Privacy notice
Last updated 12 November 2026
Sparrow (“Sparrow”, “we”) respects your privacy. This notice explains what personal information we collect, how we use and store it, and your rights under the New Zealand Privacy Act 2020 — including the data we receive through Akahu.
Who we are
Sparrow is a New Zealand business operated by Sam Ward as a sole trader, and is the agency that collects and holds the personal information described in this notice. You can contact us at hello@sparrowfinance.app.
Information we collect
When you connect a bank account we receive, through Akahu, your account names and balances and your transaction history — dates, amounts, descriptions, merchant names and categories. We collect this from Akahu only when you authorise the connection. We also process your email address, an optional phone number (if you enable SMS two-factor authentication), an account identifier, a subscription identifier, and limited non-financial app diagnostics.
What we do not collect
We do not collect your name, postal address, date of birth, or your bank login credentials. We also do not store your bank account number — each account is identified by the name your bank gives it and by Akahu’s reference for it.
How we use it
We use your financial data to automatically categorise and display your spending, calculate balances and insights, and keep everything up to date. We never sell your data, and we do not use it for advertising.
If you do not provide it
You need an account to use Sparrow, so we need your email address — without it we cannot create your account or sign you in. Connecting a bank account is optional, but without it there are no transactions to display, which is the app’s main purpose. Your phone number is optional and is only used if you enable SMS two-factor authentication. You can stop bank access at any time by revoking it.
Account identifiers
We identify your account with an identifier issued by our identity provider (Auth0) for our own application; the same value is your app user ID at RevenueCat. Akahu’s identifiers for your connected accounts and transactions are stored as references to those source records, not used to identify you elsewhere. We do not use identifiers assigned by other agencies — such as your IRD number or driver licence — to identify you.
Akahu and open finance
We access your bank data through Akahu Technologies Limited, New Zealand’s open finance platform, under the read-only consent you give. Akahu retains the financial data it exchanges and can access it using your user access token, and it stores that data in Amazon Web Services data centres in Australia. The token is stored on your device and is sent through our stateless backend only to exchange the one-time authorisation code; our backend does not retain the token. Akahu handles your data under the Akahu privacy notice. We never receive or store your bank login credentials.
Where your data is stored
Your transactions are stored on your device in an encrypted database (SQLCipher, AES-256), and your Akahu user access token is kept in the device’s secure store. We do not keep a server-side copy of your transaction history. Akahu retains the financial data as described above.
How we protect it
Your transactions are stored on your device in an encrypted database (SQLCipher, AES-256), and your Akahu access token is kept in the device’s secure store. Traffic between the app and our API uses TLS. Our API is stateless and holds no copy of your transaction history, server credentials are held in a managed secret store with least-privilege access, and we never receive or store your bank login credentials.
If something goes wrong
If a security breach affects your personal information and is likely to cause you serious harm, we will notify you and the Office of the Privacy Commissioner as soon as possible, as Part 6 of the Privacy Act 2020 requires, and we will tell Akahu, which holds the exchanged data, as our agreement with them requires. AWS, which hosts our API, is separately obliged to tell us promptly about any unauthorised access to data stored on its infrastructure, so that we can make that assessment.
Who we share it with
We do not sell or share your financial data for marketing. Akahu is our open-finance provider and retains the financial data described above. We use service providers for identity (Auth0), subscriptions (RevenueCat), and crash reporting (Sentry); they receive only the account details, purchase history, or non-financial diagnostics needed for those services. We do not send them your transaction history.
Overseas disclosure
Some of our providers hold information outside New Zealand. Akahu holds the financial data it exchanges in Amazon Web Services data centres in Australia. Auth0 (identity), RevenueCat (subscriptions) and Sentry (crash reporting) process data in the United States, and our API and website infrastructure runs on Cloudflare and Amazon Web Services (Sydney, Australia). The last group receives only the account details, purchase records or non-financial diagnostics described above — never your transaction history, which stays on your device and with Akahu. By creating an account and using Sparrow, you authorise us to disclose your information to these recipients outside New Zealand.
How long we keep it
We keep personal information only for as long as it is reasonably required, in line with the Privacy Act 2020. Your transactions and balances stay on your device until you delete the app or your account, and we keep no server-side copy. Your account details are held until you delete your account, and your subscription records are held by RevenueCat as its policy requires. Crash and performance diagnostics are held by Sentry under its retention period. Our API writes operational logs containing errors and warnings, never your transaction data, and keeps them for 365 days. Akahu retains financial data under its own policy, and your access token until you revoke access.
Revoking access
You can stop Sparrow reading your accounts at any time from Manage Connections in the app, or at my.akahu.nz. Revoking access stops all future syncing and ends Akahu’s access through your token. Data already stored on your device remains until you delete it.
Deleting your account
Deleting your account revokes our access to your connected accounts (via Akahu) and removes the financial data stored on your device. You can cancel your subscription separately through the App Store or Google Play.
Your rights
You can ask to access or correct the personal information we hold, and you can ask us to delete it. Email hello@sparrowfinance.app and we will respond within 20 working days, as the Privacy Act 2020 requires. Transaction data comes from your bank through Akahu, so if something in it is inaccurate, correcting it with your bank and re-syncing in the app updates it here. You may also complain to us, or to the Office of the Privacy Commissioner at privacy.org.nz.
Changes to this notice
We may update this notice from time to time. Material changes will be reflected here, along with a revised date above.
Contact us
Questions about privacy? Our privacy officer is Sam Ward. Email hello@sparrowfinance.app and we will respond within 20 working days.