Your Data Stays on Your Device

How Your Data Is Protected

1. Privacy-First Design Philosophy

Expense Tracker is built with a fundamental commitment to privacy. Unlike most financial applications, we believe your financial data should remain completely under your control.

2. Data Collection and Storage

2.1 What we never collect from core tracking

• Personal financial information (expenses, income, budgets, accounts, debts, investments)
• Bank account details, card numbers, UPI IDs, or payment credentials
• Location data
• Advertising or behavioural tracking data

2.2 What you may choose to share with us

• Feedback (optional): star rating, name if provided, comment, timestamp, app version, and browser user-agent — sent to our Google Apps Script endpoint so we can read it.
• Contact/support (optional): name, email, subject, message, and reCAPTCHA token — sent to our Google Apps Script endpoint and verified via Google reCAPTCHA.
• Premium purchase (optional): Razorpay order ID, payment ID, and signature are exchanged through our Cloudflare Worker to verify payment and issue a device licence. Card, UPI, and bank details go directly to Razorpay and are never visible to us.
• Device-to-device transfer (optional, Premium): your full backup travels directly between your devices over a peer-to-peer WebRTC connection after you scan a QR code. PeerJS signalling and Google STUN servers help establish the connection.

2.3 What we store locally on your device

3. No Account Required

Expense Tracker eliminates the biggest privacy risk in financial applications: the account system. There is no tracker login, so there are no tracker credentials to phish or leak. If you email us or pay for Premium, we receive only what is needed for that task.

• Eliminate the need to store personal identifiers for tracking
• Remove the risk of a central financial-data breach — we operate no financial-data servers
• Ensure your day-to-day tracking stays anonymous to us
• Give you full control over your data lifecycle

4. Offline-First Architecture

All financial calculations, analytics, receipt OCR, and report generation happen locally on your device, and core tracking works offline after the first load. A network connection is required for the initial load and for any feature you invoke that needs one: Premium checkout and verification, feedback, contact, device-to-device transfer, and delivery of app assets, fonts, and libraries.

4.1 Device permissions

• Camera: used only when you scan a receipt or a transfer QR code. Images are processed locally with on-device OCR.
• Microphone: used only when you tap voice input. Transcription uses your browser's Web Speech API, which may send audio to your browser vendor's speech service depending on your browser and OS.
• Notifications: budget, bill, recurring, and expiry reminders are generated and shown locally. No notification content leaves your device.
• Biometrics and passcode: the optional app lock uses a locally stored passcode hash and on-device WebAuthn biometrics. Biometric data never leaves your device and is never visible to us. The lock deters casual access but does not encrypt stored data.

5. Data Portability and Export

CSV import is available on all plans and is processed locally. CSV export, backup, downloadable reports, and QR-based device-to-device transfer are Premium features. Transfers send your full backup (transactions, expiries, purchases, categories, budgets, accounts, recurring schedules, goals, currency) directly to your other device — only pair with a device you trust, in person, on a network you trust.

6. Payment Processing

Premium (currently ₹49 INR one-time, regular price ₹99) is processed through Razorpay via our Cloudflare Worker, which creates orders and verifies payment signatures. We receive only order and payment IDs and verification results — never card numbers, UPI IDs, or bank credentials. Razorpay retains transaction records under its own policy. Your Premium licence is stored locally; clearing browser data may require re-activation with your Razorpay Payment ID or unlock code.

7. Cookies and Tracking

We do not run ads and do not use analytics or advertising trackers. What is stored or set:

• Essential local storage (no cookies): your financial records (IndexedDB), preferences such as theme and consent choice (LocalStorage), and offline assets (Cache Storage).
• Third-party storage set only when you use that feature: Google reCAPTCHA (contact form spam prevention) and Razorpay Checkout (payment) may set cookies or equivalent storage and receive your IP address and browser details. Google Fonts loads stylesheets and receives standard request data (such as IP address) when pages load.

8. Security Measures

We use HTTPS in transit, Firebase Hosting delivery, browser sandboxing, and regular updates. Local data benefits from browser sandboxing but is not encrypted at rest — anyone or any script with access to your browser profile could read it. Use device-level security (screen lock, trusted browser and extensions) alongside the optional in-app passcode or biometric lock.

9. Third-Party Services

Core tracking uses no third-party data services. When you load the site or invoke a connected feature, these providers are involved:

• Firebase Hosting: delivers the website and app.
• Cloudflare Workers (Razorpay proxy): creates Razorpay orders and verifies payment signatures for Premium.
• Razorpay: processes Premium payments (checkout script loaded only during purchase).
• Google Fonts: loads display fonts on marketing pages.
• Google reCAPTCHA: protects the contact form from spam.
• Google Apps Script: receives in-app feedback and contact-form messages you send.
• PeerJS Cloud + Google STUN servers: establish your opt-in Premium device-to-device transfer connection (financial payload flows peer-to-peer).
• CDN libraries (jsDelivr, Unpkg): deliver open-source transfer and QR libraries for the app.
• Browser speech service: may transcribe voice input, depending on your browser.

No data-analytics or advertising services are used. Each third party processes standard technical data (such as IP address) under its own policy.

10. Data Retention and Deletion

Financial records stay on your device until you delete individual entries or clear all application data (Settings → Clear All Data) or clear browser storage. Clearing storage also removes your locally stored Premium licence — keep your Razorpay Payment ID for re-activation. Feedback and support messages you send are retained to handle your request. Razorpay retains payment records under its policy.

11. Children's Privacy

Expense Tracker is a general-purpose finance tool and is not directed at children. In India, where our pricing is offered in INR via Razorpay, a child is a person under 18 — we do not knowingly collect personal information from children, and parents or guardians should supervise any use by minors and use the contact details below to request deletion of any inadvertently shared information.

12. International Data Transfers

Your financial records are not transferred internationally by us — they stay on your device unless you export or transfer them. When you use a connected feature, the listed third parties (for example Google, Cloudflare, Razorpay infrastructure, PeerJS/STUN) may process technical or task-specific data on servers outside India under their own policies.

13. Your Privacy Rights

You can access, correct, delete, and — on Premium — export your financial records at any time on your device. To request access, correction, or deletion of feedback or support messages you sent us, email expensetrackerlive@gmail.com.

14. Changes to This Privacy Policy

We may update this privacy policy to reflect changes in our practices or for legal and regulatory reasons. Material changes will be posted on this page with an updated revision date.

15. Contact Information

If you have questions about this privacy policy, email us at expensetrackerlive@gmail.com or use the form on our Contact page.