Privacy policy
Expense Tracker is a personal finance app. It has no ads, does not sell your data, and does not share it with other companies for their marketing. Data is used only to run the app for you.
Who is responsible
Poelys.com operates this app and is the organisation responsible for the personal data described here. Questions and requests: kuntimaddithrishank@gmail.com.
What is stored, and where
- Your account. Your email address and name from Google or email sign-in, held with Firebase Authentication.
- Your entries and settings. Expenses, income, bills, budgets, goals, trips, debts, recurring rules and preferences, stored under your account in Google Cloud Firestore so they can sync across your devices. Database rules are written so only you can read your entries.
- Your devices. A name such as the phone or browser you use, when it was last open, and whether the app lock is on, so you can see and sign out of your devices.
- App lock. If you turn it on, a salted one-way hash of your PIN (never the PIN itself) and a log of security events such as repeated wrong PINs. Fingerprint and face unlock happen on your device; nothing biometric leaves it.
- Notifications. A push token per device and your upcoming reminders, so they can be delivered while the app is closed. The app may also use exact alarms on Android to fire those reminders on time.
- Usage activity. Your email and name, when your account was created, when you last opened the app and last added an entry, how many entries you have, how often you open it, and which app and version you use. This list is used only to understand how the app is used and to improve it. It never includes amounts, what your entries are, or any other part of your money data, and it is deleted when you delete your account.
Google Drive backup
If you turn on Drive backup, the app saves copies of your data to a folder named “Expense Tracker backups” in your own Google Drive. It asks only for the drive.file permission, which lets it see the files it creates and nothing else in your Drive. The app talks to Drive directly from your device; Poelys.com does not keep a copy of your backups or of your Google access. You can delete the backups from Google Drive at any time.
Expense Tracker’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Auto-capture payments (Android, optional)
This is off until you turn it on in the app (Profile → Auto-capture payments). Each source needs your permission in Android. The feature exists so you can add a real payment to your own expense log with one tap. It is not used to sell data, show ads, or build a profile of you.
- UPI app notifications (Android “Notification access”): the app looks only at notifications from payment apps (Google Pay, PhonePe, Paytm, BHIM, CRED, Amazon Pay, MobiKwik, WhatsApp) and SMS apps. Other apps’ notifications are ignored.
- Bank SMS (Android’s SMS permission,
RECEIVE_SMSonly): the app looks only at new messages from business senders (for example “AD-HDFCBK”) that mention an amount. Messages from people (phone numbers) are ignored. The SMS inbox is never read, and the app does not useREAD_SMS.
Messages that look like a completed payment are kept on your phone only, for up to 30 days, and shown on Home as “Add this payment?”. OTPs, requests and reminders are skipped. Nothing is uploaded or saved to your account unless you tap Add — then only the entry (amount, name, date), not the original message. Turning the feature off deletes everything it kept on the device.
Invites
Your invite code is stored with your account. If you create an account from a friend’s invite link, a record says which account invited yours and when you added your first entry. Your friend can see how many people joined, never who, and never anything about your money.
Bank statements
When you import a statement, the file is read on your device. It is never uploaded; only the entries you choose to add are saved to your account.
Emails we may send
If app lock is on, you may get an email at your account address about security events (for example, repeated wrong PINs). There is no marketing email.
Services used (processors)
- Google Firebase (Authentication, Firestore, Cloud Messaging) — to host your account, sync your data and deliver push notifications.
- Google Drive, if you turn on backup — files stay in your Drive.
- Exchange rates from public sources (including jsDelivr / Cloudflare Pages and the European Central Bank via Frankfurter). These requests contain dates and currencies, never your personal or financial entries.
These providers process data on Poelys.com’s instructions, or — in the case of your Google Drive — on yours, to provide the feature you switched on.
Retention
Account data and entries are kept until you delete them or delete your account. Auto-capture messages that you have not added stay on the device for up to 30 days, or until you turn the feature off. Push tokens are removed when you sign out of a device. Usage activity is deleted with your account.
Your choices
- Export everything as JSON or CSV at any time (Profile → Your data).
- Delete all your data, or your whole account, from Profile. Deletion from our database is immediate. Backups in your Google Drive stay until you delete them. A step-by-step guide is on the delete account page. You can also write to kuntimaddithrishank@gmail.com.
- Sign out any device from Profile → Security.
Unused accounts
If you have not opened the app for 25 days or more, Poelys.com may email you at your account address and, with your agreement, close the account. Closing switches off sign-in and moves your data aside. It is kept for 90 days so it can be restored if you ask, and is then deleted for good. Nobody reads the kept data. Write to the address above to have it restored.
Children
Expense Tracker is not directed at children and is not intended for anyone under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, write to kuntimaddithrishank@gmail.com and the account and its data will be deleted.
Changes
If this policy changes, the updated version will be posted at https://expensetracker.poelys.com/privacy/ with a new effective date.
Contact and grievances
Poelys.com · https://poelys.com
Support and Grievance Officer: kuntimaddithrishank@gmail.com
Complaints or grievances about this app or how your data is handled can be sent to the Grievance Officer at the email above. We aim to acknowledge them within 24 hours and resolve them within 15 days.