Privacy & data

ExpenseGen is operated by Genact AI Studio Sdn Bhd, Malaysia. This policy explains what we hold, why, and how to get rid of it. Last updated 12 October 2026.

What we collect

Your account. Your email address, your display name, and your password — stored only as a PBKDF2-SHA256 hash with a per-account salt. We never store or see your actual password. If you sign in with Google we receive your email address and name from Google instead.

What you record. The expenses you enter: amount, currency, merchant, category, date, any note or tag, and which group or person it is split with — and, if you use them, income, budgets and recurring payments. Taken together this is a detailed picture of your spending, which is why the rest of this page exists.

Receipt photos, if you attach them. Your phone shrinks the image before it leaves the device, and we keep it in a private storage bucket — not on a public address. There is no link anyone can open: every view is checked against the same permission that guards the expense itself, so only people who can already see the expense can see its receipt. Deleting the receipt, the expense, or your account deletes the image itself, not merely the record of it.

Any way to be paid you save so friends can pay you back: a QR image from your bank or e-wallet, account details as text, or both. Either names you and points at your money, so we treat it as the most identifying thing you can put in ExpenseGen. Links are not accepted in it. It is shown to somebody only when two things are true at once: you are both in a group that is still live, and there is at least one expense in it that you are both split on. Somebody who merely knows your email address, or who was once in a group with you that has since gone, cannot see it. You can delete it at any time, and deleting it removes it everywhere.

Anything you send us through the contact form — your name, your email address and your message. It goes to our support inbox so a person can read and reply to it. Please do not put anything in there you would not want kept in an inbox; if you want it deleted afterwards, ask and we will.

Where you ask to be told things, and only if you ask. You can have group and bill notices sent to Telegram or WhatsApp, or as a push notification. For WhatsApp we keep the phone number you give us; for Telegram, the chat you linked by opening our bot; for push, the token your browser issues for that one device. None of the three is on unless you turn it on, each can be turned off from the same screen, and turning it off removes what we held for it. We do not use the number for anything else, and we do not read or keep what you write in those chats.

Technical data needed to run the service: a session token when you sign in, a count of recent sign-in attempts per email and IP address to stop password guessing, the same kind of count against your IP address when you use the contact form so it cannot be used to flood our inbox, and — only if you turn on bill reminders — the push subscription your browser issues. These counts hold a number and a timestamp, and they expire on their own.

What we do not collect

No bank or card connections. No location. No contacts or address book. The loan and savings calculators run on your device: what you type into them is not sent to us or saved. No advertising identifiers, and nothing that builds a profile of you to sell or to target you with. No AI is used to profile you or to decide anything about you; the only places a model is involved at all are the three AI features you choose to use, described below.

Measurement is worth being exact about, because the two halves differ.The signed-in app loads no analytics — nothing counts what you do inside it. This public website uses Google Analytics, which sets a cookie and can therefore recognise a second visit and tell us roughly where in the world it came from. It runs on the marketing and legal pages only, it is not connected to your account, and it is never told who you are: by the time you have signed in you are on a different site with no analytics on it.

How the app is paid for

By subscription, and by nothing else. ExpenseGen carries no advertising. It briefly had a single sponsored card on the Reports screen; that was removed in September 2026, along with the code and the table behind it. No ad network ever received your data, nothing was ever loaded from a third-party ad server, and there was no tracking pixel, cookie or device identifier involved — and now there is no such placement at all.

The free tier is a complete product and stays one: recording, groups, splitting, settling, reports and export are not behind a paywall, and there is no cap on how many expenses you may record. What the free tier does carry is a monthly allowance of AI credits, spent by the receipt scanner, the assistant and the product scanner, and a limit on how many receipt photographs are kept. The app shows what is left of the allowance.Gen Pass is an optional paid subscription that lifts both, and adds PDF statements and your year in review.

Information about other people

You can add people to a group by name before they have an account, so you can log a cash expense for a friend. When you do, you are giving us someone else's name. Please only add people who would expect to be in that group, and use a name they would recognise rather than anything more identifying than necessary.

If that person later joins, the entry becomes their own account and they see the shared history. A group owner can remove a member who has no expenses or settlements attached.

Money never passes through us

ExpenseGen does not process payments, hold funds, or act as a payment service. Settling up shows how the other person has said they can be paid — a QR, account details, or both — so you can pay them in your own banking or e-wallet app; both sides then confirm it happened. We record that you both said so. We are not a party to the transfer and we never see your banking credentials.

One thing is for sale — the Gen Pass subscription — and it is worth being precise about what that does and does not involve. We never see or store your card. Who takes the payment depends on where you buy:

In the iPhone or Android app, Apple or Google takes it. That is their requirement for anything bought inside an app, and it means the purchase happens in their sheet, under the account you already have with them. They tell us what was bought and until when; they do not tell us your card, and we do not ask.

On this website, Stripe takes it, on Stripe's own hosted page rather than ours, so your card details go from your browser to Stripe and never pass through ExpenseGen.

What we keep afterwards is the same either way, and it is the shape of the subscription rather than the payment: an identifier for the subscription at whichever of the three sold it, which plan you are on, whether it is active, when the paid period ends, and the amount and currency charged. That is what the app reads to decide whether your Gen Pass features are switched on. Because it is attached to your ExpenseGen account rather than to the device, a subscription bought in the app works on the website and the other way round.

Who else touches your data

We keep this list short on purpose. Today it is:

• • Amazon Web Services — where your data is kept: the servers the app runs on, the database holding your account, expenses and saved payment details, and the private storage bucket holding receipt photos. All of it is in AWS's Malaysia region, so your data is stored in-country. The three AI features are the exception, and it is a processing one rather than a storage one — see OpenRouter below.
• • jsDelivr, and a Cloudflare Pages site as its stand-in — where we read daily exchange rates, so an expense in another currency can be shown in yours. Our server asks for a currency and a date and gets back a table of rates. Nothing about you is sent: not your account, not the amount, not the expense — the request would look identical whoever made it, and it is made by our server rather than by your phone or browser.
• • Cloudflare — the network your connection passes through on its way to us. Cloudflare carries traffic; it does not store your account, your expenses or your photos.
• • Google — reCAPTCHA on sign-up and on the contact form (to stop automated abuse), Google Sign-In if you choose it, and Google Analytics on this website. reCAPTCHA sees your IP address and how you interacted with that page. Analytics sees the pages you read on this website, your approximate location from your IP address, and a cookie that recognises a repeat visit — it is not used on the signed-in app and is never joined to your account.
• • Resend — sends our email. It handles the address and name of anyone you invite to a group, whatever you write in the contact form, and password reset links. It delivers mail; it does not get your expenses. The logo in our emails is loaded from our own site, and we do not use it — or anything else — to tell whether you opened a message.
• • OpenRouter, and through it the model behindthe three AI features, and only those: Scan a receipt, the assistant, and Scan a product. Nothing is sent when you enter an expense by hand.
  What goes, per feature: the receipt scanner sends the photograph, to be turned into a list of items and prices. The assistant sends what you type to it and any photo you attach to that message, together with two facts from your profile if you have set them — how you describe your own spending, and your household size — because they change the advice. When you ask it about your own money, it can look the answer up, and what it looked up is sent with your question: totals, and the lines behind them — dates, merchant names, amounts, categories, the names of your groups, your budgets and recurring payments. If you ask who owes whom, that includes the names of the people in your groups and on your friends list and what each stands at. It is sent only what a question needs, at the moment you ask it, and never your whole history; notes on your expenses, receipt photos already stored, saved payment details and email addresses are not sent at all. It cannot change, delete or send anything: whatever it proposes opens a form for you to check and save yourself. Scan a product sends the photograph of the product.
  This is the one part of ExpenseGen that leaves Malaysia: OpenRouter and the model run abroad, so what you send to an AI feature is processed outside the country even though it is stored inside it. We send every one of those requests with OpenRouter's data-collection setting set to deny, which routes them only to model providers that keep nothing and train on nothing — a request will fail before it will go to a provider that would retain it. What OpenRouter itself keeps in passing the request on is governed by its own terms, which we do not control. If that is not a trade you want, type the expense in and leave the assistant alone: all three are optional and always will be.
• • An AI app you connect yourself, if you choose to. UnderMe → Connected AI you can let your own AI app — Claude, Codex and the like — read your ExpenseGen records. Nothing is connected unless you do it, and we send that app only what it asks for: the same totals and lines the assistant can look up, which includes the names of the people in your groups and on your friends list when it asks who owes whom. Whoever runs that app receives it undertheir terms; they are your choice, not a company we have an agreement with, and we cannot control or recall what they keep. The app cannot change, delete or send anything: what it proposes waits in ExpenseGen for you to open, check and save. We keep the connection's name, when it was last used and what the app called itself, and only a scrambled copy of its token, which we cannot read back. Disconnecting stops it at once, and changing your password or deleting your account disconnects every one.
• • Apple and Google — take the payment for Gen Pass if you subscribe inside the app, which is the only way to buy it there. The purchase happens under the Apple or Google account already on your phone, so they already know who you are; what they tell us is which plan you bought and when it renews or ends. They send the receipts and handle refunds, cancellations and a card that stops working, so those emails come from them. Both operate outside Malaysia. If you never subscribe in the app, neither is told anything about you by us.
• • Stripe — takes the payment for Gen Pass if you subscribeon this website. It receives your email address and what you bought, and it holds the card; we do not. Stripe also sends the receipts and the emails about a payment that failed or a card about to expire, so those come from them rather than from us. Stripe operates outside Malaysia. If you never subscribe here, Stripe is never told you exist.
• • Telegram and WhatsApp (Meta) — only if you link one to receive notices. The notice is delivered through them, so they handle its text: who added an expense or asked to be paid back, in which group, and the amount unless you have switched amounts off in notification settings. WhatsApp is given the phone number you entered, because that is how it finds you. Both operate outside Malaysia. If you never link either, neither is told anything.
• • Google's Firebase Cloud Messaging, and behind it your browser vendor's push service — only if you turn on push notifications in a browser. It is given the device token and the text of the notice, and nothing else about your account. The iPhone and Android apps do not send push notifications today.

We do not sell your data, and we do not share it for advertising. Some of these providers operate outside Malaysia, so your data may be processed abroad.

Keeping it, and getting rid of it

We keep your data while your account exists, because it is the record you came here for.

Export: Me → Export my data gives you everything as JSON, or your expenses as CSV. Free, always, with no cap. Your data is never held hostage.

Deletion: Me → Edit profile → Delete my account starts a 30-day window. You are signed out immediately and cannot sign in during it; signing in is what would cancel it, so nothing is destroyed by a mistap. After 30 days the account and its data are deleted.

One exception worth stating plainly: expenses inside a shared group are part of other people's records too. Deleting your account removes your account and your personal expenses, but a group's shared history remains for its other members.

Your rights

Under Malaysia's Personal Data Protection Act 2010 you may ask for access to your personal data, ask us to correct it, withdraw consent, or limit how it is processed. Access and correction are mostly built into the app — export, edit and delete are all in your hands without asking us. For anything else, write to [email protected].

Security, stated honestly

Passwords are hashed, never stored in readable form. Sessions use opaque tokens, and changing your password signs you out everywhere except the device you changed it on. Every request is authorised against your account, and a group's data is only readable by its members — private expenses are visible only to the person who paid.

Payment details (a QR image, account text) are stored in our database; receipt photos are stored in a private storage bucket that cannot be reached from the internet directly. Both are protected by those same access controls and encrypted at rest by our hosting provider. We do not add a separate layer of encryption on top, so please do not attach photos containing information you would not want stored — a receipt is fine, a document showing your full card number is not.

No system is perfectly secure, and we would rather tell you where the edges are than imply otherwise.

Children

ExpenseGen is not aimed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

Changes

If we change this policy we will update the date at the top, and we will tell you in the app before anything that materially changes how your data is used takes effect.

Contact

Questions, requests, or complaints: [email protected].
Genact AI Studio Sdn Bhd, Malaysia.