Privacy policy
SpotHeight is a personal finance app for Android and the web, made in New Zealand by Nic Maultsaid. This page says what it collects, why, where it is kept, and how to have it deleted. Questions or requests: privacy@spotheight.com.
What SpotHeight collects
- Your account. Your email address and display name. If you sign in with Google, Google shares your name, email address and Google account ID with SpotHeight — nothing else from your Google account.
- What you enter. Transactions, budgets, savings goals, loans, categories, rules and settings you create in the app.
- Bank data, only if you connect a bank. Bank connections are invitation-only and go through Akahu, a New Zealand open-banking provider, with your consent given at your bank. SpotHeight then receives your account names and balances, and your transactions (date, amount, description and merchant). SpotHeight never sees your bank login. The access token Akahu issues is stored encrypted on your phone; SpotHeight's server keeps only a one-way fingerprint of it, used to route new-transaction notifications to your account.
- Diagnostics and usage. Firebase Crashlytics records crash reports (the app version, device model, operating system and what the app was doing). Google Analytics for Firebase records how the apps are used (screens opened, features used) along with device type and approximate location derived from your IP address.
How it is used
- To run the app: storing your records, keeping your phone and the web in sync, categorising bank transactions, and calculating budgets, goals and loans.
- To fix crashes and decide what to improve.
SpotHeight shows no advertising, does not sell your information, and does not share it with anyone except the service providers below, who process it only to run the app.
Where it is kept
- Google Firebase stores your records in Google's Sydney, Australia data centre. Sign-in, analytics, crash reporting and some server processing run in other Google regions, including the United States.
- Akahu (New Zealand) holds your bank connection.
- Cloudflare serves the web app.
Data is encrypted in transit. Access rules on the server let only you read your financial records; the person who administers SpotHeight can grant or withdraw bank access but cannot read your money data.
Google user data
SpotHeight's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google sign-in is used only to identify you to SpotHeight.
Keeping and deleting it
- Your data is kept while your account exists.
- You can export your records as CSV files from the app at any time.
- You can disconnect your bank in the app, or revoke SpotHeight's access at my.akahu.nz; no new bank data arrives after that.
- To delete your account and everything stored with it, email privacy@spotheight.com from your account's address. Deletion is completed within 30 days; crash and analytics records age out on Google's own retention schedule.
Your rights
Under New Zealand's Privacy Act 2020 you may ask for a copy of the personal information SpotHeight holds about you and ask for it to be corrected. If you are unhappy with how your information has been handled, you can complain to the Office of the Privacy Commissioner.
Children
SpotHeight is not intended for anyone under 16.
Changes
If this policy changes, the date above changes with it, and significant changes will be noted in the app.