Legal

Privacy Policy

Last updated: July 31, 2026

1. Who We Are

NEXO ("the App", "we", "us") is an expense-tracking application operated by Khaw Jyh Boon, an individual. This Privacy Policy explains what personal data we collect, why, how we protect it, and the rights you have over it.

If you have any questions, contact us at [email protected].

2. Data We Collect

a. Account data

• Email address and authentication credentials (passwords are stored in hashed form by our authentication provider — we never see your plain-text password)
• Display name / profile info you choose to provide
• Profile photo (avatar), if you choose to upload one

b. Financial records you enter

• Transaction amounts, categories, dates, notes, and currencies
• Wallet/account names and balances you create
• Shared expense group memberships

c. Notification tokens

• If you turn notifications on, we store the push token issued by Apple or Google for your device. It identifies a device, not a person, and it is the only way we can deliver a notification to you.
• It is deleted when you turn notifications off, and when you delete your account.

d. Technical data

• Standard server logs kept by our infrastructure provider — IP address, timestamps and request metadata — used for security and abuse prevention.
• NEXO contains no analytics and no crash-reporting software. There is no Google Analytics, no Firebase Analytics, no Sentry and no equivalent embedded in the app. Nothing in it reports your behaviour back to us.

What we do NOT collect

• We do not connect to your bank accounts or collect banking credentials
• We do not collect government ID numbers, precise location, or contacts
• We do not collect payment or card details. NEXO has no subscriptions and no in-app purchases — the app is free and there is nothing in it to buy.
• We do not sell your personal data to anyone

3. How We Use Your Data

4. Notification Settings

NEXO does not send marketing or promotional email. The only messages it sends are the notifications you switch on yourself, and essential service email such as password resets and space invitations you asked us to send.

Each notification is controlled separately in Settings → Notifications: Budget alerts, Partner activity and Settle reminders. Turning them all off stops every notification, and your stored notification token is removed. It does not affect essential service email such as password-change or security notices.

5. Where Your Data Is Stored

Your data is stored on secure cloud infrastructure provided by Supabase, Inc., with servers located in Mumbai, India (AWS ap-south-1). Data is encrypted in transit (TLS) and at rest.

6. Data Sharing

We share data only with:

1. Users you choose to share with — when you join or create a shared expense group, members of that group can see the records within it.
2. Service providers — providers that process data on our behalf under contractual safeguards:
   • Supabase, Inc. — database, authentication, and file storage
   • Expo (650 Industries, Inc.) — delivery of push notifications. Receives your notification token and the contents of the notification, in order to hand it to Apple's or Google's push service. Only used if you have notifications switched on.
   • Resend, Inc. — delivery of service email such as password resets and the space invitations you send. Receives the recipient's email address and the contents of that email.

   We also request currency exchange rates from a public rate service. Those requests contain a currency pair and nothing else — no account data, no device identifier, and nothing that identifies you.

3. Legal requirements — if required by law, court order, or to protect the rights and safety of users.

We never sell or rent your personal data to third parties for marketing.

7. Data Retention

• Your data is retained for as long as your account is active.
• If you delete your account, your personal data is deleted within 30 days, except where we are legally required to retain certain records.
• Shared spaces: if you shared expenses with other users, those shared records remain visible to the remaining members so their financial history stays accurate. They are re-attributed to a placeholder member that retains only the display name you used in that space — your account, email, and all other personal data are removed.
• Campaign pledge records — if you backed the NEXO launch campaign, that transaction record may be retained for up to 5 years after account deletion where needed for tax, accounting, and dispute-resolution obligations. The link to your account is severed, so the record no longer points back to a NEXO user. It is kept in minimized form and is not used for any other purpose.
• Backup copies are purged on a rolling basis within 90 days.

8. Your Rights

Depending on your location, you have rights under the Philippine Data Privacy Act of 2012 (RA 10173), the GDPR (if you are in the EU), and similar laws, including the right to:

• Access — request a copy of the data we hold about you
• Rectification — correct your data (you can edit most data directly in the App by editing your profile or transactions)
• Erasure ("right to be forgotten") — delete specific data or your entire account and all associated data
• Data portability — receive your data in a portable format (e.g., CSV export)
• Object / withdraw consent — opt out of promotional messages or other consent-based processing
• Lodge a complaint — with the National Privacy Commission (Philippines) or your local data protection authority

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

In-app controls

• Edit personal data: edit your profile information directly in the App
• Edit transactions: edit or delete transactions at any time
• Export your data: Settings → Cloud & data → Export data gives you your records as CSV or PDF
• Delete your account and all associated data: Settings → Delete account, at the bottom of the Settings tab. This is permanent and takes effect immediately.

If you no longer have the App installed, or cannot sign in, you can still request deletion by email. Full instructions, and a breakdown of exactly what is removed and what is retained, are on the Delete Your Account page.

9. Security

We use industry-standard measures to protect your data, including encrypted connections, hashed credentials, role-based access controls, and row-level security so users can only access their own or shared records. No system is 100% secure, so please use a strong, unique password.

10. Children

NEXO is not intended for anyone under 18, and we do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it.

11. International Transfers

Because our infrastructure may be located outside your country, your data may be transferred and stored internationally. We take reasonable steps to ensure equivalent protection wherever data is processed.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced in the App or by email, and the "Last updated" date will be revised. Continued use after changes take effect constitutes acceptance.

13. Contact & Data Protection

• General support / privacy requests: [email protected]
• Data Protection Officer: not separately designated at this stage — privacy requests are handled through the support email above
• Operator: Khaw Jyh Boon