Privacy policy
Last updated 11 November 2026
XPENS is a personal money ledger at xpens.in. This page explains what XPENS collects, why, where it is kept and what you can do about it.
What XPENS collects
- From Google when you sign in: your Google account ID, email address and name. XPENS asks only for the basic
openid,emailandprofilepermissions. It never sees your Google password and cannot read your Gmail, Drive, contacts or anything else in your Google account. - What you enter: the accounts, transactions, budgets, bills, loans, holdings and other records you type in or import.
- A sign-in cookie: one secure cookie that keeps you signed in for up to 7 days, plus a short-lived cookie used only while signing in. There are no advertising or tracking cookies and no analytics.
How it is used
Your Google account ID identifies your private ledger. Your name and email are shown to you inside the app. Your records are used only to show you your own ledger, balances and reports. XPENS does not sell your data, does not use it for advertising, does not share it with anyone, and does not use it to train AI models.
XPENS's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Where it is stored
Your ledger is stored in a Cloudflare D1 database (Asia-Pacific region) and served through Cloudflare. Cloudflare processes it on XPENS's behalf as a hosting provider. Each signed-in person can only read and change their own ledger.
How it is protected
- All traffic uses HTTPS.
- Sign-in is verified with Google on every new session, and session cookies are signed and cannot be read by page scripts.
- The service refuses requests it cannot verify.
No online service is perfectly secure, so keep regular backups from Settings → Download full backup.
Keeping and deleting your data
Your records are kept until you remove them. You can download everything at any time (Settings → Download full backup) and empty your ledger (Settings → Reset this ledger). To have your account and all stored data deleted completely, email iashishux@gmail.com from the Google account you sign in with; deletion is completed within 30 days. You can also remove XPENS's access at myaccount.google.com/connections.
Children
XPENS is not intended for anyone under 18.
Changes
If this policy changes, the date above will change. Significant changes will be shown in the app.
Contact
Questions or requests: iashishux@gmail.com