Privacy Policy (Beta)

This is the beta Privacy Policy. It covers the Sprigly open beta, which has no account and no subscription. For the full release of Sprigly, see the main Privacy Policy.

This Privacy Policy explains how the Sprigly open beta (“the app”, “we”, “us”) handles your information. In short: the beta app requires no account, collects no personal data, and keeps your budgeting data on your own device. Our website and the launch waitlist do process a small amount of data, described in sections 12 and 13.

1. Who is responsible (Data Controller)

For the purposes of the EU General Data Protection Regulation (GDPR):

Name: Konstantin Siegel
Address: Simeonistraße 8, 80637 Munich, Germany
Email: support@spriglyapp.com

2. Summary

The beta app needs no account and no sign-in. There is nothing to register for, and no password or email address to give us.
The beta app is free of charge and contains no subscription and no purchases.
Your budget lives on your phone and is never sent to us — your transactions, accounts, and envelopes stay in the app’s own storage. Section 3 has the detail, including what Android’s own backup does.
The app works with no network connection and makes no requests to us or to anyone else.
The app uses no analytics, advertising, tracking, or crash-reporting tools (see section 6).
If you email us a bug report, we then hold what you sent us. That is the one way using the app can result in us holding your data, and it is entirely your choice (see section 5).
You can erase everything at any time in Settings → Danger zone → Erase all data (see section 9).
Our marketing website and the optional launch waitlist do process data — see sections 12 and 13.

3. Where your budgeting data lives

When you use Sprigly, you create and store data such as transactions, amounts, dates, notes, budget envelopes, categories, accounts, transfers, a display name you choose, and app settings.

This budgeting data is stored on your device, in the app’s local database. We never receive it: the app never sends it to us or to any third party. We have no access to it and cannot read it. Uninstalling the app or clearing its data deletes this information from your device. One thing outside the app can copy it off the phone, and it is your own Android backup — see the next paragraph.

If you have Android’s built-in backup switched on, Android may include Sprigly’s data in your own device backup to your own Google Drive, the same way it does for other apps. That backup belongs to you and to Google — we have no access to it. You can turn it off in your Android settings under Google → Backup.

4. The app collects no personal data

The beta app does not collect, transmit, or store any personal data about you. There is no account, no sign-in, no subscription, no device identifier, no advertising ID, and no usage or telemetry data. Nothing about how you use the app is reported back to us.

Because the app collects nothing, no third-party service processes personal data on our behalf for it. Google Play distributes the app and acts as an independent controller for the data it collects as a store, under its own terms — see policies.google.com/privacy. It is not a payment processor for Sprigly, because the beta has nothing to buy.

5. Support and bug reports

Sprigly has a “Report a bug” screen in Settings. It prepares a message and opens your own email app so you can send it to support@spriglyapp.com. Sprigly does not send anything itself — you review the text, can edit it, and send it from your own email account.

A bug report contains: your app version, Android version, device model, screen size, language, selected currency, and counts of your data (for example “340 transactions”) — never the transactions themselves, their amounts, or your category names.

If you choose to include them, it also contains recent error messages recorded on your device. Error messages quote whatever the app was handling when the problem occurred, so they can occasionally contain text from your own data. Sprigly shows you the exact text before you send it, and you can edit or remove anything you do not want to share.

When you email us we receive your email address and whatever you wrote. We use it only to answer you and to fix the problem. Legal basis: our legitimate interest in supporting and improving the app (Art. 6(1)(f) GDPR). We keep support emails for as long as needed to resolve the issue and for up to 12 months afterwards, then delete them.

Two providers handle that email for us: ImprovMX Incorporated (United States), which forwards mail sent to our addresses, and Google, which stores it in the mailbox we read it in (Gmail). Both are outside the EEA, so your message is processed in the United States — see section 11.

You can reach us at support@spriglyapp.com for any privacy request — access, correction, deletion, portability, or objection.

6. No analytics, no crash reporting

Sprigly contains no analytics, no advertising, no tracking, and no crash-reporting service. When the app hits an error it records it on your device only, in a log holding the 50 most recent entries. You can read that log in Settings → Error log, and clear it at any time. It is deleted when you use “Erase all data”, it is never included in a data export, and it is never sent anywhere automatically — the only way it leaves your device is if you choose to attach it to a bug report and send that yourself (section 5).

The Sprigly app does not:

Require an account, a sign-in, or a subscription
Collect any personal data
Make network requests in the course of budgeting
Upload, sell, or share your budgeting data — it stays on your device
Use analytics, telemetry, or usage tracking
Use advertising or marketing trackers
Use third-party crash-reporting services
Link to your bank accounts or use open-banking / PSD2 connections
Receive or store your card or payment details
Load remote fonts, scripts, or other third-party web resources

7. App permissions

Sprigly still declares the Android internet permission in its manifest, left over from an earlier version that had accounts, but the beta app no longer uses it — it makes no network requests. We do not access your contacts, location, photos, microphone, or camera.

The app also declares visibility of email apps, so that the “Report a bug” screen can open your mail client. That is not a permission, and it gives Sprigly no access to your mail.

8. Data retention

Budgeting data: kept on your device until you delete it or uninstall the app — controlled entirely by you. We hold no copy.
Error log: the 50 most recent entries, on your device only, overwritten as new ones arrive. Cleared whenever you ask, and by “Erase all data”.
Support emails: kept while we resolve your issue and for up to 12 months afterwards, then deleted.
Waitlist address: kept until you unsubscribe or ask us to delete it (see section 13).

9. Your rights

EU / EEA / UK (GDPR / UK GDPR)

You have rights to access, rectification, erasure, restriction, portability, and objection. For your budgeting data you exercise these directly in the app: edit or delete individual items at any time, export a copy via Settings → Export data, or erase everything via Settings → Danger zone → Erase all data. We hold no copy of it, so there is nothing for us to retrieve or delete on your behalf. The Delete Your Data page has the full steps.

For anything we do hold — support emails you have sent us, or your waitlist address — contact support@spriglyapp.com. We answer within one month of receiving your request. If a request is unusually complex we may take longer, up to a further two months, and we will tell you within the first month if that happens.

Right to object. Where we rely on our legitimate interests (Art. 6(1)(f) GDPR) — support emails and bug reports (section 5), website hosting logs and cookieless analytics and the contact form (section 12), and the bot protection on the waitlist and contact forms (sections 12 and 13) — you may object at any time on grounds relating to your particular situation. Write to support@spriglyapp.com and we will stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. Where we rely on your consent instead — the waitlist — you can withdraw it at any time, as described in section 13.

We make no automated decisions that produce legal effects for you or similarly significantly affect you, and we do no profiling.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — in particular in the EU or EEA country where you live or work or where the alleged infringement took place, or with the authority competent for us.

California (CCPA / CPRA)

You have rights to know, delete, and correct, and to opt out of “sale” or “sharing.” The beta app collects no personal information. The only personal information we hold is what you send us yourself — a support email or contact-form message, or a waitlist sign-up. We do not sell or share your personal information, and we do not use it for cross-context behavioural advertising.

Everywhere else

10. Children and minors

Sprigly is intended for users aged 16 and over. It is not directed to children, and we do not knowingly collect personal information from anyone under 16.

11. International data transfers

Your budgeting data stays on your device and is not transferred anywhere. The beta app itself transfers nothing. Our website, the launch waitlist and the support mailbox, however, involve providers outside the EEA (see sections 5, 12 and 13). Where data is transferred outside the EEA, we rely on appropriate safeguards for that transfer, such as the European Commission’s Standard Contractual Clauses, together with the receiving provider’s own terms.

12. The website (spriglyapp.com)

Sections 1–11 concern the Sprigly app, which contains no analytics. This section covers our marketing website, spriglyapp.com. The data controller is the same as in section 1.

Hosting

The website is hosted by Vercel Inc. as our processor. To deliver the site, Vercel processes connection data such as your IP address and browser user-agent in server logs. We rely on our legitimate interest (Art. 6(1)(f) GDPR) in operating a secure, functioning website.

These logs are short-lived: on our plan Vercel keeps runtime logs for about one hour, and the data behind its observability views for about 12 hours.

Cookieless analytics

We use PostHog (EU-hosted) as our processor for privacy-preserving, cookieless website analytics. PostHog sets no cookies, stores nothing in your browser, and makes no session recordings. It does read some information from your browser in order to describe each visit, set out below.

What PostHog records: the pages you view, clicks on links and buttons (including the text on them), the page or search engine you came from, your browser and operating system, your screen size, and an approximate country worked out from your IP address. It does not record what you type into forms.

To count unique visitors, your IP address and user-agent are processed transiently on the server to compute a one-way hash with a salt that rotates daily and is then deleted; the raw IP and user-agent are not stored, and the result is not designed to identify you and is not linked to your app data. We have asked PostHog to discard client IP addresses, so your IP address is not kept alongside the events. We do not track you across other websites. Our legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in understanding website usage. See PostHog’s privacy information at posthog.com/privacy.

Analytics events are deleted after 12 months.

Contact form

If you use the form on our contact page, we receive your email address, your message and, if you give it, your name. We use them only to answer you. Legal basis: our legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR).

Our website does not store your message. Our server passes it to Resend (USA), our processor, which delivers it as an email to our support mailbox (see section 5). We keep it for as long as needed to answer you and for up to 12 months afterwards, then delete it. The form is protected from bots by Cloudflare Turnstile, exactly as described for the waitlist in section 13.

Cookies and device storage

We set no cookies of our own on spriglyapp.com, and the site stores nothing in your browser’s local or session storage. Our analytics run in cookieless mode, our fonts are served from our own domain, and there are no advertising or social-media pixels anywhere on the site. There is therefore nothing for you to clear or consent to storing.

Two things do read information from your device without storing anything on it. PostHog reads your browser, operating system, screen size and referring page to build the analytics events described above. Cloudflare Turnstile reads technical browser signals, and only on the waitlist and contact pages (sections 12 and 13). You can block either with your browser’s privacy settings or a content blocker — the rest of the site works normally without them, though the waitlist and contact forms cannot be submitted if Turnstile is blocked.

Because the site stores nothing on your device and runs no cross-site tracking, we show no cookie-consent banner, and there is nothing for a “Do Not Track” or “Global Privacy Control” signal to switch off.

13. The early-access waitlist

If you choose to join our launch waitlist (on the /waitlist page), we process the personal data you give us there. This is optional and entirely separate from the app.

What we collect: your email address and the date and time you signed up. We ask for nothing else — no name, no company, no other details. Your IP address is additionally processed by the bot check on the form, as described under Cloudflare Turnstile below.
Why: to send you email about Sprigly — news of the launch and, from time to time, product updates and other news about the app. We do not sell or share your address, and we do not use it for anything unrelated to Sprigly.
Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by submitting the form. You can withdraw it at any time — every email we send includes an unsubscribe link, or you can email support@spriglyapp.com and we will remove you.
Retention: we keep your address until you unsubscribe or ask us to delete it (whichever you choose) — you can do either at any time.

We use the following processors for the waitlist, each under their standard data processing terms (and, where they are outside the EEA, the safeguards described in section 11):

Supabase — stores the waitlist (see supabase.com/privacy).
Resend — stores the mailing list and sends our emails (see resend.com/legal/privacy-policy).
Cloudflare Turnstile (Cloudflare, Inc., USA) — protects the form from bots. When the waitlist page loads, and again when you submit the form, Turnstile processes your IP address and technical signals from your browser. On submission our server passes your IP address to Cloudflare so that it can verify the check; we do not store it. Turnstile sets no tracking cookies. Legal basis: our legitimate interest in preventing abuse of the form (Art. 6(1)(f) GDPR). See cloudflare.com/privacypolicy.

14. Changes to this policy

We may update this policy as the beta evolves. We will update the “Last updated” date and, for significant changes, note them in the release notes of an app update and on this page. The beta app makes no network requests, so it cannot tell you about a change on its own. When Sprigly leaves beta, the full-release Privacy Policy will apply instead — we will tell you before that happens.

15. Contact

Email: support@spriglyapp.com
Postal: Simeonistraße 8, 80637 Munich, Germany

Privacy Policy — Beta