Privacy Policy

1. Information the app handles

Depending on the features you use, information may include:

• Account information: your Google account email, authentication identity and session credentials used to sign in and keep your app records associated with your account. Google and our authentication provider may also supply basic profile information, such as your name or profile image.
• Financial records: account names and types, currencies, balances, transaction amounts and dates, categories, subcategories, merchants, notes, labels, recurring plans, budgets, savings goals, debts, loans and project records.
• Documents you choose: receipt images, warranty details, photos and project documents, including information visible in those documents.
• Preferences and learned rules: language, appearance, exchange rates, monthly cycle settings, templates, reminders and financial-message classification rules you choose to remember.
• Technical information: our hosting and authentication providers may process IP addresses, request times, browser/device information and security or error logs necessary to deliver and protect their services.
• Support correspondence: information you send when asking a question or requesting data deletion.

Do not enter bank passwords, card security codes, authentication codes or other credentials in transaction notes or uploaded documents. We do not need them.

2. How information is used

Information is used to display and organize your records, calculate summaries, budgets and balances, prepare drafts, remember your chosen classifications, provide reminders and widgets, authenticate you, synchronize records when enabled, process backups and imports, respond to requests, and maintain security and reliability. We do not initiate bank transfers, purchase financial products or make lending decisions from your records.

3. Optional SMS access and message processing

The current Android release requests READ_SMS only when you choose to enable SMS inbox access. This permission can expose received SMS messages, including personal messages, sender details and timestamps. The app uses this access to display inbox messages and support its SMS widget and financial-transaction draft review. Messages are parsed on your device to suggest an amount, account, merchant, category or subcategory. Suggestions can be wrong; review them before saving.

The current release does not request permission to send SMS or automatically receive incoming SMS broadcasts. It does not send, delete or mark your messages as read, and does not use a notification-listener service. The companion website cannot read your phone’s SMS inbox. You can paste a message manually without granting SMS permission.

Reading or opening an SMS does not upload your inbox. Raw SMS inbox bodies and the local SMS archive are excluded from the current Android relational sync. Financial details that you save as transactions, and classification/format rules you choose to remember, can be included in backups and cloud sync. These rules may contain sender identifiers, account-matching text or short surrounding text from a message. Notes or documents you deliberately save may also contain message information. You may revoke SMS permission in Android Settings at any time; manual tracking remains available.

4. Receipts, documents, photos and device features

Receipt text recognition runs on the device or in your browser using OCR software. An image is not sent to an external AI service for OCR. If you save a receipt image, warranty attachment or project document into your records, that saved content can be backed up and synchronized with those records.

The app uses system camera or file-selection interfaces when you request them. Browser camera/file access depends on your browser’s permission and selection controls. On Android, notification permission supports reminders you enable. Home-screen widgets may display financial information where other people can see your screen. Device lock or biometric verification, where available, is handled by Android; the app does not receive or store your fingerprint or face template.

5. Local storage, sign-in and cloud synchronization

Android: app vault records, account sessions and synchronization journals are stored locally using encryption backed by Android Keystore. Original offline records and Google-account profiles are kept separately. Google sign-in enables cloud synchronization with Supabase; signing out does not automatically delete either cloud records or retained local profiles.

Web: the companion app uses browser storage, including IndexedDB and authentication session storage, to keep a local working copy and maintain sign-in. Browser storage does not have the Android vault’s app-managed encryption. Use a trusted device and protect its user account.

Network communication with cloud services uses HTTPS. Cloud records are protected by authentication and account-level access controls. Cloud synchronization is not end-to-end encryption with a key known only to you: authorized service administration and infrastructure providers may access stored data where necessary to operate, support or secure the service. No storage or transmission method is completely secure.

6. Sharing and service providers

We share information only as needed to provide the features you use, comply with legal obligations, protect security, or carry out a sharing action you request:

• Google: provides Google sign-in and, for Play installations, app distribution and platform services. We do not receive your Google password.
• Supabase: provides authentication and cloud database services. When you use cloud sync, it processes account identifiers and the synchronized records and attachments described above.
• Cloudflare: hosts and delivers the companion website and this policy and may process network/security request information.
• Your chosen recipients and applications: if you export or share a backup, receipt or document, the destination you choose receives it. Your email provider processes messages you send to support.

These providers may process information in countries other than your own under their service arrangements and privacy policies. See Google’s privacy policy, Supabase’s privacy policy and Cloudflare’s privacy policy. We do not sell or rent personal information, provide financial records to advertisers, or include advertising or cross-app advertising-tracking SDKs in the current app.

7. Browser storage and cookies

The website uses browser storage to provide sign-in, retain session state, remember preferences and keep a working copy of financial records. Service providers may use cookies or similar mechanisms for authentication and security on their own services. We do not use these records for behavioral advertising. Clearing site storage can remove local copies and unsynchronized changes, but does not delete cloud records.

8. Retention and backups

Local records remain until you delete them or remove the relevant app/browser storage. Cloud records remain while your account and records are retained, unless you request deletion. Uninstalling the app, signing out or revoking SMS permission does not delete your cloud account.

Record deletion during synchronization may keep a deletion marker (tombstone) and recovery/journal information so other devices do not recreate deleted records. Therefore deleting a visible record is not the same as requesting complete account/data erasure. Provider backups, security logs and technical recovery copies may persist according to the provider’s configured retention and legal requirements. We will explain any applicable retained data when responding to a verified deletion request rather than promise immediate removal from every backup.

Exported JSON backups and documents remain wherever you save or share them, outside the app’s control. Backup files can contain readable financial information and images; store them securely and delete unwanted copies yourself. Older backups may restore data you previously deleted.

9. Your choices and account/data deletion

You can review and edit your records, export a backup, change notification preferences and revoke optional device permissions. To request access, correction, deletion of particular cloud records, or deletion of your Financial Tracker / Financial Advisor account and associated cloud data, email im.ahmed.faisal@gmail.com.

For deletion, use the subject Financial Tracker account and data deletion, identify the Google email used to sign in and say whether you want the whole app account deleted or only specified data removed. Send from that email where possible. Do not send your password, verification codes, full bank/card credentials or a financial backup. We may verify ownership before acting to prevent someone else deleting your records. We will confirm the scope and explain any necessary retention exceptions. A request can be made without reinstalling the app or signing into this website.

Account deletion concerns your app authentication profile and associated app cloud records, including financial records, saved documents and learned rules. It does not delete your Google account. Copies already exported/shared, and offline data on devices we cannot access, require separate removal. Stop using sync on other devices while deletion is being processed and remove retained local copies to avoid later re-importing them.

Depending on your location, additional privacy rights may apply, including access, correction, erasure, restriction or objection, portability, and contacting your local data-protection authority. Contact us to exercise applicable rights.

10. Children

Financial Tracker is a general personal-finance tool and is not directed at children under 13. We do not knowingly solicit their personal information. If you believe a child has provided personal information, contact us so we can review and address it.

11. Policy changes

We may update this policy when features or data practices change. The current version and effective date will be published here. Where required, we will provide additional notice or seek permission before a materially different use of personal information.

12. Contact

For privacy questions and requests concerning Financial Tracker, previously Financial Advisor, contact im.ahmed.faisal@gmail.com.