Privacy policy

Last updated October 14, 2026. This policy is for Expenvo at expenvo.com. Contact [email protected].

What we do not collect

Statement PDFs are read in your browser. The file is not uploaded. If a PDF is a photo, you can choose to read the picture on your device. The picture stays on your device. The first time you do that, English language data is downloaded so the picture can be read.

What we collect if you ask us to save

Signing in with Google gives us your email, name, and the Google account id. If Save to my account is on, we store the charges: date, description, name, amount, currency, category, and the bank or card name we detected. We do not store the PDF. If Save to my account is off, those charges stay in this browser tab only. A statement you upload while signed in still counts toward the one free upload this month.

If you pay for Pro, Paddle is the company that charges you and handles the payment. We store the plan, whether it is active, the customer number, the subscription number, and when the paid period ends. We never store a card number.

If you join the email list, we store the email address you enter. It stays unconfirmed until you open the confirmation link. You can leave the list from that link. We do not sell the address.

Why we collect it

To show you your charges, remember a category you change, apply the free upload limit, and keep a paid plan up to date. Where European privacy law (GDPR) applies, we rely on the service you asked for, and on your agreement when you sign in with Google or save charges. You can read a statement without saving it.

United States, including California

If you live in California, the California Consumer Privacy Act (CCPA), as updated by the CPRA, gives you the right to know the personal information we collect, the right to delete it, the right to correct it, and the right to say no to the sale or sharing of personal information. Expenvo does not sell personal information and does not share it for advertising across other websites. To make a request, email [email protected]. Someone you authorize can make the request for you. We will not treat you worse for using these rights. If we say no to a request, reply to that email to appeal.

Residents of other US states with a privacy law can use the same email to ask for access, correction, or deletion. We treat those requests the same way.

Canada and Europe

If you are in Canada, the federal privacy law (PIPEDA) applies: we say why we collect information, we collect only what is listed above, we keep it only while you have an account, and you can see it and correct it. Email [email protected] to see, correct, or delete saved statements. You can also complain to the Office of the Privacy Commissioner of Canada.

If you are in the European Economic Area, the UK, or Switzerland, you can ask to see your data, correct it, delete it, limit how we use it, get a copy of it, or object to how we use it. You can also complain to your local privacy authority. We do not use saved charges for advertising and we do not sell them.

Where it is stored

Saved charges are stored in Canada. Cloudflare hosts the website and receives payment notices. Those notices contain billing details, not your charges. Fonts come with the site.

Who else handles data

Supabase: sign in and saved charges, stored in Canada.
Google: sign in only.
Cloudflare: the website and payment notices.
Paddle: payments, tax, and buyer support. Paddle is the company that sells Pro to you.
jsDelivr, a public file host: language data for reading a photographed statement, only if you choose that.

Retention and children

Saved statements stay until you delete them or close the account. Payment records are kept as long as tax rules require, often seven years, by Paddle and in our payment records. Expenvo is for adults 18 and over. We do not knowingly create accounts for children.