Privacy policy
SpotHeight is a personal finance app for Android and the web, made in New Zealand by Nic Maultsaid. This page says what it collects, why, where it is kept, and how to have it deleted. Questions or requests: [email protected].
What SpotHeight collects
- Your account. Your email address and display name. If you sign in with Google, Google shares your name, email address and Google account ID with SpotHeight — nothing else from your Google account.
- What you enter. Transactions, budgets, savings goals, loans, categories, rules and settings you create in the app.
- Bank data, only if you connect a bank. Bank connections are invitation-only and go through Akahu (see Bank connections through Akahu below). With your consent, SpotHeight reads your account names, masked account numbers, account types and balances, and your transactions (date, amount, description, merchant and Akahu's category), including ones still pending. It keeps the account names, types and balances and the transactions, not the account numbers. SpotHeight never sees your bank login.
- Diagnostics and usage. Firebase Crashlytics records crash reports (the app version, device model, operating system and what the app was doing). Google Analytics for Firebase records how the apps are used (screens opened, features used) along with device type and approximate location derived from your IP address.
If you register interest
On spotheight.com you can leave your email address and, if you like, a note about what you'd use SpotHeight for. They are kept in Google Firebase (Sydney, australia-southeast1) with the time you sent them. They are used only to email you about SpotHeight's launch, are never shared or sold, and are deleted once SpotHeight has launched and told you, or sooner if you ask. To be removed, reply to any email or write to [email protected]. The page sets no cookies and runs no analytics.
When you register, you'll get one email asking you to confirm your address, and nothing more until you do. That email is sent through Resend, an email service in the United States. From 30 October 2026, a sign-up that isn't confirmed is deleted about a week later. So that you aren't emailed twice, a one-way coded form of your address is kept, and only while your sign-up is.
Bank connections through Akahu
Akahu is the New Zealand open-banking provider SpotHeight uses to connect to banks. Akahu handles its side of the data under its own privacy notice.
- Consent. You connect a bank through Akahu's own connection pages, where you choose which accounts to share and log in to your bank with Akahu, not with SpotHeight.
- Read-only. SpotHeight can only read account and transaction information. It cannot make payments, move money or change anything at your bank.
- What is read, and for how long. When you first connect, SpotHeight reads the last 90 days of transactions. After that it reads new transactions and balances as they arrive, for as long as the connection stays in place.
- The access token. Akahu gives SpotHeight an access token for your connection. It is held encrypted on SpotHeight's server, on Google Cloud, and the server uses it to fetch your account and transaction data from Akahu on your behalf. Once the server holds it, the app on your phone no longer keeps a copy. If your phone connected before the server held tokens, the app hands its token over once and, to check the connection is yours, reads the email address on your Akahu account.
- Withdrawing consent. You can end the connection at any time with Disconnect in SpotHeight, or at my.akahu.nz/connections. Either way, SpotHeight reads no more bank data after that.
How it is used
- To run the app: storing your records, keeping your phone and the web in sync, categorising bank transactions, and calculating budgets, goals and loans.
- To fix crashes and decide what to improve.
SpotHeight shows no advertising, does not sell your information, and does not share it with anyone except the service providers below, who process it only to run the app.
Where it is kept
- Google Firebase stores your records, including the encrypted Akahu access token, in Google's Sydney, Australia data centre (australia-southeast1). The server that fetches your bank data runs in Sydney and in Google's us-central1 region in the United States. Sign-in, analytics and crash reporting also run in other Google regions, including the United States.
- Akahu (New Zealand) provides your bank connection.
- Cloudflare serves the web app.
- Resend (United States) sends the email that asks you to confirm a register-interest sign-up.
Data is encrypted in transit. Access rules on the server let only you read your financial records; the person who administers SpotHeight can grant or withdraw bank access but cannot read your money data.
Google user data
SpotHeight's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google sign-in is used only to identify you to SpotHeight.
Keeping and deleting it
- Your data is kept while your account exists.
- You can export your records as CSV files from the app at any time.
- When a bank connection ends — you disconnect in SpotHeight, you revoke its access at my.akahu.nz/connections, or your bank access is withdrawn — SpotHeight deletes its access token, your connected-account details, and the bank records you have not added to your own transactions. Transactions you added from your bank stay, as your own records.
- When your account is deleted, all of your data is deleted with it, bank data included.
- To delete your account and everything stored with it, email [email protected] from your account's address. Deletion is completed within 30 days; crash and analytics records age out on Google's own retention schedule.
Your rights
Under New Zealand's Privacy Act 2020 you may ask for a copy of the personal information SpotHeight holds about you and ask for it to be corrected. If you are unhappy with how your information has been handled, you can complain to the Office of the Privacy Commissioner.
Children
SpotHeight is not intended for anyone under 16.
Changes
If this policy changes, the date above changes with it, and significant changes will be noted in the app.