← Auto Expense Tracker

Privacy Policy — Auto Expense Tracker

Last updated: September 16, 2026

Auto Expense Tracker ("the app") is an Android app that helps you track your spending automatically. This page explains what information the app accesses, what it does with it, and what it never does. We wrote this to be accurate and specific to how the app actually works, not generic boilerplate. This policy is kept in sync with the Data Safety declarations we file in Google Play Console — the two describe the same facts, so nothing here should contradict what's declared there.

The short version

Your financial transaction data is processed and stored only on your device, encrypted. We do not operate a server, and your transaction history is never uploaded anywhere, ever. The only network activity the app performs is talking to Google's own services — for optional ads, optional subscriptions, and update checks — none of which involve your financial data.

What the app reads

With your permission (Android's "Notification Access" setting, which you must explicitly grant and can revoke at any time), the app reads the text of notifications from your banking, UPI, and default messaging apps, specifically to detect transaction alerts (e.g. "Rs.500 debited...", "You received Rs.1200...").

Banks send these alerts from a registered sender code (e.g. "HDFCBK"), not a normal app or contact name. To detect alerts from banks that aren't on our known-app list, the app also checks the sender name of notifications from apps outside that list against the pattern used by these registered bank codes. Only the sender name is checked for such apps — the message text itself is not read unless the sender name matches this bank-code pattern. If it doesn't match, nothing about that notification is stored, logged, or leaves your device. The app does not read notification content from social media, chat apps, or anything unrelated to financial transaction alerts.

From a matching notification, the app extracts only:

• The transaction amount
• Whether it was money sent or received
• The date/time
• The counterparty name or account, where present in the message
• The account balance, where the message happens to include one

The original notification text itself is discarded immediately after these details are extracted. It is never saved to disk, never logged, and never leaves your device.

The app does not use SMS permissions of any kind. It never requests READ_SMS or RECEIVE_SMS. Notification Access is the only mechanism used to detect transactions.

What the app stores

The structured details above (amount, direction, date, counterparty, category, your own notes/tags) are stored in an encrypted database on your device, using industry-standard encryption (SQLCipher) with a key held in your device's own secure hardware (Android Keystore) where available. This data is never transmitted off your device — there is no backend server for this app to send it to.

You can export your data at any time (JSON backup, or CSV for spreadsheet use) directly to a location you choose on your own device or cloud storage — this is an action you take deliberately; the app does not do this automatically or without your action.

You can permanently delete all app data at any time from Settings.

What we never do

• We do not operate a server that receives your transaction data.
• We do not sell, share, or transmit your financial data to any third party.
• We do not use your transaction data for advertising targeting.
• We do not read notifications from apps unrelated to financial transactions.

Data that Google's own services process

The app uses a small number of Google services, which is the only network access the app has. This is separate from, and does not involve, your financial transaction data:

• Google AdMob (for the free tier's banner ads): collects your device's Advertising ID for ad delivery and frequency capping, subject to your ad-consent choice (EEA/UK users are shown a consent form on first launch, per Google's UMP requirements, and can change this choice any time from Settings → Privacy & Ad Consent). This Advertising ID is shared with Google for ad-serving purposes; the app itself does not otherwise share or sell it.
• Google Play Billing (for the optional Pro subscription): processes your purchase history for this app's subscription only. Payment details (card numbers, UPI IDs, etc.) are handled entirely by Google Play and never reach this app or its developer — we only ever see a subscription status (active/expired), not payment instrument details.
• Google Play's in-app update and in-app review features: check for app updates and, occasionally, prompt for a Play Store rating. Standard Google Play services, not custom infrastructure of ours.

See Google's own Privacy Policy for how these Google services handle data: https://policies.google.com/privacy

Security practices

• Encryption at rest: your transaction data is encrypted on-device (SQLCipher/AES-256) with a key held in Android Keystore hardware where available.
• Encryption in transit: not applicable to your financial data — it is never transmitted anywhere. The only network traffic this app generates is the Google services above, which use Google's own encrypted connections.
• Data deletion: there is no server-side account to delete, because there is no server. You can permanently erase all locally stored data at any time from Settings → Delete All Data, which takes effect immediately and cannot be undone. Uninstalling the app has the same effect, since nothing is stored anywhere else.

Permissions the app uses, and why

• Notification access — to detect bank/UPI transaction alerts, as described above.
• Notifications (POST_NOTIFICATIONS) — to show you bill reminders and unusual-spending alerts you've configured.
• Ignore battery optimizations (request only, never silent) — the app can ask to be exempted from aggressive battery management, so the notification listener isn't killed in the background and stops capturing transactions. You choose whether to grant this from a dedicated settings screen; nothing happens without you tapping through it.
• Biometric/fingerprint — only if you turn on the optional app lock feature, to unlock the app.
• Internet & network state — used only for the Google services described above; never for transmitting your transaction data.

Children's privacy

This app is a personal finance utility intended for general adult use and is not directed at children. We do not knowingly collect information from children.

Your choices

• You can grant or revoke Notification Access at any time from Android Settings.
• You can change your ad-consent choice at any time from the app's Settings screen.
• You can export or permanently delete all your data at any time from the app's Settings screen.

Changes to this policy

If this policy changes, we'll update the "Last updated" date above. Continued use of the app after a change means you accept the updated policy.

Contact

Questions about this policy or the app's data practices can be sent to: gaurav954624@gmail.com