Privacy, explained plainly.

Who operates ExpenseTravel?

This notice covers expensetravel.com, the ExpenseTravel web app and information provided through its account and support functions.

Information used by the app

Account details

Account creation asks for your name, email address and password. Supabase provides account authentication. The app also uses account identifiers and session information to recognise your sign-in.

Trip and expense records

Information you enter can include trip names and dates, budgets, home and travel currencies, exchange rates, expense amounts, categories, payment-method labels and notes. Preferences can include language, appearance and default settings.

A payment label such as Cash or Credit describes how you paid. ExpenseTravel uses manual expense entry and does not require you to connect a bank account. Do not enter full card numbers, banking passwords, passport details or other sensitive identifiers in notes.

Shared trips

If you join or share a trip, its owner and joined members can see the trip records, your display name and who added each expense. Members can edit trip details and add, edit or delete expenses. The owner manages invitations and membership. Leaving or removal stops further access but does not remove your existing entries from the group record or copies already exported by other members.

Technical information

Hosting, authentication and other service providers can receive information needed to deliver their services, such as IP addresses, request times and browser or device details. Their logging and retention arrangements are still being confirmed for the final policy.

What the information is used for

The app uses account and trip information to let you sign in, save and sync records, calculate budgets and currency totals, show spending summaries, apply preferences and download exports. Account confirmation also uses your email address.

Additional support, marketing or analytics uses will be described when their processes and providers are confirmed. This draft does not promise a support response time or a marketing-email schedule.

Cloud data and browser storage

Supabase provides authentication and cloud data storage. The app also keeps local browser information, including preferences, sign-in state and local copies of trip data. A service worker can cache web-app files on your device. Shared trips are excluded from the app’s persistent trip cache. A pending invite is kept in browser storage until it is used, dismissed or expires. Invite links can be reused by a group until they expire or the owner stops them.

Clearing browser site data can remove local app information and sign you out. It does not by itself delete your cloud account. Export available information and confirm syncing before removing site data.

CSV and JSON files you download remain wherever you save them. They can contain private travel and spending information, so keep those copies secure.

Service providers and external requests

• Netlify: hosts and delivers the website.
• Supabase: provides account authentication and cloud records.
• Frankfurter: provides exchange-rate data. The reviewed app requests currency pairs rather than your name, email, trip name or purchase amount. Direct requests can still reveal connection details such as an IP address.
• Google Fonts: delivers the website’s fonts.
• jsDelivr: delivers the authentication software library used by the app.

Font and software-library requests can expose connection information to those providers. The account email-delivery provider, processing locations and applicable retention arrangements will be added once confirmed.

Information may be handled outside your country where providers operate. The confirmed database region and relevant international processing locations are still pending. This draft does not claim that all information stays in Australia.

Google services

Google Analytics

We use Google Analytics to understand how people use the website. The Google tag runs when pages load. Default reporting can include page views, users, sessions, approximate location and browser or device information. Analytics uses first-party cookies to distinguish browsers and sessions. The tag does not include custom events containing your trip names, expense notes or purchase records. Additional collection may depend on the settings enabled in our Google Analytics account. Our analytics retention settings and applicable consent arrangements still need to be confirmed for the final policy. See Google’s explanation of Analytics data collection and Google’s Privacy Policy.

Google Search Console

We use Google Search Console to monitor how the website appears in Google Search, including indexing and search performance. Search Console is separate from Google Analytics. Connecting it does not add a separate website analytics tag.

Retention, access and deletion

You can view and edit your trip and expense records in the app. The Data & backup settings provide CSV and JSON downloads. A download is a copy of your data, not a request to delete it.

Retention periods for cloud records, logs, backups and future support messages are being confirmed. Account-deletion procedures and the contact channel for access or correction requests will be published when ready.

Deleting an expense or trip is different from deleting an account. Removing site data from a device also does not delete the cloud account. Until the request process is confirmed, this draft does not state that an account-deletion button or response deadline is available.

Protecting your information

The app uses account sign-in and service access controls. No online service can guarantee complete security. Keep your password private, use care on shared devices and avoid sending unnecessary personal details when reporting a problem.

The final policy will confirm applicable security practices and the process for reporting concerns.

Updates to this notice

We will revise this notice as operator details, support processes and information-handling practices are confirmed. The final policy will also explain applicable privacy rights, complaint options and any audience or age restrictions.

Draft last updated: 16 October 2026.