under any circumstances.

    4

    AI Processing

    Your uploaded financial data is processed by OpenAI's API to generate personalised insights, analysis, and roast content. OpenAI processes this data in accordance with their enterprise privacy commitments.

    We do not use your financial data to train AI models — neither our own systems nor OpenAI's models. Your financial data is used solely to generate your personalised content and is not shared with other users or used for any other purpose.

    For more information on OpenAI's data practices visit openai.com/privacy.

    5

    Data Storage and Security

    We implement reasonable technical and organisational measures to protect your information, including:

    • Encrypted data transmission (HTTPS)
    • Secure authentication systems
    • Restricted internal access
    • Row-level security on our database so each user can only access their own data
    • Immediate deletion of financial documents after processing

    However, no system is 100% secure and we cannot guarantee absolute security. In the event of a data breach affecting your personal information we will notify you as required by applicable law.

    6

    Data Retention

    Financial documents (receipts and bank statements)

    Deleted immediately and permanently after AI processing is complete. We do not retain your source financial documents.

    AI-generated roast content and analysis

    Retained while your account is active. Deleted within 30 days of account deletion.

    Account information

    Retained while your account is active and for up to 90 days after account deletion to allow for account recovery if requested.

    Transaction and spending data

    Retained while your account is active. Deleted within 30 days of account deletion.

    Usage and log data

    Retained for up to 12 months for security and performance monitoring purposes.

    Billing metadata

    Retained for 7 years as required by Canadian tax law.

    You may request deletion of your data at any time by visiting our Data Deletion page or contacting us at admin@expenseroaster.com. Account deletion requests are processed within 30 days.

    7

    Third-Party Services

    We use the following third-party service providers:

    Payment Processing

    • Stripe (web and iOS payment processing)
    • Google Play Billing (Android purchases)
    • RevenueCat (subscription management across iOS and Android)

    AI Processing

    • OpenAI (generates all roast content and financial analysis from your uploads)

    Infrastructure and Security

    • Supabase (database and authentication)
    • Replit (application hosting)

    Monitoring and Performance

    • Sentry (error tracking)

    Each provider processes only the data necessary to perform their specific service. We do not share your financial documents or roast content with any third party beyond what is required for service delivery.

    8

    Your Rights

    Depending on your jurisdiction you may have the right to:

    • Access your personal data
    • Request correction of inaccurate data
    • Request deletion of your data
    • Withdraw consent at any time
    • Request data portability
    • Know what personal data we have collected

    Canadian Users — PIPEDA

    Your personal information is collected, used, and disclosed in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA).

    We collect only the information necessary to provide the Service. Your information is used only for the purposes described in this policy. You may withdraw consent to our collection and use of your personal information at any time subject to legal or contractual restrictions by contacting us at admin@expenseroaster.com.

    To file a privacy complaint contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.

    US Users — CCPA (California)

    California residents have additional rights:

    • Right to know what personal information we collect, use, and share
    • Right to delete personal information
    • Right to opt out of sale of personal information (we do not sell personal information)
    • Right to non-discrimination for exercising your privacy rights

    To exercise your California privacy rights contact us at admin@expenseroaster.com.

    EU and UK Users — GDPR

    If you are located in the EU or UK your personal data is processed under legitimate interest and contract performance as the legal basis. You have the right to lodge a complaint with your local data protection authority.

    To exercise any of these rights contact us at admin@expenseroaster.com.

    9

    Children's Privacy

    Expense Roaster is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13.

    If you are between 13 and 17 we recommend reviewing this policy with a parent or guardian.

    If we become aware that we have collected personal information from a child under 13 without verifiable parental consent we will delete that information immediately. If you believe we have inadvertently collected information from a child under 13 please contact us at admin@expenseroaster.com.

    10

    Changes to This Policy

    We may update this Privacy Policy from time to time. When we make material changes we will notify you:

    • By email to the address associated with your account
    • By prominent notice within the app

    We will provide at least 14 days notice before material changes take effect. Non-material changes such as clarifications or corrections may take effect immediately.

    The date at the top of this policy reflects when it was last updated. We encourage you to review this policy periodically.

    11

    Contact Us

    For privacy-related questions, requests, or complaints contact us at:

    Expense Roaster

    Toronto, Ontario, Canada

    admin@expenseroaster.com

    We will respond to all privacy requests within 30 days.

    Expense Roaster © 2026