Privacy

This page describes exactly what Expense Agent does with your data during the trial. If anything changes, this page is updated first.

What we store

Each expense: amount, date, category, place, note, and the exact text you typed.
The edit and delete history of each expense (so you can undo).
Categories and rules you create.
If you use Kakeibo: the income and savings goal you enter for each month, and your reflection answers.
If you send a photo of a receipt or a bank transfer: the text Claude copies from the photo (which may include the recipient's name, the transfer memo, and part of an account number). Expense Agent never receives the photo itself.
If you import Shopee orders (from a file or with the Expense Agent — Shopping order import extension): order ID, payment date, total, shop name, item names, order status and payment method (e.g. "Credit card" — no card number). The recipient's name, phone number, address and tracking number never leave your device. The extension only reads your orders on your device, when you click it; the Expense Agent server never signs in to Shopee on your behalf. If you use the extension, Expense Agent also keeps your import code in hashed form (it can't be reversed) and when it was last used.
If you let Claude read receipt emails (through Claude's Gmail connector, which you turn on yourself): Expense Agent has no access to your Gmail. Claude only copies the sender, subject, date and the part with amounts. Expense Agent keeps the sender's domain, subject, amount, date, place, order ID and lines with amounts — dropping names, phone numbers and addresses, and keeping only the last 4 digits of a card; the rest of the email is not kept.
If you use a shared ledger: each person's display name, the relationship the owner picked when inviting (spouse, housekeeper, other), each person's access, who added and who paid each expense, and when you agreed to join. If you use a group ledger, it also stores: the ledger name, start and end dates of the trip, each person's share of each expense, payments marked as made, and who marked them.
If your household has a child ledger, it also stores: the child's name, the expenses they log, the money they receive, the QR code and PIN in hashed form (no one can read back the original codes), and when the ledger was last opened.
No email addresses or passwords are stored. Sign-in (in Claude or on the web, with Google or a code sent to your email) is handled by WorkOS; Expense Agent only keeps an ID issued by WorkOS, plus your first name (no last name) if your Google account has one, when you create your ledger on the web. The Account page asks WorkOS for your sign-in email each time you open it, just to show it to you; Expense Agent doesn't store it. You can change your name on the Account page.
When you sign in on the web, Expense Agent counts attempts per hashed IP address (it can't be reversed) to block code guessing, and deletes the count after one day.
When you create a ledger on the web, Expense Agent counts new accounts per hashed IP address to block mass sign-ups, and deletes the count after one day.
Server logs never record a child's name, PIN or QR code.

Chrome extension

The Expense Agent — Shopping order import extension only runs when you click its icon on shopee.vn. It doesn't run in the background and doesn't work on any other website.
The extension reads your own orders on shopee.vn using the session you're already signed in to on your device. It doesn't know your Shopee password.
When you click Sync, the extension sends to Expense Agent — and only to Expense Agent — the order ID, order date and payment date, order status, total, shop name, payment method, and item names and quantities. The recipient's name, phone number, address and tracking number are never read and never leave your device.
When you click Download file, the file contains only the columns above and stays on your device until you import it yourself.
The extension keeps on your device: your import code, the date of the latest order sent, the last sync, the date range you picked, the last download date and your "paid by" choice. Removing the extension deletes all of it.
The Chrome Web Store version doesn't have the "Full export" feature (a file with recipient details) from the old test version.
The extension sends nothing to third parties, doesn't sell data, and has no ads or trackers.

Where it's stored

Neon (database hosting): a Postgres database, with servers in Singapore.
Vercel (app hosting): servers in Singapore.
WorkOS (sign-in service): you sign in with your Google account or a code sent to your email.

Who can see it

You, through the web ledger and through Claude if you connect it. Browser sign-ins are remembered for 30 days; links Claude gives you work for 24 hours.
The extension's import code can only add Shopee orders to your ledger; it can't view the ledger. Getting a new code, or turning the code off on the ledger page, stops the old code from working.
Each account sees only its own ledger, unless you join a shared ledger with an invite code and agree. In a shared ledger, the owner picks each person's access: "Sees the whole ledger" sees every expense, including the ones you add; "Sees only their own expenses" sees only the expenses that person added or paid. The owner can change access at any time, and the person affected will see a notice. If you leave a shared ledger, you can no longer see it; expenses you added stay in the shared ledger.
Group ledgers (trips): everyone in a group ledger sees every expense in it, who paid and each person's share. The creator gets a balance link: anyone with the link can see the ledger name, each person's name, the expenses (name, amount, date, who paid), the balances and who owes whom, but not the original text or notes. The link expires 30 days after the ledger is closed, or as soon as the creator deletes the ledger. Group ledger expenses don't go into anyone's home ledger; when the ledger is closed, only your share goes to the review inbox in your home ledger.
Child ledgers: parents who are Managers can see every expense a child logs, the money they receive and every edit. People in the home ledger whose access leaves out the children's ledgers, or who see only their own expenses, can't see the children's ledgers. Children see only their own ledger.
The operator of Expense Agent (Mangala Labs) has access to the database, and only looks at your data to fix a problem you report or when you ask for deletion. Data is not yet encrypted separately for each person.
What Expense Agent replies appears in your chat with Claude, so it's also covered by the data policy of Anthropic (the company that makes Claude).
There are currently no ads and no third-party trackers on these pages, and data isn't shared with anyone other than the operating services listed above.

Deleting your data

Delete an expense: tap Undo right after logging it (on the web or on the card in Claude), or tell Claude "delete the last one". It disappears from the ledger and all totals, but stays in the database so you can undo.
Remove the connector in Claude: Claude stops accessing your ledger, but your data is not deleted. Deleting your account doesn't remove the connector; if you stop using Expense Agent, remove the connector in Claude.
Sign out on the web: only ends the sign-in on that browser; your data stays intact.
Delete your account: do it yourself on the Account page (tap the circle in the top-right corner of your ledger). Your data is deleted permanently, right away, and can't be recovered. Your WorkOS sign-in account (email) isn't deleted; signing in again or messaging Claude afterwards starts a new, empty ledger. Can't get into your ledger, or want your WorkOS sign-in account deleted too? Email truongnguyenptit@gmail.com from the address you sign in with; it's deleted within 30 days and you'll get a confirmation email.
If you're in a shared ledger: expenses you add to a shared ledger belong to that ledger. When you delete your account, your own ledger is deleted permanently, and your name on expenses in the shared ledger is replaced with "Former member". An owner who still has other people in the ledger needs to remove them first.
Deleting your account after creating a group ledger: the ledger passes to the person who joined earliest; if no one is left, the ledger is closed.
Parents can revoke a child's code at any time; deleting a child ledger permanently deletes every expense the child logged. Deleting the account of the only Manager also deletes the children's ledgers.
Download your data: not available yet.