Privacy
This Privacy Policy explains how SpentNest handles information that is collected, stored, or processed while you use the application. SpentNest is a personal finance tracking application used to manage spending, budgets, income, savings, dues, and related financial activities. We aim to be transparent about the types of information we process and the ways it may be used.
The application may process information you directly provide when you sign up or use the service, including:
User accounts are created with a name, email, and password. The frontend stores a session token in browser local storage to keep the user signed in across browser sessions. The backend uses authentication mechanisms for protected routes and API calls, including JWT-based authentication as described in this project’s documentation. This means account authentication depends on credentials and tokens that are stored and transmitted as part of normal login and session behavior.
SpentNest stores and processes personal financial data needed for budgeting and tracking, such as:
This information is used to display summaries, charts, and recommendations in the app. Because the product is a personal finance tracker, this data is inherently sensitive and should be treated as such.
The AI features of SpentNest may send user-related financial information to backend endpoints for analysis, predictions, budget recommendations, and challenge generation. The frontend calls backend AI APIs for endpoints such as expense prediction, recommendations, auto-budget suggestions, and savings challenges. These requests may include user-specific data that has been stored in the system or derived from the user’s financial records.
The exact data sent to the AI provider depends on the backend implementation and the service it uses. You should assume that AI processing may involve the information the user has submitted for analysis, and that generated responses may be based on that information.
SpentNest uses user information to provide the following core functions:
According to the project documentation and implementation, the application stores data in a backend database with MongoDB and uses Express.js-based APIs. User authentication and finance records are persisted for use in the application. Some data may also be cached or temporarily stored in browser local storage for session persistence and user experience.
The application does not provide a clear public self-service deletion workflow in the frontend, and the project does not appear to include a verified bulk deletion mechanism for all personal data. If a user needs account or data deletion, they should contact the developer through the public website information provided in this policy.
SpentNest relies on backend services and may use third-party infrastructure for hosting, database access, authentication, and AI processing. These technologies may involve transmission of account data and user financial information to external providers in order to perform the service features. We do not control how those providers handle data outside our application, and their own terms and privacy practices will apply to that processing.
The AI features in this application are powered through backend endpoints connected to external AI services. When prompts or user financial data are sent to an AI provider, relevant information may be processed by that provider under its own data handling, retention, and security policies. The product itself does not provide a guarantee that user data is never processed by external providers, nor does it guarantee a specific retention period. The user should review the provider’s disclosures if they are concerned about AI data handling.
This application uses browser local storage to keep a session token and user identifiers available to the frontend, including values such as the login token and user ID. This is used to keep the user signed in and to identify the logged-in account for API requests. The application may also rely on browser storage to preserve state or temporary UI data. It does not appear to use a separate cookie-based session management system in the current frontend implementation, but browser storage still persists data locally on the device.
Users should treat local browser storage as an accessible medium on the device and protect their device and browser environment accordingly. Clearing browser data may impact login persistence and stored application state.
SpentNest may share or disclose personal data when necessary to provide the service, maintain security, comply with legal obligations, or respond to valid requests from authorities. We may also share data with service providers that support hosting, storage, authentication, or AI processing. We do not claim that data is never shared; it depends on the actual services and integrations in use.
Data retention periods depend on the system configuration, database behavior, and service provider policies. The app stores user financial and account data to support tracking and account functionality. The frontend does not obviously provide a complete public self-service deletion feature for all records, so account and data deletion requests should be handled directly with the developer or operator where available.
Reasonable security measures are used to protect user data, including encrypted communication where the deployment and service providers support it, password hashing in backend processes, and secure API access patterns. However, no online service can guarantee absolute security. Users should use strong passwords, protect devices, and remain aware that any stored data may be exposed to risk if credentials or devices are compromised.
Depending on the applicable jurisdiction and the service configuration, users may have rights relating to access, correction, restriction, and deletion of personal information. If you would like to enquire about your account data, review your records, or request assistance regarding privacy, please use the contact details in this policy.
The service is intended for general personal finance management and is not specifically designed for children. If a child under the relevant age threshold uses the service, appropriate parental or guardian supervision should be in place. We do not knowingly market the service to children as a primary audience.
SpentNest may include links to external websites such as the Stavan Labs website. These external links are provided for your convenience and are not under our control. We are not responsible for the privacy or security practices of external websites.
This Privacy Policy may be updated from time to time to reflect changes in the service, applicable laws, or operational requirements. Continued use of SpentNest after an update means you accept the updated policy.
Application: SpentNest
Developer / Brand: Stavan Labs
Website: https://stavanlabs.is-a.dev
If you have questions about SpentNest, this Privacy Policy, or related terms, please contact the developer through the Stavan Labs website above.
These privacy practices are effective as of October 15, 2026 and were last updated on October 15, 2026.