Sprig Privacy Policy

Effective date and last updated: 3 October 2026 (replaces the version of 5 September 2026). Applies to the Sprig app for iPhone and iPad (Apple App Store) and Android (Google Play), app ID com.secundumreality.sprig, published by Secundum Reality.

1. Who we are

Sprig is developed and published by Secundum Reality ("we", "us", "our"), an app studio in Islamabad, Pakistan. Secundum Reality is operated by HOMEVISM SMC-PRIVATE LIMITED, Islamabad, Pakistan. Under data protection laws such as the GDPR, we are the controller of the limited personal data described in this policy. You can reach us at contact@homevism.com.

This policy covers the Sprig app on iPhone and iPad (downloaded from the Apple App Store) and on Android (downloaded from Google Play), including updates. The Secundum Reality website is covered by its own website privacy policy.

2. Your data at a glance

3. Your books stay on your device

Sprig is a local-only app. What you create in Sprig is saved in the app's private storage on your device and nowhere else. That includes:

• income, expense and transfer entries, with their categories, summaries, notes and amounts;
• wallets (bank account, credit card, cash, savings), including any account number or IBAN you choose to type in;
• your Personal and Side business books, monthly limit and category budgets;
• invoices you track (client name, amount, invoice number and due date), recurring entries, mileage trips and the figures in your tax summary;
• receipt photos you attach, and their dates;
• app settings such as your language, app lock, your free-entry and ad top-up counts, and whether Premium is active.

Sprig does not upload any of this. The app has no server to send it to and makes no network requests of its own. The only network traffic comes from the app store (for purchases and subscription checks) and, on the free plan, Google's ad software (see section 8). Neither receives your bookkeeping data. Links you tap in Sprig, such as this policy or the store's subscription page, open in your browser or the store app. Because nothing reaches us, we cannot see, access, restore or recover your books.

How your books are protected

• Android: Sprig's data file is encrypted with AES-256-GCM. The encryption key is created inside the Android Keystore, the phone's hardware-backed key store, and cannot be copied off the device. Receipt photos are stored as separate image files in Sprig's private storage. They are not part of the encrypted data file, and Sprig does not encrypt them itself; Android's app sandbox stops other apps from reading them.
• iPhone and iPad: Sprig's data file and receipt photos are kept inside Sprig's private app container. The iOS app sandbox stops other apps from reading them, and iOS Data Protection encrypts files on your device using keys tied to your device passcode, when one is set. Sprig does not add its own encryption on iPhone and iPad, either to the data file or to receipt photos, so make sure your device has a passcode.

Back Tap Quick Entry (iPhone)

If you set up Back Tap Quick Entry on iPhone (iOS 16 or later), Sprig's two shortcuts run in Apple's Shortcuts app. So that the shortcut can offer your categories, Sprig keeps a copy of your category names in a small shared file that only Sprig and its shortcuts can use. An entry you log this way (amount, category and note) is held in the same shared space. It stays on your device and is added to your books the next time you open Sprig. To install the "Log Expense" shortcut, Sprig opens a link on Apple's iCloud website. Apple handles that download.

4. No account, no sign-in, no bank connection

Sprig never asks you to create an account, sign in, or connect a bank, card or payment service. You type each entry yourself. We do not collect your name, email address, phone number, contacts, location, or any bank or card login. Sprig does not ask for permission to use your location, contacts, microphone or phone.

The permissions Sprig uses are limited to what its features need. On Android: internet and network-state access (for store billing and, on the free plan, ads), biometric access for the app lock, the Google Play billing permission, and the advertising-ID permissions that Google's ad software requires. On iPhone and iPad, iOS asks you before Sprig uses the camera or Face ID, and Apple's tracking permission is covered in section 9. Sprig does not request general storage access.

5. App lock (Face ID, Touch ID, fingerprint)

You can turn on an optional app lock in More › Settings & security. Your device's operating system does the checking:

• iPhone and iPad: Face ID or Touch ID, with your device passcode as a fallback. iOS asks your permission before Sprig can use Face ID.
• Android: on Android 11 and later, fingerprint or face unlock where your phone supports it, with your PIN, pattern or password as a fallback. On Android 10, your phone's own screen-lock check.

Sprig only receives a yes-or-no result. It never sees, stores or sends your fingerprint, face data or passcode. The app lock relies on your device's screen lock: if your device has no passcode, PIN, pattern, password or biometrics set up, Sprig opens without asking.

6. Receipt photos and the camera

To attach a receipt, you take a photo with the camera or pick one from your photos:

• iPhone and iPad: iOS asks your permission the first time Sprig opens the camera. When you pick an existing photo, Apple's photo picker gives Sprig only the photo you select. Sprig cannot browse your library.
• Android: Sprig opens your phone's camera app or the system file and photo picker, and receives only the image you choose.

Sprig copies the image into its private storage. To date the receipt, it reads the date the photo was taken from the image's details. It does not read or use location or any other information in the photo. The copy may still carry the photo's original details (for example the location, if your camera saved one), and those details go with the image if you share it. Sprig does not run text recognition on receipts and never uploads them. When you share a receipt from Sprig, the image goes wherever you choose to send or save it.

Deleting a receipt in More › Receipts deletes the photo file. Deleting an entry does not delete its receipt photo: the photo stays in Receipts until you delete it there. Uninstalling Sprig deletes all receipt photos.

7. Backups, CSV export and import

• Encrypted backup. In More › Settings & security you can create a backup file of your books. It is encrypted with a passphrase you choose (at least 6 characters): the key is derived with PBKDF2-HMAC-SHA256 (100,000 iterations), and the file is encrypted with AES-256 and protected with an integrity check (HMAC-SHA256). The backup contains your entries, wallets, books, settings, invoices, trips and receipt records. Receipt photos are not included in backups.
• CSV export. You can export the active book's entries as a CSV file, optionally with notes and your mileage log. CSV files are plain text and are not encrypted. They do not include receipt images.
• You choose where files go. Sprig hands backup and CSV files to your device's share sheet or save dialog, and you choose the destination, for example the Files app, iCloud Drive, Google Drive, email or a messaging app. We never receive a copy. The service you choose stores the file under its own terms and privacy policy.
• CSV import. When you import a CSV file, Sprig reads it on your device. Nothing is uploaded.

Anyone who has a backup file and its passphrase can read it, so keep both safe. We cannot recover a forgotten passphrase.

8. Ads on the free plan (Google AdMob)

The free plan is supported by ads from Google AdMob. This is how it works:

• When the ad software starts. For free-plan users, Sprig starts Google's ad software when the app opens. First, Google's User Messaging Platform (UMP) checks whether your consent is needed where you are. If it is, Google's consent form is shown. Once ads are allowed, the Google Mobile Ads SDK starts and loads ads in the background so that one is ready if you ask for it. Loading an ad does not show it.
• When ads are shown. An ad is only shown when you tap "Watch an ad" to earn 20 more entries. Sprig has no banner ads and shows no ads automatically.
• What Google may collect. Once the Google Mobile Ads SDK has started, it may collect device identifiers (such as the Android advertising ID, or on iPhone and iPad the advertising identifier (IDFA) if you allow tracking), your IP address (from which an approximate location can be worked out), device and operating-system details, app information, diagnostics and performance data (for example crash and latency data), and how you interact with ads.
• What Google uses it for. Google uses this data for ad delivery, measurement and reporting, frequency capping, and fraud prevention and security. Where you have agreed, it is also used for personalised ads.
• No bookkeeping data. Sprig never passes your entries, amounts, names, notes or receipts to the ad software.

Consent. Where the law requires consent, for example in the European Economic Area, the UK and Switzerland, you see Google's consent form before any ad is requested. You can change or withdraw your choice at any time in More › Ad privacy options. This row appears when it applies to you.

Sprig Premium. If you have Premium, Sprig does not start the ad software when you open the app. You get no consent form, no ad requests and no ads.

Google's use of this data is governed by the Google Privacy Policy. See also how Google uses information from sites or apps that use its services.

9. Tracking and advertising identifiers

Sprig itself does not track you. We do not follow you across other companies' apps or websites, build advertising profiles, or sell your data. On the free plan, Google AdMob may use your device's advertising identifier to show and measure ads, including personalised ads where you have agreed. On iPhone and iPad, Google can use that identifier only if you allow tracking. That is why Sprig's App Store privacy label lists identifiers under data that may be used to track you.

• iPhone and iPad: Sprig's own code never asks for tracking permission. If Apple's tracking prompt appears in Sprig, it is shown as part of Google's consent message. You can turn tracking off at any time in Settings › Privacy & Security › Tracking. Without your permission, the advertising identifier is not available to Sprig or Google.
• Android: you can reset or delete your advertising ID and opt out of personalised ads in Settings › Google › Ads or Settings › Privacy › Ads, depending on your phone.

10. Purchases and Sprig Premium

Sprig Premium is an optional, auto-renewing yearly subscription. It removes the free plan's entry limit and all ads. You buy it through the Apple App Store (StoreKit) or Google Play Billing:

• Apple or Google processes your payment. We never see your card or bank details.
• Sprig receives a signed purchase confirmation from the store and checks it on your device. Sprig then saves "Premium is active" in your local data. There is no Sprig server involved. When you use "Restore purchase", Sprig asks the store for your existing purchases.
• Your purchase history is held by Apple or Google under the Apple Privacy Policy or the Google Privacy Policy.

Prices, renewal, cancellation and refunds are covered in our Terms & Conditions.

11. Third-party services

Sprig has no analytics or crash-reporting tools of its own. These third parties may process limited data:

Apple and Google also give us aggregated statistics about the app, such as downloads and sales. If you have agreed in your device settings to share diagnostics with app developers, they may also give us crash reports. These do not include your bookkeeping data and do not identify you to us.

12. What we do not collect

We do not collect, and Sprig does not send us, your amounts, wallet names, account numbers, memos, client names, invoices, receipt images or anything else you type. We do not sell your data and we do not use data brokers. If a future version of Sprig adds any analytics, we will update this policy first and mention the change in the app's release notes on the App Store and Google Play.

13. If you email us

If you write to contact@homevism.com, we receive your email address and whatever you include in your message. We use it only to reply and help you. Please don't send backup files, passphrases or other financial details. We never need them to help you.

14. Legal bases and international transfers

Because your books stay on your device, we do not process them. For the limited processing that does happen:

• Ads on the free plan: your consent where the law requires it (for example for personalised ads in the EEA and UK). Otherwise, the legitimate interest in funding the free plan and preventing ad fraud. Google decides how it processes ad data as an independent controller.
• Purchases: performance of the contract with you, handled by Apple or Google.
• Support emails: our legitimate interest in answering you, or steps you ask us to take.

Apple and Google process data in many countries, including the United States, under their own safeguards. If you email us, we handle your message from Pakistan, and our email provider may store it in other countries.

15. How long data is kept

• Your books and receipt photos: on your device until you delete them or uninstall Sprig.
• Backups and CSV files: as long as you keep them, wherever you saved them.
• Purchase records: kept by Apple or Google under their own policies and the law.
• Advertising data: kept by Google under its own retention policies.
• Support emails: only as long as needed to help you and to keep ordinary business records.

16. Deleting your data

• Single items: in the Ledger, swipe an entry left to delete it. Delete receipt photos in More › Receipts. Deleting a wallet also deletes its entries, after a confirmation.
• Everything: delete the Sprig app from your device. On Android you can also use Settings › Apps › Sprig › Storage › Clear storage (the wording varies by phone). Because all data is stored on the device, this removes it permanently. We hold no copy that could be deleted or restored.
• Device backups: if your phone's own system backup (for example iCloud Backup or Google backup) included Sprig, a copy may remain there until that backup is deleted or replaced. Manage these in your Apple or Google account settings.
• Backups and exports: delete any Sprig backup or CSV files from wherever you saved them.
• Subscription: deleting the app does not cancel Sprig Premium. Cancel it in your App Store or Google Play subscriptions. Purchase records are held by Apple or Google.
• Ad consent and advertising ID: see section 17.

If you need help with any of this, email contact@homevism.com.

17. Your rights and choices

Depending on where you live, laws such as the GDPR (EU), the UK GDPR and US state privacy laws like the CCPA (California) may give you rights to:

• access, correct, delete or get a copy (portability) of your personal data;
• object to or restrict processing;
• withdraw consent;
• opt out of the sale or sharing of personal data, or of targeted advertising.

Because your books are on your device and we hold none of them, you control them directly:

• Access and correct: view and edit everything in the app.
• Portability: export your entries as CSV (section 7).
• Delete: delete items in the app, or delete the app and its data (section 16).
• Withdraw ad consent: go to More › Ad privacy options (shown where consent applies). Or upgrade to Premium, which does not start the ad software.
• Tracking on iPhone and iPad: go to Settings › Privacy & Security › Tracking.
• Advertising ID on Android: go to Settings › Google › Ads or Settings › Privacy › Ads.

We do not sell your personal data for money. On the free plan, Google's use of your advertising identifier for personalised ads may count as "sharing" or "targeted advertising" under some US state laws. You can opt out with the device settings above or in More › Ad privacy options where it appears. For data held by Google or Apple, use the privacy controls in your Google account or Apple ID.

You can also email us. We will reply within the time the law requires, and we will not treat you differently for using your rights. You also have the right to complain to your local data protection authority.

18. Children

Sprig is a financial record-keeping tool for adults. It is not directed at children under 13, or under the age of digital consent in your country. We do not knowingly collect personal information from children. If you believe a child has sent us personal information by email, contact us and we will delete it. Purchases made by a child are handled by Apple or Google support.

19. Security

• Data on the device: on Android, Sprig's data file is encrypted with a hardware-backed key. On iPhone and iPad, it is protected by the iOS app sandbox and the operating system's data protection. On both, Sprig does not encrypt receipt photos itself (section 3).
• App lock: with app lock on, Sprig locks when it starts and every time you return to it. It needs a screen lock on your device to work (section 5).
• Screen protection: on Android, Sprig blocks screenshots and screen recording and hides its content in the recent-apps view. On iPhone and iPad, Sprig covers its screen while the screen is being recorded or mirrored.
• Backups: backup files are encrypted with your passphrase. CSV files are not encrypted.
• Back Tap on iPhone: the shortcuts can add an entry while your iPhone is locked, and show your category names so you can pick one. They cannot display your entries, balances or reports.
• Device system backups: depending on your settings, your phone's own system backup (for example iCloud Backup or Google backup) may include Sprig's files, including receipt photos. Those backups are created and stored by Apple or Google under your account, not by us.

No method of storage is perfectly secure. You are responsible for your device's security, such as using a screen lock and installing system updates.

20. Changes to this policy

We may update this policy when the app or the law changes. We will change the date at the top. We will note material changes in the app's release notes on the App Store and Google Play. If a change needs your consent by law, we will ask for it. If you continue to use Sprig after an update, the revised policy applies.

21. Contact

Secundum Reality (HOMEVISM SMC-PRIVATE LIMITED) · Islamabad, Pakistan · contact@homevism.com

See also: Sprig Terms & Conditions · About Sprig · Sprig Blog