Privacy Policy
Last updated 17 August 2026
Who we are
Spolu is a shared-finance app for couples and small groups. It is run by an individual, not a company: the data controller for the app and this website is Janko Hrasko, Slovakia, reachable at inbox@getspolu.com about anything on this page.
What we store
Your ledger — expenses, splits, budgets, settlements, and the accounts and categories you create — lives on your device. When you sign in, your personal space and the parts you share with a group sync to our servers so your other devices can restore them. Your personal space syncs to a private partition only your account can access.
Your account
Sign-in is handled by Amazon Cognito. We only ever see your account's stable identifier (not your password) — Cognito stores and verifies your credentials directly. We do not store your name, address, or any profile data beyond that identifier.
Receipt scanning
When you scan a receipt, the photo is uploaded to process it and extract the merchant, items, and total. The image is stored privately and only accessible to you; it is not shared with anyone besides the OCR provider that reads it.
Group members
Expenses, settlements, budgets, and joint accounts you mark as shared are visible to everyone in that group. Your personal space is never visible to anyone else — your personal accounts, personal budgets, and transfers between your own accounts sync to a private area only your own account can read, so they can be restored on your next device without ever reaching a group member.
The launch mailing list
If you enter your email address on this website, we use it for one thing: to write to you about Spolu — a welcome note, and one more the day it launches. Nothing else. We send a confirmation link first, and we only add you if you click it — so an address typed by someone else never ends up on the list. Every email includes an unsubscribe link, and unsubscribing removes you immediately.
The list is stored and sent by EmailOctopus, who process it on our behalf and for no other purpose. We do not sell, rent, or share it. The legal basis is your consent, which you can withdraw at any time. Signing up for this list is entirely separate from having a Spolu account — neither one creates the other.
Analytics & crash reports
With your permission, Spolu can send crash reports and basic usage analytics (which screens are used, whether actions succeed) to Firebase, a Google service, so we can find and fix problems. This is off by default and only starts if you turn it on — you can choose during onboarding, or anytime after in Profile → "Share analytics & crash reports". Turning it off stops new data from being collected immediately. We keep a record of your choice — what you decided, when, and which version of this policy you were shown — stored privately with your own data so it follows you to a new device instead of quietly resetting.
This website has no analytics of its own. The sign-up form on the home page is provided by EmailOctopus and loads from their servers, so they may set a cookie when that form is shown; no other page on this site loads anything external.
Third parties
These services process data on our behalf, each limited to one job:
- Amazon Web Services — hosting, storage, and sign-in (Amazon Cognito).
- A receipt-OCR provider — extracting text from photos you choose to scan.
- EmailOctopus — the launch mailing list, if you signed up for it.
- Firebase (Google) — analytics and crash reports, only if you opted in.
None of them receives more than what is needed for that job, and none is authorized to use your data for anything else.
Where your data is stored
The app's servers run in Amazon Web Services' Europe (Frankfurt) region, so your ledger and receipt images stay within the EU. Some of the services above may process data outside the EU; where they do, that transfer is covered by the safeguards required under GDPR.
Data retention
Your data stays on your device until you delete it (uninstalling the app, or removing a group, removes its local copy). Synced group data persists on our servers so it can be restored on a new device or after signing back in — leaving a group does not retroactively erase history other members still see. Mailing-list addresses are kept until you unsubscribe or the list is retired. You can ask for your account and its data to be deleted at any time; what that removes and what it leaves behind is set out in full on its own page.
Deleting your account
You can ask us to delete your Spolu account and the data stored with it at any time, and you do not need the app installed to ask. Delete your account explains how to make the request, what we delete, what stays in a group you shared it with, and how long it takes.
Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, or restrict how we use it, and you can object to processing or ask for your data in a portable form. Where processing rests on consent — analytics, and the mailing list — you can withdraw that consent at any time, without affecting what was done before you withdrew it. Write to inbox@getspolu.com and we will respond within one month; for deleting the whole account, the procedure is here. You also have the right to complain to a supervisory authority; in Slovakia that is the Office for Personal Data Protection (Úrad na ochranu osobných údajov SR).
Your choices
You can sign out at any time (your local data stays on the device), remove yourself or others from a group, opt in or out of analytics and crash reporting anytime in Profile, or stop syncing by staying offline — the app keeps working fully offline except for scanning new receipts.
Changes to this policy
If what we do with your data changes, we will update this page and its date. Changes that affect something you consented to will be put to you again rather than applied quietly.