Legal
Privacy Policy
This policy explains what personal and financial data Crumb collects, why, how it's protected, and what control you have over it. Crumb is currently in closed early access — some features described in "How Crumb works today" below (like self-service account deletion) are still being built, and this policy says so plainly rather than describing a product that doesn't exist yet.
1. Who we are
Crumb ("Crumb", "we", "us", "our") is an expense-tracking application at crumbmoney.com and app.crumbmoney.com, operated by Athena Private Management FZCO, part of the Athena Holdings group, registered at Suite 4333, Dubai Silicon Oasis, Dubai, United Arab Emirates. Athena Private Management FZCO is the data controller for the personal data described in this policy.
For any privacy question, contact support@crumbmoney.com.
privacy@crumbmoney.com) has not been confirmed yet — support@crumbmoney.com
is used as an interim contact throughout this document.
2. Scope of this policy
This policy covers two related but separate surfaces:
- The Crumb application (
app.crumbmoney.com) — the authenticated product where you track expenses. It requires an account and is never indexed by search engines. - The Crumb marketing site (
crumbmoney.com) — the public page you're reading this from, including the early-access request form. It's intentionally public and indexable.
Where the two collect or handle data differently, this policy says so explicitly rather than treating them as one system.
3. Data we collect
3.1 Account & profile data
When you're invited to Crumb and set up your account: your email address (held by our authentication provider, Supabase Auth), and your name, which you can edit as first name, last name, or a combined display name. We do not currently collect a phone number, avatar image, or postal address as part of your profile.
3.2 Authentication & security data
Your password is never seen or stored by Crumb's own application code — it's managed entirely by Supabase Auth. We hold a session (kept in a browser cookie) that proves you're signed in. Two-factor authentication (TOTP) is not yet available in the product, so no TOTP secret is collected.
3.3 Financial & expense data
The data you enter to track your spending: expense names, amounts, currencies, categories, due and paid dates, notes, and a payment method label you choose (e.g. "Visa •••• 4242") — we never store a full card number, only the last four digits you provide as a label, and we never process card payments directly. If you use multiple currencies, we also store the exchange rate we used at the time, for accurate reporting.
3.4 Workspace & organisation data
The name of your organisation and any workspaces you create within it, and who has access to them (your teammates' membership and role).
3.5 Device, session & usage data
See Section 12 for the full, itemised list of cookies and local-storage values the app and marketing site use. In short: a small number of strictly-necessary session cookies, plus a handful of on-device preference values (theme, workspace selection, list density) that never leave your browser as identifiable tracking data. We do not currently log your IP address or device details against your account activity inside the app.
3.6 Communications data
If you're invited to Crumb, or if the reminder/summary email features are active for your account, we send transactional emails containing your name and relevant expense information (e.g. "3 payments due this week"). As of this policy's effective date, Crumb's outbound email system is built but not yet turned on — no reminder, invitation, or summary emails are currently being sent in production. This policy describes what will happen once that changes, so it doesn't need to be rewritten the moment it does.
3.7 Early-access & waitlist data
If you request early access via the form on this marketing site, we collect: your name, email address, how you'd describe your use case, any features you say you're interested in, whether you'd like occasional product updates, and basic attribution information (how you found us — e.g. a campaign link — and your browser's user-agent string). We do not collect your IP address as part of this form.
4. How we use it
- To provide the core product — storing and displaying your expenses, categories, and reports.
- To authenticate you and keep your account secure.
- To operate your organisation's workspaces and membership.
- To send you service communications (once email is active) — invitations, password resets, and, if you don't turn them off, expense reminders and spending digests.
- To respond to support requests you send us.
- To manage the early-access waitlist and, if you opted in, send occasional product updates.
- To keep the product working — basic performance monitoring (see Section 13).
We do not sell your personal or financial data, and we do not use it for third-party advertising.
5. Lawful bases
Where a legal basis is required for our processing (for example, under UK/EU data protection law), we rely on:
- Contract — processing needed to provide the Crumb service you've signed up to use.
- Legitimate interests — keeping the product secure, reliable, and functioning correctly.
- Consent — for optional marketing communications, which you can withdraw at any time (see Section 11).
- Legal obligation — where we're required to retain or disclose information by law.
6. How financial data is handled
Crumb is an expense-tracking tool, not a bank, payment processor, or accounting platform — we never move money and never connect to your bank account.
Your organisation's data is isolated from every other organisation's data at the database level: every record is tied to your organisation, and access is enforced by database-level row security tied to your verified identity — never by a value your browser sends us. Every change to your data (create, edit, delete) is written through controlled application functions and recorded in an internal audit trail scoped to your organisation, so activity within your account is traceable.
7. Security
We take reasonable, industry-standard measures to protect your data, including:
- Encryption in transit (TLS) for all traffic to and from Crumb.
- Encryption at rest for stored data, provided by our infrastructure providers.
- Database-level access controls that restrict every query to your own organisation's data.
- Payment method details limited to a label and last four digits only — never a full card number.
- Passwords hashed and managed by our authentication provider, never stored or handled directly by Crumb's own code.
We describe this as "encrypted and secure by design" deliberately, and not as "end-to-end encrypted," "zero-knowledge," or bank-grade/military-grade security — those are specific technical claims we don't currently meet, and we won't use them until we genuinely do. No system is perfectly secure, and we can't guarantee absolute security of information transmitted over the internet.
8. Who we share data with
We share data only with service providers who help us run Crumb, under terms that require them to protect it. We do not sell your data or share it for third-party advertising.
| Provider | What it's for | What it processes |
|---|---|---|
| Supabase | Database, authentication, scheduled jobs | All account, organisation, and expense data described in Section 3 |
| Vercel | Hosting the application and this website | Standard hosting/request data; anonymised, URL-stripped performance timing (see Section 13) |
| Resend | Transactional email (currently inactive — see Section 3.6) | Recipient email address and email content, once activated |
| Frankfurter (FX rates) | Currency conversion reference rates | Currency codes and dates only — never your name, expenses, or any other personal data |
We may also disclose information where required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets — in which case we'd ensure your data continues to be protected under materially similar terms.
9. International transfers
Athena Private Management FZCO is based in the United Arab Emirates, and our infrastructure providers (Section 8) may process and store data in other countries. Where your data is transferred outside the country you're in, we take steps intended to keep it appropriately protected.
10. Retention & deletion
We keep your data for as long as your account is active, so the product can keep working for you. Deleted expenses go to a Trash first and can be permanently removed from there.
11. Your rights
Depending on where you live, you may have rights to:
- Access the personal data we hold about you.
- Correct inaccurate data (you can also edit most of this yourself in Settings).
- Delete your data (see the current limitation noted in Section 10).
- Restrict or object to certain processing.
- Receive a copy of your data in a portable format.
- Withdraw consent for marketing communications at any time — every marketing email includes an unsubscribe option, and you can also email us directly.
To exercise any of these rights, contact support@crumbmoney.com.
13. Analytics
We use Vercel Speed Insights to understand how quickly the product loads for real users. It measures performance timing only — not what you click or type — and the page address it records has any query parameters and identifying fragments removed before it's sent. We do not use behavioural analytics, advertising trackers, or session-replay tools.
14. Age requirement
Crumb is intended for adults managing their own or their household's/business's finances. You must be at least 18 years old to create a Crumb account.
15. Automated decision-making
Crumb does not use your data to make automated decisions that produce legal or similarly significant effects about you, and we do not use profiling or machine-learning-based scoring anywhere in the product today.
16. Data breaches
If a data breach occurs that's likely to put your rights and freedoms at risk, we'll notify affected users and, where legally required, the relevant regulator, without undue delay.
17. Changes to this policy
We review this policy whenever a product change might materially affect it, and we version every update. You can see the full history of changes in our change log. Material changes that affect how your existing data is used will be communicated to you directly, not just posted here silently.
18. Contact us
Questions about this policy or your data: support@crumbmoney.com.