Legal

Privacy policy

This explains what Vend16 collects, why, and what we do with it. Vend16 is run by Spruik Co Pty Ltd in Australia, and we handle personal information under the Australian Privacy Principles.

Last updated 24 September 2026.

What we collect about you

Your email address, a hashed password or your Google account email if you sign in with Google, the apps you create and their settings, and billing records from Stripe. We never see or store card numbers; Stripe handles payment.

What we collect about your app’s users

Only what you and the app stores send us: the purchase details Apple and Google provide (product, transaction IDs, dates, price where the store includes it) and the user ID your app gives us. We do not ask for names, emails or device identifiers of your users, and you should not send them as the user ID.

Why we use it

To verify purchases, keep subscription records, send you the events and alerts you ask for, bill you, and contact you about your account. We do not sell data or use it for advertising.

Alerts and push notifications

If you turn on alerts, we email you, or send a push notification to the phones you choose, when your apps make sales, get refunds and the other events you pick. For push notifications we keep each phone’s push token (a code Apple or Google issues so a notification can reach that phone), whether it is an iPhone or an Android phone, the app version, its language and when it was last used. Apple and Google deliver the notifications. A phone’s token is deleted when you sign out on that phone, remove it in Alerts, or Apple or Google tell us it no longer works. We keep a copy of each alert we send for 30 days, then delete it. Alerts show the product and price, never your customer’s user ID.

Website analytics

We count visits to this website with Umami, which we host ourselves and which sets no cookies. We also use Google Analytics, which sets cookies and sends Google anonymised information about how the site is used (pages viewed, rough location, device type). You can block it with any ad or tracker blocker, or with Google’s opt-out browser add-on. Analytics never run inside the dashboard, inside our iPhone and Android app, or on the password reset pages.

Google sign-in

If you sign in with Google we receive your name, email address and Google account ID, and use them only to create and sign in to your account.

Where it’s stored

On our servers in Germany (Hetzner). Google Play service account keys you upload are encrypted at rest. We keep nightly backups for 14 days.

Who we share it with

Apple and Google, to verify purchases and to deliver push notifications; Stripe, for billing; Send16, to deliver account and alert emails. Otherwise only if the law requires it.

How long we keep it

While your account is open. You can delete everything we hold about one of your app’s users, or about one purchase, at any time through the API (see Delete a user’s data); we then keep only a count of the purchases deleted, for plan limits, and nothing about who or what they were. Delete your account (in the app: More, then Delete account; on the web: Account) and we delete it, your apps and their purchase records straight away, apart from billing records we must keep for tax. See Delete your account.

Your rights

You can ask to see, correct or delete your information at any time by emailing hello@spruik.co. If you are unhappy with our response you can contact the Office of the Australian Information Commissioner.

Questions: hello@spruik.co. Spruik Co Pty Ltd, ABN 61 695 444 645.