Expendracker Privacy Policy

Effective 25 October 2026 · Applies to the Expendracker app for Android (com.expendracker)

Who we are

Expendracker is developed by J Vignesh, an individual developer in India. In this policy, "we" means the developer and "you" means the person using the app. Contact details are at the end.

SMS messages

With your permission, Expendracker reads SMS messages to find transaction alerts from banks and payment apps. It reads new messages as they arrive. If you choose to import past transactions, it also reads messages already in your inbox for the date range you pick.

From a transaction alert it extracts only:

• the amount and currency
• the merchant or payee name
• the transaction date
• whether money went out or came in
• the bank or UPI reference number
• the last digits of the account or card, such as 1234 in "a/c ****1234", if the message has them
• the bank's SMS sender name, such as VM-HDFCBK, which tells the app which bank it was
• the available balance, if the message shows one, which helps tell two accounts at the same bank apart

The full text of the message is not stored. Messages that are not transaction alerts, such as personal messages or one-time passwords, are discarded as soon as they are read. They are never stored, logged or sent anywhere.

SMS content, and data derived from it, is used only to record your spending. It is never used for advertising and never sold or shared.

Data stored on your phone

The app keeps a local database on your phone containing:

• the transaction details listed above
• expenses and income you enter by hand, including any notes
• the categories (labels) you create and assign

You do not need an account to use Expendracker, and we cannot see this data.

Google Drive backup (optional)

If you turn on backup, you sign in with your Google account and the app uploads a backup file of your transactions and labels to your own Google Drive. The file goes directly from your phone to Google. It never passes through a server of ours.

The app asks for Google's drive.file permission. With this permission, Google allows the app to see only files the app itself created. It cannot see any of your other Drive files.

You can turn backup off at any time in the app. To remove the backup, delete the file from your Google Drive. You can also withdraw the app's access at myaccount.google.com/permissions.

Android device backup

If you have Android's own backup switched on, Android may include Expendracker's local database in your device backup to your Google account. This is controlled by your phone's settings, not by us. The database does not contain SMS message text.

Purchases

Paid features are sold through Google Play. Google handles the payment, and we never receive your card or bank details. The app receives only a confirmation from Google Play that the purchase was made, so it can unlock the feature. Google's handling of payments is covered by the Google Payments Privacy Notice.

Notifications

With your permission, the app shows notifications, for example to ask which category a new merchant belongs to. Notifications are generated on your phone.

Crash reports

If the app crashes, or something inside it fails (such as a backup), it sends a crash report to Firebase Crashlytics, a Google service, so we can find and fix the problem. A report contains:

• what went wrong in the app's code: the type of error and where in the code it happened
• the app version, your Android version, and your phone's manufacturer and model
• technical details about the phone at the time, such as free memory and storage
• a random installation ID created by Crashlytics. It is not linked to you, your Google account or your phone number, and it changes if you reinstall the app
• a few facts about the app itself: its database version, whether backup is connected, and how many bank accounts it has found (a number only)

A crash report never contains your SMS messages, transactions, amounts, merchant or payee names, labels or account numbers. When something goes wrong while reading a message, the app reports the error without the message.

Crash reports are on by default. You can turn them off at any time in Settings › Privacy › Send crash reports, and nothing is sent after that. Google keeps crash reports for 90 days and processes them under the Firebase privacy and security terms.

Feedback sent from earlier versions

Versions of the app before 1.1.3 had a feedback form. If you used it, we received your message, the kind of feedback you picked, the app version, your Android version and your phone's manufacturer and model, but no transactions, SMS messages or identifier for you. Those messages are kept in a Google Sheet that only the developer can open, are used only to improve the app, and are never sold or shared. You can ask us to delete them (step 7 below). The form has been removed; to reach us now, email us from Settings › Contact us.

What we do not do

• We do not run servers that store or receive your spending data.
• We do not sell your data.
• We do not show ads or use advertising or analytics services. The only outside service the app reports to is crash reporting, described above.
• We do not share SMS-derived or spending data with anyone.

Deleting your Expendracker data

Expendracker has no accounts and no server, so the developer holds none of your spending data. You can delete all of it yourself. The only things held outside your phone are crash reports (step 6) and feedback you sent from an earlier version, which you can ask us to delete (step 7).

1. One transaction: open it in the app and tap delete.
2. Everything on your phone: go to Settings › Apps › Expendracker › Storage and tap Clear storage, or uninstall the app. This deletes all transactions, labels and settings immediately.
3. Your Google Drive backup (only if you turned backup on): open drive.google.com, search for Expendracker.backup, delete it, then empty the Drive trash. Google otherwise keeps items in the trash for 30 days.
4. Drive access: remove Expendracker at myaccount.google.com/permissions so the app can no longer write to your Drive.
5. Android device backup (if switched on in your phone's settings): delete your device backup in your Google account's backup settings, or wait for Google to replace it.
6. Crash reports: turn them off in Settings › Privacy › Send crash reports so no more are sent. Reports already sent are deleted automatically after 90 days. They carry no identifier we could use to find yours, so we cannot delete them sooner.
7. Feedback you sent (only if you used the feedback form in a version before 1.1.3): email vigneshj8133@gmail.com with the subject "Delete my Expendracker feedback", and roughly when you sent it and what it said, so we can find it. The form doesn't record who you are, so we can't find your messages without these details. We delete them within 30 days and reply to confirm.

What is deleted: every transaction (amount, merchant, date, direction, reference, note), your labels and your app settings. Feedback messages you ask us to delete are removed completely. What is kept: nothing by us, apart from feedback you have not asked us to delete; crash reports until they expire after 90 days. A backup unlock you bought stays on your Google Play account so you can restore it on a new phone. Questions: contact us at the address below.

Security

Backups and crash reports are sent over encrypted (HTTPS) connections. Only the Android system can deliver SMS to the app, so other apps cannot insert fake transactions. No method of storage or transmission is completely secure, so please keep your phone and Google account protected.

Children

Expendracker is intended for adults and is not directed at children. We do not knowingly collect information from anyone under 18.

Changes to this policy

If this policy changes, we will update it on this page and change the effective date at the top. Significant changes will also be announced in the app or on its Google Play listing.

Contact

Questions or requests about your privacy: vigneshj8133@gmail.com