Privacy policy
What we collect, what we don’t do, and how disconnect vs delete works.
Updated 2026-10-16 · Draft for closed beta — not legal advice
Who we are
SPEND NZ is a household cashflow tool. It estimates how much you can safely spend until payday (the Daily Number) after reserving fixed bills and an optional save-this-paycheck amount.
This policy applies when you use the hosted app (account signup and bank connect).
Privacy officer
Kyle Jardine is the privacy officer for Spend NZ (Privacy Act 2020, s201).
Email privacy@spendnz.nz.
What we collect
Account: email, password hash (we never store your password in plain text), optional display name and household name, session cookies.
Bank data (when you connect via Akahu): account names, types and balances, transaction descriptions, amounts, dates, and any merchant or category labels Akahu provides. We do not ask for your bank login — Akahu handles bank authentication.
Product data you create: categories, tags, save targets, bill confirmations or suppressions, pay-period settings, and similar preferences.
Billing (when you subscribe): Stripe customer and subscription identifiers and entitlement status. We never receive your card number.
Technical: server logs. Ordinary lines keep the time, the path, and error messages. An account-activity line (sign-in, sign-out, partner, bank connect or disconnect, delete) also keeps the user id, household id and IP address. We do not log full account numbers or access tokens.
Account activity record: the time you sign up, sign in, sign out, get locked out, enter a wrong invite code, add, remove or leave a partner, connect or disconnect your bank, or delete your account, plus your account when we know it, the IP address, and your browser’s user-agent text (the first 200 characters). A wrong password stores a hashed (scrambled one way) version of the email, not the email. We never store the password. We keep this so we can see if someone else is trying to get in.
Days you opened the app: the New Zealand date, once per person per day you used the app while signed in. That daily-open record has no page, no time of day, and no device. We also store a last-seen time on your account and on the sign-in session, updated about once an hour. We use the dates to count how many people opened the app. The operator page shows those counts only.
Guessing counters: wrong passwords for an account, stored as a hashed (scrambled one way) email, and wrong invite codes for an IP address, stored as a hashed (scrambled one way) IP address. A hashed email or IP address can be checked against a known one, so neither is anonymous. A correct sign-in clears the password counter. A separate count of a small number of tries per IP address stays in the server memory for about 15 minutes and is not saved.
Akahu and open banking
Bank connectivity is provided by Akahu (akahu.nz). When you authorise the connection, Akahu issues a user access token that we store encrypted for your household so we can refresh balances and transactions.
Access is read-only. We never receive your bank password, initiate payments, or move money.
You can disconnect in Setup. We revoke the Akahu token before we drop it. If revoke fails, nothing is deleted, so you can try again. When the link is cut — in Setup, or by revoking Spend NZ at my.akahu.nz — we delete the imported accounts, transactions, bills, balances, and Daily Number history. Your login, categories, tags, and pay clock stay. Delete account still removes the login as well.
How we use data
To run the product: Daily Number, bills detection, categorisation, spend views, and sync.
To secure the service: sessions, abuse prevention, and fixing outages.
To bill you (when enabled): validate subscriptions and restore access.
To support you: respond to email requests about your account.
We do not sell your transaction data. We do not use bank data for ads.
What we don’t do
We do not sell personal information.
We do not use advertising networks or track you across other companies’ apps and websites.
We do not send your bank data, balances, or transaction rows to AI / LLM providers. There is no AI Coach in this product.
We do not access contacts, precise location, photos, microphone, health data, or advertising identifiers.
We do not move, hold, or lend money. We are not a bank, adviser, or lender.
Service providers and storage
Akahu — consent-based, read-only access to New Zealand bank data. We never receive your bank login credentials.
Hosting and database — Railway, in the United States (US West). Your account and bank data are stored there, outside New Zealand. United States law may not protect that information in the same way the New Zealand Privacy Act does.
Bank access tokens are encrypted, and the database is not reachable from the public internet. Data is scoped by household. Local development may use Docker Postgres on your machine.
Stripe — subscription billing when you choose a paid plan. Stripe handles card details; we store only customer/subscription identifiers and status.
Akahu and Stripe may also process limited data outside New Zealand, under their own terms.
Retention, disconnect, and deletion
We keep your data while your account is active so the product works across pay periods.
Disconnect bank (Setup), or revoking Spend NZ at my.akahu.nz: we delete the imported accounts, transactions, bills, balances, and Daily Number history. Your login stays, and so do categories, tags, and the pay clock. If our revoke call fails, nothing is deleted, so you can try again. A revoke that Akahu has already confirmed still deletes the imported data.
Delete account (Setup → Delete account): irreversible, and only the owner can do it. We revoke Akahu first. If revoke fails, we stop and leave the household in place unless you choose “delete anyway” (then revoke the link yourself at my.akahu.nz). On success we delete the household from the live database: accounts, transactions, bills, categories, tags, settings, secrets, the owner login, and any partner login. We also ask Stripe to delete the customer when one exists. Stripe may keep invoices. A partner can delete only their own login (Setup → Leave household). That does not remove the owner’s household.
The live database drops that data when delete finishes. The database host (Railway) keeps point-in-time backups. A deleted household can remain in those backups until the host backup window rolls off. That window is the host setting. This policy does not invent a day count. Server logs can keep a time, a path, and an error line. An account-activity line (sign-in, sign-out, partner, bank connect or disconnect, delete) also keeps the user id, household id and IP address. We do not log full account numbers or access tokens. This policy does not state how long the host keeps those logs.
Account activity records, including the IP address, are deleted after 365 days by a manual cleanup we run about monthly. Each sign-in lasts 30 days. After you log out, or after those 30 days, we keep that sign-in row (who, and when) for another 90 days, then that same cleanup deletes it. That row does not hold the IP address. Idle guessing counters are deleted after 30 days by that cleanup. The dates you opened the app stay while the account exists, and are deleted with the account. The last-seen time stays on the account while the account exists, and on the sign-in row until that row is deleted. Disconnecting your bank does not delete these records. Delete account removes the account activity records linked to your household. Records not linked to a household stay until their 365 days are up: failed or locked sign-ins, wrong invite codes, and one line recording that an account was deleted (time, IP address, browser, and the ids of the deleted account and household). If a partner deletes their own login, their sessions, last-seen time and daily-open dates are deleted straight away. Their earlier activity lines stay for the same period.
You can also email privacy@spendnz.nz with “Privacy request — delete” from your account email if you cannot use the in-app path.
Your rights (NZ Privacy Act)
You can ask for a copy of your information, ask for it to be corrected, or ask for it to be deleted. We reply within 20 working days.
You can complain to the Office of the Privacy Commissioner (privacy.org.nz) if you’re unhappy with our answer.
Email privacy@spendnz.nz. We may need to verify you control the account.
Security
We use HTTPS, hashed passwords, encrypted Akahu tokens at rest, per-household database scoping, and session cookies that are not readable by JavaScript.
If we ever send optional notifications, lock-screen text will avoid merchant names and exact dollar amounts.
No online system is risk-free. Use a unique password and tell us promptly if you suspect unauthorised access.
Breaches
If a breach is likely to cause serious harm, we tell the Privacy Commissioner and the people affected as soon as practicable.
If it involves bank data from Akahu, we also tell Akahu at security@akahu.nz as soon as practicable. Unauthorised use of our Akahu access is told to that same address straight away.
Not financial advice
SPEND NZ is an information tool. Nothing in the app is financial, tax, or investment advice. The Daily Number is a model — it can be wrong if bills, categories, balances, or pay dates are incomplete or misclassified. Savings figures are planning amounts, never a promise or a transfer.
Changes
We may update this policy. The “Updated” date at the top of the page will change. Material changes for active users will be called out in-app or by email when practical.