Privacy policy
DRAFT — not legal advice
Version 0.1-draft · 2026-11-03
The short version
Your money data stays on your phone unless you sign in. If you sign in, it syncs to our servers so it can reach your other devices. We do not sell it and we show no ads. Analytics run only if you say yes, and you can say no or change your mind any time in Settings.
Who we are
Notibi ("we") runs Spool. Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) we are the data fiduciary for the personal data you give us. Contact us at hello@notibi.com.
What we collect and why
Your entries, bills, accounts, goals and settings, to work out your safe-to-spend and forecast. If you sign in: your email address, to identify your account and send sign-in and reminder emails. If you contact support: your message, email and any screenshot you attach. If you agree to analytics: a few events such as "finished setup", with no amounts and no entry notes. We use data only for these purposes.
Where it is kept
On your device (in the browser database) by default. If you sign in, a copy is stored on Cloudflare, who run our servers and may process it outside India. Emails are sent through Resend. We share data with them only so the service works. We do not sell data and we use no advertising trackers.
Consent and withdrawal
Optional uses, such as analytics and personalised tips, are off until you switch them on. You can withdraw consent in Settings at any time and it takes effect at once. We record when you chose and which version of this policy was shown. Withdrawing does not stop the app from working.
Your rights
You can ask to access your data, correct it, erase it, and have a grievance heard. You can export all your data from Settings, edit it in the app, and delete it from Settings. You may also nominate someone to exercise these rights for you if you cannot. For anything else write to hello@notibi.com.
How long we keep it
On your device, until you delete it. On our servers, while your account exists. When you delete your account we remove your data from our servers, and from backups on a fixed schedule. Support emails are kept for up to 2 years.
Children
Spool is for people aged 18 and over. We do not knowingly collect data of children. If you think a child has given us data, tell us and we will erase it.
Security
Data is encrypted in transit. The optional app lock keeps others out of the app on your phone; it does not encrypt the data on the device. If a breach affects you we will tell you and the Data Protection Board as the law requires.
Grievance contact
Write to hello@notibi.com with the subject "Grievance". We aim to reply within 7 days. If we do not resolve it you may complain to the Data Protection Board of India.
Changes
If this policy changes in a way that matters, we show the new version and ask you to accept it again. This draft has not been reviewed by a lawyer.