Privacy Policy

Effective date: September 23, 2026

This Privacy Policy explains what information the TaskSpend mobile app and website (the "Service") collect, why we collect it, and what control you have over it. TaskSpend is operated by Boyach LLC ("TaskSpend", "we", "us").

1. Information you give us

• Account details, your email address and name. You sign in with Sign in with Apple or Sign in with Google, these are the only sign-in methods, and we receive your name and email address from the provider you choose. If you use Apple's "Hide My Email", we only ever see the private relay address.
• Profile information, an optional profile photo, display name, and phone number.
• Workspace content, the organizations, projects, budgets, budget categories, expenses, notes, approval decisions, and pre-approval messages you create.
• Receipts and documents, images and files you capture or upload, and the details read from them (merchant, date, amount, tax, and similar fields).
• Bank connections, if you choose to connect a bank or card account (a Premium feature), we receive transaction details (date, merchant, amount, and a suggested category) and account names with the last digits of the account number from our bank-connection provider, Plaid. We never receive your bank username or password.
• Invitations, email addresses you enter to invite teammates, used solely to deliver that invitation. If you share a team join code instead, we store only a protected fingerprint of the code that lets us verify it, never the code itself.

2. Information collected automatically

• Service logs, request timestamps, the route called, response status, and a pseudonymous account identifier, kept to operate and secure the Service. We do not log request contents, passwords, or authentication tokens.
• Subscription status, whether your workspace has an active Premium subscription, confirmed with Apple. We never receive your payment card details; all purchases are handled by Apple.
• Web sign-ins, when you use the web workspace we record the time of each sign-in and the browser and operating system it came from (the user-agent string), so we can see how the web and the app are used and spot unfamiliar sign-ins. These records are kept for 90 days and deleted with your account.

3. What we do not collect

• No advertising or tracking in the app. The TaskSpend app contains no advertising SDKs, no analytics or attribution SDKs, and no cross-app or cross-site tracking of any kind. Nothing you do inside the app is profiled, sold, or shared with advertisers.
• No tracking cookies on this website. taskspend.com may measure aggregate visits, which pages are read and where visitors arrived from, using a privacy-preserving setup that stores nothing on your device and never identifies you. We do not use advertising cookies, we do not build profiles, and we do not follow you to other sites.
• No passwords. A TaskSpend account has no password at all, sign-in happens through your Apple ID or Google Account, and TaskSpend never sees the credentials you use with them. The same is true if you connect a bank account: you sign in on Plaid’s screens, and your bank login never reaches TaskSpend.
• No biometric data. If you enable Face ID or Touch ID to lock the app, the check happens entirely on your device. Your biometric data never leaves your device and is never available to TaskSpend. We do not collect biometric identifiers. Profile photos are stored as ordinary images; we never analyze faces or create face templates.
• No contacts. We never read your device's address book. Teammate invitations use only the email addresses you type yourself.

4. How your information is used

• To provide the Service, showing your projects, budgets, expenses, receipts, and approvals to the people in your organization who are permitted to see them.
• To send transactional email, welcome messages, teammate invitations, and confirmation codes for destructive actions such as deleting a project or account.
• To send product and feature announcement email, which always includes an unsubscribe link. Transactional emails, invitations, security codes, and approval notices, are sent regardless of that preference because the Service needs them to function.
• To read receipt details, so expense entry can be pre-filled (see section 5).
• To keep the Service secure and reliable, and to enforce plan limits and permissions.

We do not use your workspace content for advertising, and we do not use it to train machine-learning models.

5. Receipt scanning and AI assistance

• On-device first. Receipt text recognition runs on your device, the image itself is not sent anywhere for this step. On supported devices, the suggestions themselves (merchant, amount, date, category) can also be produced entirely on your device, so a scan can complete without anything leaving your phone.
• Premium AI assistance is opt-in. If your workspace is on a Premium plan, TaskSpend can additionally send the recognized text only, never the receipt image or PDF, to a third-party AI provider under contract to help structure the details. This happens only with your permission: the app asks before the first time, it stays off until you agree, and you can turn it off at any time in your account settings. Scanning keeps working on-device without it. Text that is sent is used solely to return a result to you, is not used to train any model, and passes through automated filters that redact sensitive values (for example, reducing a card number to its last four digits) first.
• Always review. Automatically extracted details are suggestions and may be incomplete or wrong. Please check them before submitting an expense.

6. Who your information is shared with

We do not sell your personal information, and we do not share it for advertising. We do not sell or share personal information, and we do not use it for targeted advertising. Information is shared only in these cases:

• Your organization. Content you add to an organization is visible to its other members according to their roles. Workspace owners and admins can see the organization's projects, expenses, and members.
• Service providers. We use a small number of vetted third-party providers, under contract, to run the Service. This includes Amazon Web Services (hosting, storage, email delivery, and the optional AI receipt analysis via Amazon Bedrock), located in the United States. When Premium AI receipt analysis is turned on, only the recognized receipt text is sent for that analysis, never the receipt image, and only after you turn the feature on in your account settings; the provider does not use that text to train its models (Amazon Bedrock does not train on customer content). Apple processes sign-in and all subscription payments; Google processes sign-in if you choose it.
• Accounting integrations you turn on. If a workspace owner connects QuickBooks Online or Xero, approved expense data from the chosen project is sent to that provider at your direction. These integrations are optional, off by default, and per project. The provider's own privacy policy then applies to the data they receive.
• Bank connections you turn on. If a workspace owner connects a bank or card account, they sign in on Plaid’s own screens; Plaid retrieves the transactions and shares them with us. TaskSpend never sees your bank login. Connections are optional, off by default, and can be removed in the app at any time, which also ends our access at Plaid. Plaid’s own privacy policy applies to the information it processes.
• Legal reasons. If required by law, or to protect the rights, safety, or property of our users or of Boyach LLC.

If TaskSpend is ever involved in a merger, acquisition, or sale of assets, we will notify you before your information becomes subject to a different privacy policy.

7. How your information is protected

• All traffic between the app and our servers is encrypted with HTTPS/TLS.
• Your information is also encrypted at rest: the databases and file storage that hold your account data, workspace content, and receipts encrypt everything they store.
• Receipt images and profile photos are held in private storage that is never publicly readable. The app reaches them only through short-lived, single-purpose links that expire within minutes.
• Sign-in tokens are stored in the iOS Keychain on your device, restricted to that device. In the web workspace they are kept in your browser’s local storage for that site only, and signing out removes them.
• Access to organization data is checked on our servers for every request, so a member can only reach what their role permits.
• Deleting a project or your account requires a confirmation code sent to your verified email address.

No online service can promise perfect security, but we design to limit what an incident could expose.

8. How long information is kept

• Account and workspace data is kept while your account is active.
• When you delete your account, your profile and sign-in are removed, and organizations you own are deleted along with their projects, expenses, receipts, and approvals. In organizations where you were only a member, your membership is removed; expenses, receipts and approvals you submitted remain part of that organization's records, together with the name and email address recorded on them at the time, because they belong to the organization's financial history and an expense record has to show who submitted it.
• Operational logs are retained for a limited period (currently up to 90 days) and then deleted automatically.

9. Your choices and rights

• Access and correction, view and edit your profile and workspace content at any time in the app.
• Export, generate and export reports of your project spending as PDF or CSV from the Report Center.
• Deletion, delete your account from Profile → Delete Account inside the app. No email to support is required. See how account deletion works.
• AI assistance, the Premium option to send recognized receipt text for AI suggestions is off until you allow it, and can be turned off again at any time in your account settings (see section 5).
• Permissions, camera and notification access can each be changed at any time in the iOS Settings app. The app never reads your photo library. It asks for permission only to save a receipt image to your library when you choose Save Image; picking a photo to attach uses Apple's own picker, which shares with us only the photos you select.

Depending on where you live, you may have additional rights, such as requesting a copy of your data or objecting to certain processing. Contact us at support@taskspend.com and we will respond.

10. Consumer health data

Receipts you upload may incidentally contain health-related information, for example a pharmacy receipt. TaskSpend uses that information only to provide the service you asked for, recording and categorizing your expense, and does not use it to infer anything about your health. We never sell or share it. You can delete it at any time by deleting the expense or your account.

This section also serves as the consumer health data notice for residents of Washington and Nevada.

11. Users in the European Economic Area, United Kingdom, and Switzerland

Boyach LLC is the controller of your account data, and a processor for data a workspace owner's organization asks us to process about its members.

Lawful bases. We process your information based on performance of a contract (providing the Service you signed up for), your consent (optional AI receipt analysis, product emails), and our legitimate interests (security, fraud prevention, and abuse limits).

Your rights. You have the right to access, rectify, erase, restrict, and port your data, to object to certain processing, to withdraw consent at any time, and to lodge a complaint with a supervisory authority. To exercise any of these rights, contact support@taskspend.com; we respond within one month.

International transfers. Your information is processed in the United States. Transfers rely on the standard contractual clauses in our providers' agreements, including the AWS Data Processing Addendum.

Retention. See section 8.

Automated processing. The AI suggestions described in section 5 are never final. A person always confirms amounts and approvals.

12. International users

TaskSpend is operated from the United States, and your information is stored and processed there. If you use the Service from elsewhere, you understand that your information is transferred to and processed in the United States.

13. California residents

We do not sell or share personal information. The categories of personal information we collect are listed in sections 1 and 2. California residents have the right to know what personal information we collect, to delete it, to correct it, and to be free from discrimination for exercising these rights.

To exercise these rights, contact support@taskspend.com, or delete your account directly in the app (see section 9). We do not respond differently to browser "Do Not Track" signals, because we do not track you across other sites or services.

14. Changes to this policy

If we make a material change to this policy, we will update the effective date above and, where appropriate, notify you in the app or by email. Continuing to use the Service after a change means you accept the updated policy.

15. Contact

Questions about privacy, or a request about your data: support@taskspend.com
TaskSpend, part of Boyach LLC
Postal address: Boyach LLC, Broward County, FL