XabitXabit
Legal

Privacy policy

Effective date: July 25, 2026

Xabit is currently operated on an unincorporated basis by its developer, based in Pakistan, pending formal company registration. References to “Xabit,” “we,” “us,” and “our” in this Privacy Policy refer to that operator.

1. Introduction

This Privacy Policy explains how Xabit collects, uses, shares, and protects information when you use the Xabit mobile application, our website (xabit.app), and related services (together, the “Service”). It should be read together with our Terms and Conditions. By using the Service, you acknowledge the practices described here.

2. Information we collect

2.1 Account information

When you create an account, we collect information such as your name and email address, typically obtained through Google Sign-In and/or our backend authentication provider, together with basic profile details you choose to add.

2.2 Expense and budgeting data

Information you enter to use the app's core features, including:

  • Expense records you log manually — merchant, amount, category, date, and payment method;
  • Custom categories and monthly budget caps you set, and whether you have reached an 80% or 100% alert threshold;
  • Receipt photos you attach to an expense, captured via your device camera or selected from your photo library;
  • Group information — which groups you belong to, group membership, expense splits, and approval activity within a group; and
  • The data used to generate your “spending personality” summary and periodic reports, which we produce using rule-based logic applied to your own expense data. We do not use this data to build advertising profiles about you.

2.3 Location information

If you choose to enable live location sharing for a specific group, we collect your device's approximate or precise location (depending on the permission you grant) for as long as sharing remains active for that group, so it can be shown to other members of that group on the group map. This feature is off by default and is entirely optional. If you do not enable it, we do not collect your live location through the app.

2.4 Device and technical information

We and our service providers automatically collect certain technical information needed to operate the Service, such as a device push-notification token (used to deliver notifications through Google Firebase Cloud Messaging), app version, device type and operating system, and basic diagnostic/crash information used to keep the app stable.

2.5 Information from other users

If another user includes you in a group, adds an expense involving you, or uploads a receipt photo that references you, we will process that information as part of operating the group feature, even though you did not submit it yourself.

3. How we use information

We use the information described above to:

  • Provide, maintain, and improve the Service, including expense logging, budgeting, group splitting, receipt storage, spending reports, and the group map;
  • Create and secure your account, and authenticate you when you sign in;
  • Send transactional and budget-related push notifications (for example, an alert that you have reached 80% of a category budget), where enabled;
  • Detect, investigate, and prevent fraud, abuse, and security incidents;
  • Respond to your support requests; and
  • Comply with applicable legal obligations.

We do not sell your personal information, and we do not use your expense or receipt data to serve third-party advertising.

4. How information is shared

4.1 With other members of your group

Expense entries, notes, receipt photos, and split/approval activity you post to a group are visible to the other members of that group. If you enable live location sharing for a group, your location is visible to that group's members while sharing is active. You control what you share and with which group; leaving a group stops new sharing but does not retroactively remove information other members already viewed.

4.2 With service providers

We share information with third-party providers who help us operate the Service, including:

  • Supabase — database hosting and backend infrastructure used to store your account, expense, and group data;
  • Google Firebase — push notification delivery and related app infrastructure;
  • Google Sign-In — authentication when you choose to sign in with your Google account; and
  • Google Maps Platform — map rendering and location display used by the group map feature.

These providers process information on our behalf and are contractually or contextually restricted from using it for their own independent purposes, subject to their own applicable terms and privacy practices, which we encourage you to review.

4.3 Legal and safety disclosures

We may disclose information if required to do so by law, regulation, legal process, or governmental request, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Xabit, our users, or the public.

4.4 Business transfers

If Xabit is involved in a merger, acquisition, reorganisation, or sale of assets, information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

5. International data transfers

Xabit's users are located worldwide, while our infrastructure providers (including Supabase and Google) may store and process data in countries other than your own, including outside the country in which you reside. By using the Service, you understand that your information may be transferred to, stored, and processed in a country that may have different data protection laws than your own.

6. Data retention

We retain your account and expense data for as long as your account remains active, so that you can continue to use the Service's history and reporting features. If you delete your account, we will delete or anonymise your personal information within a reasonable period, except where we are required to retain certain records for legal, tax, security, or dispute-resolution purposes, or where copies persist temporarily in routine backups until they are overwritten in the ordinary course.

Receipt photos and location data are retained only for as long as needed for the purposes described in this Policy; location data shared on the group map is not stored as a historical location history beyond what is needed to operate the live map feature.

7. Your rights and choices

Depending on your location, you may have rights to access, correct, export, or delete your personal information, or to object to or restrict certain processing. You can exercise many of these directly in the app:

  • Edit or delete individual expenses, categories, or receipt photos at any time;
  • Leave a group, or turn off live location sharing for a group, from within the app;
  • Disable push notifications through your device settings or in-app settings; and
  • Delete your account from within the app's settings, or by emailing hello@xabit.app, which will remove your personal data subject to the retention exceptions described in Section 6.

To make a request we cannot handle directly in the app, contact us at hello@xabit.app. We may need to verify your identity before completing certain requests.

8. Data security

We use reasonable administrative, technical, and organisational measures designed to protect your information, including relying on infrastructure providers (Supabase, Google Firebase) that provide encryption in transit and access controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Children's privacy

The Service is not directed at, and is not intended for use by, individuals under 18 years of age, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us at hello@xabit.app so we can investigate and, where appropriate, delete that information.

10. Third-party links and services

The Service may reference or link to third-party services (such as the Google Play Store or Google account settings). This Privacy Policy does not cover the practices of those third parties, and we encourage you to review their respective privacy policies.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the app or by other reasonable means before the changes take effect. The “Effective date” at the top of this Policy indicates when it was last revised. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

12. Governing law

This Privacy Policy is governed by the laws of the Islamic Republic of Pakistan, without prejudice to any mandatory data-protection rights available to you under the law of your own country of residence.

13. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us at hello@xabit.app, or visit xabit.app.